Merge pull request #357 from trails-cool/stigi/preview-test

Test cd-staging preview lifecycle

.github/workflows/cd-staging.yml

@@ -165,7 +165,7 @@ jobs:
             # via cd-infra) are live. Idempotent.
             docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile || true
 
-            docker compose -f docker-compose.staging.yml -p trails-staging ps
+            docker compose -f docker-compose.staging.yml -p trails-staging --env-file staging.env --profile persistent ps
 
   # ── PR preview deploy ────────────────────────────────────────────────
   deploy-preview:
@@ -303,7 +303,7 @@ jobs:
             # Reload Caddy to pick up the per-PR snippet (writes/replaces it from the SCP step)
             docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile
 
-            docker compose -f docker-compose.staging.yml -p "$PROJECT" ps
+            docker compose -f docker-compose.staging.yml -p "$PROJECT" --env-file staging.env ps
 
       - name: Comment preview URL on PR
         uses: peter-evans/create-or-update-comment@v4

apps/journal/app/root.tsx

@@ -18,6 +18,7 @@ import stylesheet from "@trails-cool/ui/styles.css?url";
 
 // Paths that must stay reachable even when the user has a stale
 // terms_version, so they can read the Terms, accept them, or log out.
+// `/legal/` matches as a prefix (covers `/legal/terms`, `/legal/privacy`, etc.).
 const TERMS_GATE_ALLOWLIST = [
   "/auth/accept-terms",
   "/auth/logout",

infrastructure/docker-compose.staging.yml

@@ -31,8 +31,13 @@ services:
   journal:
     image: ghcr.io/trails-cool/journal:${JOURNAL_IMAGE_TAG:-latest}
     restart: unless-stopped
+    # Published on 0.0.0.0 (not 127.0.0.1) so the production Caddy container
+    # can reach it via host.docker.internal — Docker's host-gateway resolves
+    # to the bridge IP, not loopback. The Hetzner Cloud firewall blocks all
+    # inbound on ports 3000+ from the public internet, so this is effectively
+    # internal-only despite the bind address.
     ports:
-      - "127.0.0.1:${JOURNAL_HOST_PORT:?JOURNAL_HOST_PORT must be set}:3000"
+      - "${JOURNAL_HOST_PORT:?JOURNAL_HOST_PORT must be set}:3000"
     networks:
       - trails-shared
     environment:
@@ -72,8 +77,9 @@ services:
     # planner.staging.trails.cool. Saves ~256MB per active preview.
     profiles: ["persistent"]
     restart: unless-stopped
+    # Same rationale as the journal port — see the comment there.
     ports:
-      - "127.0.0.1:${PLANNER_HOST_PORT:-3101}:3001"
+      - "${PLANNER_HOST_PORT:-3101}:3001"
     networks:
       - trails-shared
     environment: