trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
1533 commits 46 branches 0 tags 6.5 MiB
Commit graph

1533 commits

This branch
This branch
All branches
Author SHA1 Message Date
Ullrich Schäfer
5d542a9391
Fix CSP: allow blob: for Yjs web worker 
y-websocket creates a Web Worker from a blob URL. The CSP script-src
needs blob: and an explicit worker-src directive to allow this.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 22:40:05 +01:00
Ullrich Schäfer
a5248872c7
Merge pull request #64 from trails-cool/dependabot/docker/apps/planner/node-25-slim 
Bump node from 24-slim to 25-slim in /apps/planner
 2026-03-25 13:21:32 +01:00
Ullrich Schäfer
17328833f4
Merge pull request #65 from trails-cool/dependabot/docker/apps/journal/node-25-slim 
Bump node from 24-slim to 25-slim in /apps/journal
 2026-03-25 13:21:17 +01:00
Ullrich Schäfer
fb13f7b8ef
Merge pull request #66 from trails-cool/dependabot/github_actions/actions/cache-5 
Bump actions/cache from 4 to 5
 2026-03-25 13:21:09 +01:00
Ullrich Schäfer
35c0c20310
Merge pull request #67 from trails-cool/dependabot/github_actions/pnpm/action-setup-5 
Bump pnpm/action-setup from 4 to 5
 2026-03-25 13:21:03 +01:00
Ullrich Schäfer
7239c1e1a5
Merge pull request #69 from trails-cool/dependabot/npm_and_yarn/production-9e71a89b93 
Bump the production group with 8 updates
 2026-03-25 13:20:54 +01:00
Ullrich Schäfer
aab7bda54a
Merge pull request #74 from trails-cool/increase-brouter-memory 
Increase BRouter heap to 1GB
 2026-03-25 13:17:13 +01:00
Ullrich Schäfer
c155bfcef5
Increase BRouter heap to 1GB 
512MB heap was too tight for 720MB of Germany segments, causing the
thread-priority-watchdog to kill routing requests after 1 second when
segment loading triggered GC pressure.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 13:17:05 +01:00
dependabot[bot]
dfba9b8170 Bump the production group with 8 updates 
Bumps the production group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@react-router/dev](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dev) | `7.13.1` | `7.13.2` |
| [@react-router/node](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-node) | `7.13.1` | `7.13.2` |
| [@react-router/serve](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-serve) | `7.13.1` | `7.13.2` |
| [i18next](https://github.com/i18next/i18next) | `25.10.4` | `25.10.9` |
| [react-i18next](https://github.com/i18next/react-i18next) | `16.6.1` | `16.6.6` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.13.1` | `7.13.2` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.57.1` | `8.57.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.0` | `4.1.1` |


Updates `@react-router/dev` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dev/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/@react-router/dev@7.13.2/packages/react-router-dev)

Updates `@react-router/node` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-node/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/@react-router/node@7.13.2/packages/react-router-node)

Updates `@react-router/serve` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-serve/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/@react-router/serve@7.13.2/packages/react-router-serve)

Updates `i18next` from 25.10.4 to 25.10.9
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next/compare/v25.10.4...v25.10.9)

Updates `react-i18next` from 16.6.1 to 16.6.6
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/react-i18next/compare/v16.6.1...v16.6.6)

Updates `react-router` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@7.13.2/packages/react-router)

Updates `typescript-eslint` from 8.57.1 to 8.57.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/typescript-eslint)

Updates `vitest` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/vitest)

---
updated-dependencies:
- dependency-name: "@react-router/dev"
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@react-router/node"
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@react-router/serve"
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: i18next
  dependency-version: 25.10.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-i18next
  dependency-version: 16.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-router
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: typescript-eslint
  dependency-version: 8.57.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: vitest
  dependency-version: 4.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:37 +01:00
dependabot[bot]
aa607609ec Bump pnpm/action-setup from 4 to 5 
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4 to 5.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/v4...v5)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:36 +01:00
dependabot[bot]
355b5f7067 Bump actions/cache from 4 to 5 
Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:35 +01:00
dependabot[bot]
2df9172161 Bump node from 24-slim to 25-slim in /apps/journal 
Bumps node from 24-slim to 25-slim.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 25-slim
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:34 +01:00
dependabot[bot]
c5508fc293 Bump node from 24-slim to 25-slim in /apps/planner 
Bumps node from 24-slim to 25-slim.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 25-slim
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:33 +01:00
Ullrich Schäfer
5f5f583722
Merge pull request #73 from trails-cool/fix-gitleaks-config 
Fix .gitleaks.toml config syntax
 2026-03-25 11:59:32 +01:00
Ullrich Schäfer
38e5b1ce25
Fix .gitleaks.toml config syntax 
regexTarget is a string field, not an array of objects. Use the correct
allowlist format with regexes array.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 11:59:26 +01:00
Ullrich Schäfer
f009ae80b6
Merge pull request #72 from trails-cool/fix-gitleaks-permissions 
Fix gitleaks permissions for dependabot PRs
 2026-03-25 10:52:18 +01:00
Ullrich Schäfer
52382427ef
Fix gitleaks permissions for dependabot PRs 
Gitleaks needs explicit contents:read and pull-requests:read permissions
to scan dependabot PR commits. Without them, the GitHub API returns 403.

Ref: https://github.com/gitleaks/gitleaks/issues/1343#issuecomment-2690243151

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 10:52:03 +01:00
Ullrich Schäfer
5201bbfca2
Merge pull request #68 from trails-cool/add-fastmail-dns 
Add Fastmail DNS records
 2026-03-25 10:15:49 +01:00
Ullrich Schäfer
0e98efe1ab Add Fastmail DNS records to Terraform 
MX, SPF, DMARC, DKIM (4 keys), mail A record, and SRV records for
autodiscover, IMAP, JMAP, CalDAV, CardDAV, SMTP submission.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 09:11:42 +00:00
Ullrich Schäfer
dbc3491c1a
Merge pull request #71 from trails-cool/fix-gitleaks-license 
Add GITLEAKS_LICENSE to gitleaks action
 2026-03-25 10:10:10 +01:00
Ullrich Schäfer
0604f5b5ca
Add GITLEAKS_LICENSE secret for org repos 
Required for gitleaks-action on GitHub Organization repositories.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 10:09:55 +01:00
Ullrich Schäfer
aa798999cb
Merge pull request #63 from trails-cool/implement-security-hardening 
Security hardening: headers, scanning, Docker, firewall
 2026-03-25 09:58:19 +01:00
Ullrich Schäfer
be3e69c10b
Security hardening: headers, scanning, Docker, firewall 
- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy,
  Permissions-Policy on all responses
- Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403
- CI: Gitleaks secret scanning + pnpm audit for vulnerabilities
- Dependabot: Weekly npm + GitHub Actions + monthly Docker updates
- Docker: Non-root user in journal, planner, and brouter containers
- Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned)
- SECURITY.md: Vulnerability disclosure policy
- Privacy page: Security practices section added

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 09:58:12 +01:00
Ullrich Schäfer
0499133982
Merge pull request #62 from trails-cool/add-new-proposals 
Add observability and security-hardening proposals
 2026-03-25 09:48:24 +01:00
Ullrich Schäfer
7d20dbb12f
Add observability and security-hardening proposals, gitignore settings.local 
Two new OpenSpec changes:
- observability (30 tasks): health endpoints, Prometheus, Grafana+Loki,
  structured logging, dashboards, alerting
- security-hardening (24 tasks): Caddy headers, scanner blocking,
  gitleaks, pnpm audit, dependabot, non-root Docker, fail2ban

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 09:48:08 +01:00
Ullrich Schäfer
734b022004
Merge pull request #59 from trails-cool/add-mcp-and-gitignore 
Add Sentry MCP config, gitignore worktrees
 2026-03-25 09:46:59 +01:00
github-actions[bot]
b0fe60fcd2
Merge pull request #61 from trails-cool/filter-404-from-sentry 2026-03-25 08:05:00 +00:00
Ullrich Schäfer
cb2a202a0f Filter 404s from Sentry on client and server 
Client ErrorBoundary: skip captureException for HTTP errors < 500.
Server beforeSend: drop events where __serialized__.status is 404.

Resolves JOURNAL-2 and JOURNAL-8 (scanner bot noise).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 08:02:26 +00:00
github-actions[bot]
e58f182221
Merge pull request #60 from trails-cool/fix-docker-image-cleanup 2026-03-25 07:59:23 +00:00
Ullrich Schäfer
c41cf06cc9
Prune old Docker images after deploy 
The 38GB disk filled up with 36.5GB of old Docker images from repeated
deploys. Add docker image prune -af after each deploy to prevent this.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 08:56:33 +01:00
Ullrich Schäfer
66baca3635 Add Sentry MCP server config, ignore worktrees 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 07:43:58 +00:00
github-actions[bot]
71dec3f2f8
Merge pull request #58 from trails-cool/implement-multiplayer-awareness 2026-03-25 07:43:33 +00:00
Ullrich Schäfer
9b4f4c6759
Add multiplayer awareness: participant list, name editing, cursor styling, join/leave toasts 
Implement the planner-multiplayer-awareness OpenSpec change:

- Add setUserName to use-yjs.ts that persists to localStorage and syncs via awareness
- Create ParticipantList component showing all session participants with color dots,
  host badge, and inline name editing for the local user
- Replace plain text cursor labels with SVG pointer arrows and styled name tags
  (colored background, drop shadow, rounded corners, z-index below map controls)
- Track awareness add/remove events and display auto-dismissing toasts (3s)
  when participants join or leave the session
- Add i18n keys for participant UI in English and German

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 08:40:35 +01:00
github-actions[bot]
068b474f94
Merge pull request #57 from trails-cool/implement-app-navigation 2026-03-25 03:14:56 +00:00
Ullrich Schäfer
bb4f193405 Add app navigation bars to Journal and Planner 
Journal gets a nav bar in root.tsx with conditional links: Routes and
Activities for authenticated users, Sign In and Register for guests.
Active route is highlighted via useLocation(). User menu shows username
linking to profile and a logout button.

Planner SessionView header title becomes a home link back to /.

Adds i18n keys (en + de) for all nav labels. Updates E2E tests to use
scoped nav selectors now that links appear in both nav bar and page body.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 03:12:27 +00:00
github-actions[bot]
a9e29b2950
Merge pull request #56 from trails-cool/implement-planner-landing-page 2026-03-25 03:07:58 +00:00
Ullrich Schäfer
160079b9be
Add planner landing page, archive change 
Replace blank home page with landing page: hero with "Start Planning"
CTA, 5 feature cards, Journal CTA, footer with attribution. All strings
in en + de. Sync planner-session spec and archive change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 04:05:02 +01:00
Ullrich Schäfer
4ddaad8c5f
Add planner landing page with features and CTAs 
Replace blank home page with a landing page explaining collaborative
route planning. Hero section with "Start Planning" CTA, 5 feature cards
(collaboration, routing, elevation, GPX, no account), secondary CTA
linking to Journal, and footer with privacy/source/attribution links.

All strings in en + de via i18n.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 04:03:06 +01:00
Ullrich Schäfer
976aee225e
Merge pull request #55 from trails-cool/add-proposed-changes 
Add 8 proposed changes and old trails analysis
 2026-03-25 03:57:34 +01:00
Ullrich Schäfer
c7c1c275df
Add 8 proposed changes and old trails analysis 
Proposed changes (all with proposal, design, specs, tasks):
- app-navigation (9 tasks) — nav bars for both apps
- planner-landing-page (7 tasks) — standalone landing page
- planner-multiplayer-awareness (13 tasks) — participants, cursors, names
- changelog (13 tasks) — public changelog with "what's new"
- transactional-emails (15 tasks) — magic link + welcome emails
- planner-features (18 tasks) — no-go areas, notes, recovery, rate limits
- komoot-import (23 tasks) — Komoot tour import
- route-features (37 tasks) — sharing, multi-day, spatial, photos

Also adds docs/old-trails-analysis.md with feature analysis from the
older trails project.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 03:57:20 +01:00
github-actions[bot]
57141cdfab
Merge pull request #54 from trails-cool/add-deploy-status-command 2026-03-25 02:28:05 +00:00
Ullrich Schäfer
ef130b4b11
Add /deploy-status command 
Shows deployed container versions, latest CD run SHA, and health check
for both apps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 03:25:18 +01:00
github-actions[bot]
2c47f2a705
Merge pull request #53 from trails-cool/implement-sentry-improvements 2026-03-25 02:18:45 +00:00
Ullrich Schäfer
4a721fc586
Add privacy route to journal route config 
Route was missing from the explicit routes.ts, so typegen didn't
generate types for it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 03:15:38 +01:00
Ullrich Schäfer
9d51fd6b36
Archive sentry-improvements, sync specs 
Sync Sentry error tracking requirement (5 scenarios) to main
infrastructure spec. Archive completed change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 03:13:36 +01:00
Ullrich Schäfer
9a904d9f69
Sentry improvements: context, tracing, source maps, privacy manifest 
- Set Sentry user context (id, username) in Journal root for all routes
- Tag Planner errors with session_id
- Use reactRouterV7BrowserTracingIntegration for route-aware traces
- Hidden source maps (no sourceMappingURL in bundles, .map deleted after
  upload to Sentry)
- Privacy manifest at /privacy documenting all data collection
- robots.txt blocking all bots on both apps
- Suppress i18next promotional console log

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 03:11:07 +01:00
Ullrich Schäfer
6c4d92f7fc
Merge pull request #52 from trails-cool/archive-phase1-mvp 
Archive phase-1-mvp, sync specs
 2026-03-25 02:55:54 +01:00
Ullrich Schäfer
3a519ea05e
Remove old phase-1-mvp location (moved to archive) 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 02:55:43 +01:00
Ullrich Schäfer
e530492753
Archive phase-1-mvp, sync specs to main 
All 85 tasks complete. Archive change to openspec/changes/archive/ and
sync 9 capability specs to openspec/specs/ for future reference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 02:55:28 +01:00
github-actions[bot]
f7288c88d1
Merge pull request #51 from trails-cool/sentry-ci-environment 2026-03-25 01:54:08 +00:00