Dn/navarch 11

.dockerignore

@@ -0,0 +1,3 @@
+**/snapshots
+**/seed
+.gitignore

.git-crypt/.gitattributes

@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary

.gitattributes

@@ -0,0 +1,3 @@
+templates/envs/** filter=git-crypt diff=git-crypt
+templates/secrets/** filter=git-crypt diff=git-crypt
+templates/tomls/** filter=git-crypt diff=git-crypt

.github/workflows/fly-deploy.yml

@@ -0,0 +1,24 @@
+# See https://fly.io/docs/app-guides/continuous-deployment-with-github-actions/
+
+name: Fly Deploy
+on:
+  push:
+    branches:
+      - main
+jobs:
+  deploy:
+    name: Deploy app
+    runs-on: ubuntu-latest
+    concurrency: deploy-group    # optional: ensure only one action runs at a time
+    strategy:
+      matrix:
+        instance: ["navarch", "navarch-11", "brokenhillmines"]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Flyctl
+        uses: superfly/flyctl-actions/setup-flyctl@master
+      - name: Set APP_NAME
+        run: echo "APP_NAME=${{ matrix.instance }}" >> $GITHUB_ENV
+      - name: Source environment variables
+        run: |
+          ./deploy.sh ${{ matrix.instance }}

.gitignore

@@ -102,3 +102,17 @@ dist
 
 # TernJS port file
 .tern-port
+
+**/snapshots
+
+*.DS_Store
+
+# Generated by flyctl launch with our template
+fly.toml
+
+nav-apps-dev-71da-e069131b2888.json
+
+uploads/
+
+package-lock.json
+package.json

.gitpod.yml

@@ -4,7 +4,7 @@ image:
   file: .gitpod.Dockerfile
 
 ports:
-  - port: 3000
+  - port: 8055
     onOpen: notify
 
 tasks:

Dockerfile

@@ -1,21 +1,25 @@
 # base node image
-FROM node:16-bullseye-slim as base
+FROM node:18.17-bullseye-slim AS base
 
 # set for base and all layer that inherit from it
-ENV NODE_ENV production
+ENV NODE_ENV=production
 
-RUN apt-get update && apt-get install -y openssl sqlite3
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends openssl sqlite3 python3 build-essential postgresql-client && \
+    rm -rf /var/lib/apt/lists/* && \
+    yarn config set python /usr/bin/python3
 
 # Install all node_modules, including dev dependencies
-FROM base as deps
+FROM base AS deps
 
 WORKDIR /myapp
 
 ADD package.json .npmrc ./
 RUN npm install --production=false
+#  --target_arch=x64 --target_platform=linux --target_libc=glibc
 
 # Setup production node_modules
-FROM base as production-deps
+FROM base AS production-deps
 
 WORKDIR /myapp
 
@@ -26,17 +30,34 @@ RUN npm prune --production
 # Finally, build the production image with minimal footprint
 FROM base
 
-ENV DATABASE_URL=file:/data/database/data.db
-ENV PORT="6055"
+ENV PORT="8055"
 ENV NODE_ENV="production"
 
 # add shortcut for connecting to database CLI
-RUN echo "#!/bin/sh\nset -x\nsqlite3 \$DATABASE_URL" > /usr/local/bin/database-cli && chmod +x /usr/local/bin/database-cli
+# RUN echo "#!/bin/sh\nset -x\nsqlite3 \$DATABASE_URL" > /usr/local/bin/database-cli && chmod +x /usr/local/bin/database-cli
 
 WORKDIR /myapp
 
-COPY --from=production-deps /myapp/node_modules /myapp/node_modules
+ARG APP_NAME
+ENV APP_NAME=${APP_NAME}
 
-ADD . .
+# TODO: Use ARG to pass in which env and toml file to use
+COPY --from=production-deps /myapp/node_modules /myapp/node_modules
+COPY ./uploads/. /myapp/uploads/.
+COPY ./templates/secrets/${APP_NAME}/. .
+COPY ./templates/envs/${APP_NAME}.env .env
+COPY ./templates/tomls/fly.${APP_NAME}.toml fly.toml
+COPY ./templates/deps/${APP_NAME}/package.json package.json
+COPY ./templates/deps/${APP_NAME}/package-lock.json package-lock.json
+
+# TODO: This is potentially adding other companies secrets.
+# May be better to add files individually which are needed.
+# ADD . .
+
+# Seed not ready yet
+# ADD seed ./seed
+COPY extensions ./extensions
+COPY fonts ./fonts
+COPY start.sh .
 
 CMD ["bash", "start.sh"]

README.gitcrypt.md

@@ -0,0 +1,137 @@
+# Granting Access to a `git-crypt` Encrypted Repository
+
+This guide explains how to securely grant another user access to a `git-crypt` encrypted repository.
+
+---
+
+## TL;DR (Quick Commands)
+
+### For the User Requesting Access (Person B)
+
+```bash
+# Generate GPG key pair
+gpg --full-generate-key
+
+# Export and share public key
+gpg --export --armor <[email protected]> > your-public-key.asc
+```
+
+### For the Repository Admin (Person A)
+
+```bash
+# Import the public key of the user requesting access
+gpg --import their-public-key.asc
+
+# Add the user to git-crypt
+git-crypt add-gpg-user [email protected]
+
+# Commit and push changes
+git add .
+git commit -m "Grant access to [email protected]"
+git push
+```
+
+### For the New User (Person B)
+
+```bash
+# Clone the repository
+git clone <repository-url>
+cd <repository-directory>
+
+# Unlock with your private key
+git-crypt unlock
+```
+
+---
+
+## Detailed Steps
+
+### 1. User Requesting Access (Person B)
+
+Person B generates their GPG key pair and shares their public key with the repository admin.
+
+```bash
+# Generate GPG key pair
+gpg --full-generate-key
+```
+
+#### Choose these options during setup:
+
+- **Key type:** RSA and RSA
+- **Key size:** 4096 bits
+- **Key validity:** 0 (does not expire)
+- **Email address:** Enter your email (e.g., `[email protected]`)
+- **Passphrase:** Set a secure passphrase.
+
+Export the public key:
+
+```bash
+gpg --export --armor [email protected] > b-public-key.asc
+```
+
+Send the `b-public-key.asc` file to Person A.
+
+---
+
+### 2. Repository Admin (Person A)
+
+Person A adds Person B's public key to the repository.
+
+1. **Import the public key:**
+
+   ```bash
+   gpg --import b-public-key.asc
+   ```
+
+2. **Grant access using `git-crypt`:**
+
+   ```bash
+   git-crypt add-gpg-user [email protected]
+   ```
+
+3. **Commit and push changes:**
+
+   ```bash
+   git add .
+   git commit -m "Grant access to [email protected]"
+   git push
+   ```
+
+---
+
+### 3. User Unlocking the Repository (Person B)
+
+Once Person B has been added, they can access the repository.
+
+1. Clone the repository:
+
+   ```bash
+   git clone <repository-url>
+   cd <repository-directory>
+   ```
+
+2. Unlock the repository:
+
+   ```bash
+   git-crypt unlock
+   ```
+
+This will use Person B's private key to decrypt the files.
+
+---
+
+## Key Points
+
+- **Private/Public Key Responsibilities:**
+  - The user requesting access (Person B) generates their own key pair.
+  - Only the public key is shared with the repository admin (Person A).
+
+- **Security of Private Key:**
+  - The private key should never be shared. It is used locally to unlock the encrypted files.
+
+- **Revocation:**
+  - Access can be revoked by removing the public key from `git-crypt` and re-encrypting the repository.
+
+---
+
+Include this guide in your repository to simplify the onboarding process for users requesting access!

README.md

@@ -77,7 +77,7 @@ You can change this by following Fly's DNS docs and then just update the secret
 We also need to create a volume in Fly to persist our app data (SQLite DB) so that Fly can persist the data stored across deployments and container restarts. Again, we can do that using the Fly command line.
 
 ```bash
-flyctl volumes create data --region [REGION] --size 1
+flyctl volumes create data --region [REGION] --size 1 --yes
 ```
 
 > Note: REGION should be the region selected when launching the app. You can check the region chosen by running `flyctl regions list`.
@@ -101,7 +101,7 @@ We are ready for our first deployment.
 
 You have two ways to deploy:
 
-- Via `npm run deploy`: deploy the current folder
+- Via `npm run deploy`: deploy the current folder (this has memory set to 512MB, otherwise Directus will crash with OOM)
 - Via Github actions.
 
 GitHub actions workflows are configured to run on push to the `main` branch. 
@@ -133,3 +133,41 @@ There are two ways to add extensions:
 2. Installed inside the `extensions` folder.
 
 This works the same as any other Directus installation
+
+### Fetching files from the live app
+Run the following command to fetch files from the project root
+`fly sftp get <REMOTE_FILE_PATH> <LOCAL_FILE_PATH_TO_SAVE_TO>`
+
+To check if the file is there, run the following command instead
+`fly sftp find <REMOTE_FILE_PATH>`
+
+### Stop/start the current machine
+To stop a running machine, run `fly machine stop` in the project root.
+
+To start a stopped machine, run `fly machine start` in the project root.
+
+For both commands, options will appear, select the machine by pressing Spacebar and hit Enter.
+
+### New features to deploy
+Run `npm run deploy` and wait for health check to complete. If it fails, then will need to check Monitoring logs to debug.
+
+## Debugging
+### Database
+```
+If it cannot find the data.db file location, it is possible that a .dockerignore file was generated and configured to ignore the .env file. If that is the case, comment it out from the .dockerignore file. This is a temporary solution until a better way to pass in configs is found.
+```
+
+### Deployment
+For this error
+```
+Error failed to fetch an image or build from source: error connecting to docker: failed building options: failed probing “navarch”: context deadline exceeded
+```
+
+Run the following commands
+```
+fly version update (get the latest version, or however you prefer to do that)
+fly wireguard websockets enable
+fly xxxx (whatever flyctl commands you wanted to run when you got the error)
+```
+
+If that fails, run `fly doctor report` to debug further

README.newinstance.md

@@ -0,0 +1,28 @@
+# Create New Instance For New Client
+
+## Prerequisite
+
+1. Ensure flyctl / fly CLI is [installed](https://fly.io/docs/flyctl/install/), then use `fly auth login` to login to your fly.io account on which you've been added to the navarch org.
+
+## Steps
+
+1. Create a new project in [Neon](https://console.neon.tech/). Then, make sure a few steps are done here:
+    - Go to the dashboard of the new DB and select "Create Database" and create a new one called `navarch_db` where we'll use instead of the default of `neondb`.
+    - Then, select "Create Role" and create a new one called `admin` where we'll use instead of the default of `neondb_onwer`. These are important steps for data seeding to work correctly.
+2. Create a new app in the fly.io [Navarch org](https://fly.io/dashboard/navarch). This is best done using [script](./deploy.sh).
+3. Create a [new service account](https://console.cloud.google.com/iam-admin/serviceaccounts?project=nav-apps-prd-7443&supportedpurview=project) with the naming convention of `nav-[client_name]`. **DO NOT** grant any roles when creating the service account. We don't want this service account to have access to other buckets in other companies.
+4. Create a [new bucket in GCP](https://console.cloud.google.com/storage/browser?project=nav-apps-prd-7443) to store client data. Use the exact same naming convention of `nav-[client_name]`.
+5. Navigate to the newly created bucket, select the "Permission" tab and add the service account as "Storage Object Admin" to this bucket. The principal to add is for example: `nav-[client_name]@nav-apps-prd-7443.iam.gserviceaccount.com`.
+6. Navigate back to the Service Account that was newly created, create a new JSON key. Store the file into the secrets directory.
+7. Duplicate and populate important information for the `.toml` and `.env` files:
+    - Create a new file in [tomls](./templates/tomls/) for the new client, populate important info.
+    - Create a new file in [envs](./templates/envs/) for the new client, populate important info.
+8. Deploy the changes to fly.io under the navarch org. To do that, you'll need to copy some sensitive values from the `[client_name].env` file and replace the `deploy.sh` script, and run `./deploy.sh [clientname]` to deploy to fly.io. Make sure you open the URL to kick start the application and iterate the configs until you get a successful instance running.
+    - Be sure to update the Dockefile if deploying for 'navarch' test instance
+9. We can now seed the database (`navarch_db`) with our data.
+    - Depending on whether you have a clean export of a database we can start with, you may need to dump it from a known good Navarch instance. Inspect the [db-1-backup.sh](./db-1-backup.sh) and change the env path before running to dump a copy of `navarch_*` schemas to your local machine.
+    - Then, inspect the [db-2-restore.sh](./db-2-restore.sh) and change the env path before running to load the dumped data into the new database for the new client.
+10. Enter Neon DB console again and enter the newly seeded database. Delete from the following tables everything that can be deleted that are not constrained by deletions, or use the [db-3-restore.sh](./db-3-cleanup.sh) script to perform a clean up of the new instance.
+    - directus_files
+    - directus_users
+    - directus_activity