Add build workflow, seed data and README #9

Merged

mcp-bot merged 5 commits from feature/deployment into develop

2026-11-01 20:48:38 +01:00

mcp-bot commented

2026-11-01 20:46:14 +01:00

Member

Why

Phase 1 is only useful once it runs in the homelab and someone else can set it up. This adds the missing path from a merge on main to an image in the registry, and the documentation for it. A review of the finished state also turned up three bugs and a schema drift, which are fixed here.

What

build.yaml, taken from mangadex-gui: on push to main it creates tag and release YYYY.MM.N and publishes the image through the remote BuildKit for linux/amd64
python -m notenwart.seed (make seed): two demo groups with invented pieces and a setlist, safe to run twice
README: setup, configuration, roles, PocketID client, homelab deployment, backup

Fixes found in review

A superadmin who also joined a group as member lost admin rights there
Timestamps shortly after midnight showed the previous day, because they were formatted in UTC
The logo upload read the whole file into memory before checking its size
Three indexes existed only in migrations, so the next autogenerated migration would have dropped them. They are now declared in the models, and test_models_match_the_migrations runs alembic check

The README also warns that Emails verified by default in PocketID is only safe if users cannot change their own address, because the superadmin check relies on that claim.

Verification

make lint and pytest pass (427 tests)
compose.yaml resolved with homelab values: no host ports, labels and paths as planned, missing secrets stop the start with a clear message
Final image built natively on arm64 and started: uid 1000, migrations at head, /health ok, deu available, /data writable, no build tools in the image
Image also built and started as linux/amd64 under emulation: native packages load, deu available
build.yaml itself runs for the first time on the merge to main

## Why Phase 1 is only useful once it runs in the homelab and someone else can set it up. This adds the missing path from a merge on `main` to an image in the registry, and the documentation for it. A review of the finished state also turned up three bugs and a schema drift, which are fixed here. ## What - `build.yaml`, taken from mangadex-gui: on push to `main` it creates tag and release `YYYY.MM.N` and publishes the image through the remote BuildKit for `linux/amd64` - `python -m notenwart.seed` (`make seed`): two demo groups with invented pieces and a setlist, safe to run twice - README: setup, configuration, roles, PocketID client, homelab deployment, backup ## Fixes found in review - A superadmin who also joined a group as member lost admin rights there - Timestamps shortly after midnight showed the previous day, because they were formatted in UTC - The logo upload read the whole file into memory before checking its size - Three indexes existed only in migrations, so the next autogenerated migration would have dropped them. They are now declared in the models, and `test_models_match_the_migrations` runs `alembic check` The README also warns that `Emails verified by default` in PocketID is only safe if users cannot change their own address, because the superadmin check relies on that claim. ## Verification - `make lint` and `pytest` pass (427 tests) - `compose.yaml` resolved with homelab values: no host ports, labels and paths as planned, missing secrets stop the start with a clear message - Final image built natively on arm64 and started: uid 1000, migrations at head, `/health` ok, `deu` available, `/data` writable, no build tools in the image - Image also built and started as `linux/amd64` under emulation: native packages load, `deu` available - `build.yaml` itself runs for the first time on the merge to `main`

mcp-bot added 5 commits

2026-11-01 20:46:15 +01:00