Test Organization:
- Create tests/unit/, tests/integration/, tests/system/ directories
- Move existing tests into appropriate categories
- Add pytest markers (@pytest.mark.unit, @pytest.mark.integration)
Shared Fixtures:
- Create conftest.py with SQLite engine (for unit tests)
- Add PostgreSQL session fixture with transaction rollback
- Add TestClient fixture for API tests
Configuration:
- Update pyproject.toml with asyncio_mode=auto
- Add test markers and default addopts
- Add aiosqlite dependency for SQLite support
E2E Testing:
- Initialize Playwright in e2e/ directory
- Add playwright.config.ts
- Create login flow E2E test
Build:
- Add test-unit, test-integration, test-system, test-e2e to Makefile
- Update test target to run all categories
- Add testing documentation to README
Note: Some tests have import issues due to missing python-jose
package in dev environment. This needs to be addressed separately.
Vite reads env vars at build time, not runtime. The previous setup
only set them in docker-compose 'environment' which is only available
at container runtime. Now they are passed as build args so Vite can
embed the correct API URL during the build process.
- Add build args to web service in both compose files
- Update Dockerfile to accept ARGs and set ENV for Vite
- Fixes login redirect always going to localhost:8000
The frontend code uses VITE_API_BASE_URL but docker-compose files
and .env.example were setting VITE_API_URL, causing the login
redirect to fall back to localhost:8000.
- Update docker-compose.traefik.yml: VITE_API_URL → VITE_API_BASE_URL
- Update docker-compose.yml: VITE_API_URL → VITE_API_BASE_URL
- Update .env.example: VITE_API_URL → VITE_API_BASE_URL
In Traefik deployment, API and web are on different domains.
Frontend was using relative paths (/auth/login) which resolved
to the web domain instead of the API domain.
- Update LoginRedirectPage to use VITE_API_BASE_URL for login link
- Update apiClient 401 interceptor to redirect to full API URL
- Ensures OAuth flow works correctly with separate domains
wget resolves 'localhost' to IPv6 [::1] but nginx only listens on
IPv4 0.0.0.0:80, causing connection refused. Using 127.0.0.1 ensures
IPv4 connection and healthy container status.
Replace hardcoded 'hq-api' and '' router names with
configurable hq-api and -web. This ensures
unique identifiers per deployment and avoids conflicts with other
services sharing the same Traefik instance.
- Create /run directory explicitly for nginx.pid
- Set proper ownership and permissions for non-root user
- Fixes 'open() /run/nginx.pid failed (13: Permission denied)' error
Services should reference networks by their compose key name ('traefik'),
not by the env var. The actual Docker network name is already configurable
via TRAEFIK_NETWORK in the network definition at the bottom.
- Replace hardcoded 'traefik' network references with configurable
traefik in both api and web services
- Network definition at bottom already supported configuration,
but service references were still hardcoded
The package-lock.json was missing some esbuild optional dependencies
for other platforms. Using npm install instead of npm ci allows the
docker build to proceed without requiring all platform-specific packages
in the lock file.
- Add docker-compose.yml with postgres, redis, api, and web services
- Add multi-stage Dockerfile for API (Python 3.11)
- Add multi-stage Dockerfile for web (Node.js 20 + nginx)
- Add Makefile with common development commands
- Add .env.example with all required environment variables
- Add placeholder pyproject.toml and package.json for builds
- Configure health checks for all services
- Setup persistent volumes for postgres, redis, and repos
- Run services as non-root users
The OIDC issuer URL was being used to construct authorize/token URLs,
but Authentik's endpoints are at different paths than the issuer base.
- Use the actual authorization_endpoint from .well-known config
- Use the actual token_endpoint from .well-known config
- Fixes Authentik 'not found' error on login redirect
The OIDC issuer URL in .env ends with a trailing slash, which caused
the authorize endpoint to have a double slash (//authorize).
- Normalize issuer URL by removing trailing slash before appending path
- Applied to both LoginPage.tsx and CallbackPage.tsx
- Fixes Authentik 'not found' error on login redirect
- Add VITE_OIDC_REDIRECT_URI to .env.example and docker-compose files
- Pass OIDC variables as build args in Dockerfile (build-time only)
- Update both docker-compose.prod.yml and docker-compose.traefik.yml
- Fixes undefined OIDC variables causing 404 on login redirect
The sec-headers@file middleware was referenced but not defined,
causing Traefik to return 404 for all routes.
- Changed sec-headers@file to default-security-headers@file in both
docker-compose.prod.yml and docker-compose.traefik.yml
- This assumes the external Traefik has default-security-headers defined
in its file provider configuration (e.g., in dynamic/middlewares.yml)
If you don't have this middleware defined, either:
1. Define it in your Traefik dynamic configuration, or
2. Remove the middleware label entirely
- docker-compose.traefik.yml now contains api, web, db services only
- Assumes external Traefik proxy is already deployed
- Uses external traefik network for discovery
- docker-compose.prod.yml remains the full stack with embedded Traefik
- Remove TRAEFIK_DASHBOARD_SUBDOMAIN from .env.example (no longer used)
- Rename traefik routers from 'api'/'web' to 'headquarter-api'/'headquarter-web'
- Rename traefik services from 'api'/'web' to 'headquarter-api'/'headquarter-web'
This prevents router/service name collisions with other projects
sharing the same Traefik instance.
- Delete docker-compose.traefik.yml (redundant overlay)
- Remove Traefik service from docker-compose.prod.yml
- Add traefik external network and labels to api/web services in prod compose
- Add TRAEFIK_ENTRYPOINT env var to all Traefik router labels
- Remove deploy/ folder (portainer-stack.yml, .env examples, README)
Production compose now assumes external Traefik proxy on Docker network.
All environment variables come from host environment only.
- Remove env_file from deploy/portainer-stack.yml (api and web services)
- Add TRAEFIK_CERT_RESOLVER env var to all Traefik router labels
- Add TRAEFIK_DASHBOARD_SUBDOMAIN for configurable dashboard hostname
- Add TRAEFIK_ENTRYPOINT env var to Traefik dashboard router
- Update .env.example with TRAEFIK_DASHBOARD_SUBDOMAIN and TRAEFIK_LOG_LEVEL
- Update deploy/.env.example with new Traefik variables
All environment variables now come from host environment only.
- Remove env_file references from docker-compose.yml and docker-compose.prod.yml
- Add explicit environment variable forwarding for all services
- Use TRAEFIK_NETWORK env var in docker-compose.traefik.yml instead of hardcoded name
- Add VITE_* frontend variables to .env.example and deploy/.env.example
- Add missing production variables (TRAEFIK_ENTRYPOINT, TRAEFIK_CERT_RESOLVER) to deploy/.env.example
This makes environment configuration more explicit and easier to manage
across different deployment scenarios (local dev, CI/CD, Portainer).
- Add proposal, design, specs, and tasks for git connection model
- Include provider adapter, credential storage, SSH key lifecycle specs
- Add repository connection API and git operations specifications
- Create RepositoryListPage with connection status display
- Create RepositoryDetailPage with SSH key management
- Add repository API methods to client
- Update router with repository routes
- Add Repository types to frontend
- Add GitHubAdapter and GitLabAdapter with URL parsing
- Create provider factory in apps/api/app/git/providers/
- Implement clone, fetch, push in LocalGitOperations
- Add repository_connections router with CRUD and SSH key endpoints
- Create RepositoryConnection schema with validation
- Update models and routers __init__.py for new components
- Add comprehensive tests for git operations
- Add DatabaseCredentialStorage with async CRUD operations
- Create Credential SQLAlchemy model with encrypted values
- Update GitCredential and AccessTokenCredential to support async
- Fix SSH key encryption to use Fernet instead of base64 placeholder
- Mark all 31 config-secrets tasks as complete
- Mark all 25 runfusion-poc tasks as complete
- Mark all 27 deployment-config tasks as complete
- All implementations verified and committed
- Document manifest configuration and web terminal access
- Add environment variables and workspace mount details
- Include usage instructions and differences from code-server
- Add local testing commands for OpenCode container
Fusion
alex