trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
200 commits 46 branches 0 tags 6.5 MiB
Commit graph

200 commits

This branch
This branch
All branches
Author SHA1 Message Date
github-actions[bot]
fe3621aab3
Merge pull request #83 from trails-cool/emails 2026-03-26 17:27:26 +00:00
Ullrich Schäfer
346d72a759
Fix SMTP_URL and SMTP_FROM not passed to containers during deploy 
The CD workflow exported SENTRY_RELEASE but not the SMTP env vars,
so docker-compose substituted them as empty strings and emails
silently failed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-26 18:24:17 +01:00
github-actions[bot]
ef333a2105
Merge pull request #82 from trails-cool/transactional-emails-planner-features 2026-03-26 00:03:23 +00:00
Ullrich Schäfer
0a8dd0b766
Add transactional emails (SMTP) and planner features (no-go areas, notes, crash recovery) 
Transactional emails:
- Add nodemailer SMTP email module with dev-mode console logging
- Magic link template and welcome template with HTML + plain text
- Wire sendMagicLink into login flow, sendWelcome into registration
- Update privacy page and deploy docs for SMTP configuration

Planner features:
- No-go areas: draw polygons on map (leaflet-geoman), synced via Yjs,
  passed to BRouter as nogos parameter, route recomputes on change
- Session notes: collaborative Y.Text textarea in sidebar tab
- Crash recovery: periodic localStorage save of Yjs state, restore on reconnect
- Rate limit session creation (10/IP/hour) in /new route

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-26 01:00:42 +01:00
github-actions[bot]
05b5f6febf
Merge pull request #81 from trails-cool/archive-completed-changes 2026-03-25 23:45:24 +00:00
Ullrich Schäfer
538a69e1c5
Archive app-navigation and planner-multiplayer-awareness, sync specs 
Both changes fully implemented. Sync delta specs to main:
- map-display: add Planner home page nav and cursor rendering requirements
- planner-session: add session participant awareness requirement

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-26 00:42:55 +01:00
github-actions[bot]
589cb4ab15
Merge pull request #80 from trails-cool/security-hardening-verification 2026-03-25 23:34:14 +00:00
Ullrich Schäfer
b6908fb288
Fix picomatch audit vulnerability and complete security hardening verification 
Override picomatch to 4.0.4 to resolve high-severity ReDoS (GHSA-c2c7-rcm5-vvqj),
verify all security hardening tasks (gitleaks, pnpm audit, Docker non-root,
Caddy headers, scanner blocking), sync specs, and archive the change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-26 00:31:27 +01:00
github-actions[bot]
433886772f
Merge pull request #79 from trails-cool/fix-i18n 2026-03-25 23:18:22 +00:00
Ullrich Schäfer
3f7499ff06 Fix i18n: move init to root.tsx and downgrade to stable versions 
Move initI18n() from entry.client.tsx to root.tsx in both Planner and
Journal so i18n is initialized before any component renders. Downgrade
react-i18next to 16.6.1 and i18next to 25.10.4 to avoid hydration
mismatch issues introduced in newer versions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 23:18:15 +00:00
Ullrich Schäfer
30ae68dd69
Merge pull request #78 from trails-cool/fix-i18n-sync-init 
Fix i18n: synchronous init before hydration
 2026-03-25 22:58:58 +01:00
Ullrich Schäfer
18ac8a1ce3
Fix i18n: use initImmediate false for sync initialization 
i18n.init() is async by default. With initImmediate: false, it
initializes synchronously so translations are ready before React
hydrates. Without this, useTranslation() runs before i18n is ready,
showing raw translation keys.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 22:58:51 +01:00
Ullrich Schäfer
59ef2a4b5e
Merge pull request #77 from trails-cool/fix-i18n-entry-client 
Fix i18n: init before hydration in entry.client
 2026-03-25 22:52:26 +01:00
Ullrich Schäfer
d9ef69c0a0
Fix i18n: init in entry.client.tsx before hydration 
With custom entry.client.tsx, initI18n() in root.tsx runs too late —
the client hydrates before i18n is initialized, showing raw translation
keys. Move initI18n() to entry.client.tsx where it runs before
startTransition/hydrateRoot.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 22:52:20 +01:00
Ullrich Schäfer
ebe4ccd838
Merge pull request #76 from trails-cool/fix-node25-corepack 
Fix Docker builds: corepack removed in Node 25
 2026-03-25 22:43:00 +01:00
Ullrich Schäfer
871ed81869
Fix Docker builds: corepack removed in Node 25 
Node 25 no longer ships corepack. Replace corepack enable/prepare with
npm install -g pnpm.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 22:42:54 +01:00
Ullrich Schäfer
462da3ac5d
Merge pull request #75 from trails-cool/fix-csp-blob-worker 
Fix CSP: allow blob: for Yjs web worker
 2026-03-25 22:40:11 +01:00
Ullrich Schäfer
5d542a9391
Fix CSP: allow blob: for Yjs web worker 
y-websocket creates a Web Worker from a blob URL. The CSP script-src
needs blob: and an explicit worker-src directive to allow this.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 22:40:05 +01:00
Ullrich Schäfer
a5248872c7
Merge pull request #64 from trails-cool/dependabot/docker/apps/planner/node-25-slim 
Bump node from 24-slim to 25-slim in /apps/planner
 2026-03-25 13:21:32 +01:00
Ullrich Schäfer
17328833f4
Merge pull request #65 from trails-cool/dependabot/docker/apps/journal/node-25-slim 
Bump node from 24-slim to 25-slim in /apps/journal
 2026-03-25 13:21:17 +01:00
Ullrich Schäfer
fb13f7b8ef
Merge pull request #66 from trails-cool/dependabot/github_actions/actions/cache-5 
Bump actions/cache from 4 to 5
 2026-03-25 13:21:09 +01:00
Ullrich Schäfer
35c0c20310
Merge pull request #67 from trails-cool/dependabot/github_actions/pnpm/action-setup-5 
Bump pnpm/action-setup from 4 to 5
 2026-03-25 13:21:03 +01:00
Ullrich Schäfer
7239c1e1a5
Merge pull request #69 from trails-cool/dependabot/npm_and_yarn/production-9e71a89b93 
Bump the production group with 8 updates
 2026-03-25 13:20:54 +01:00
Ullrich Schäfer
aab7bda54a
Merge pull request #74 from trails-cool/increase-brouter-memory 
Increase BRouter heap to 1GB
 2026-03-25 13:17:13 +01:00
Ullrich Schäfer
c155bfcef5
Increase BRouter heap to 1GB 
512MB heap was too tight for 720MB of Germany segments, causing the
thread-priority-watchdog to kill routing requests after 1 second when
segment loading triggered GC pressure.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 13:17:05 +01:00
dependabot[bot]
dfba9b8170 Bump the production group with 8 updates 
Bumps the production group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@react-router/dev](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dev) | `7.13.1` | `7.13.2` |
| [@react-router/node](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-node) | `7.13.1` | `7.13.2` |
| [@react-router/serve](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-serve) | `7.13.1` | `7.13.2` |
| [i18next](https://github.com/i18next/i18next) | `25.10.4` | `25.10.9` |
| [react-i18next](https://github.com/i18next/react-i18next) | `16.6.1` | `16.6.6` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.13.1` | `7.13.2` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.57.1` | `8.57.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.0` | `4.1.1` |


Updates `@react-router/dev` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dev/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/@react-router/dev@7.13.2/packages/react-router-dev)

Updates `@react-router/node` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-node/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/@react-router/node@7.13.2/packages/react-router-node)

Updates `@react-router/serve` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-serve/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/@react-router/serve@7.13.2/packages/react-router-serve)

Updates `i18next` from 25.10.4 to 25.10.9
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next/compare/v25.10.4...v25.10.9)

Updates `react-i18next` from 16.6.1 to 16.6.6
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/react-i18next/compare/v16.6.1...v16.6.6)

Updates `react-router` from 7.13.1 to 7.13.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@7.13.2/packages/react-router)

Updates `typescript-eslint` from 8.57.1 to 8.57.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/typescript-eslint)

Updates `vitest` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.1/packages/vitest)

---
updated-dependencies:
- dependency-name: "@react-router/dev"
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@react-router/node"
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: "@react-router/serve"
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: i18next
  dependency-version: 25.10.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-i18next
  dependency-version: 16.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: react-router
  dependency-version: 7.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: typescript-eslint
  dependency-version: 8.57.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: vitest
  dependency-version: 4.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:37 +01:00
dependabot[bot]
aa607609ec Bump pnpm/action-setup from 4 to 5 
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4 to 5.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/v4...v5)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:36 +01:00
dependabot[bot]
355b5f7067 Bump actions/cache from 4 to 5 
Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:35 +01:00
dependabot[bot]
2df9172161 Bump node from 24-slim to 25-slim in /apps/journal 
Bumps node from 24-slim to 25-slim.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 25-slim
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:34 +01:00
dependabot[bot]
c5508fc293 Bump node from 24-slim to 25-slim in /apps/planner 
Bumps node from 24-slim to 25-slim.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 25-slim
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 12:32:33 +01:00
Ullrich Schäfer
5f5f583722
Merge pull request #73 from trails-cool/fix-gitleaks-config 
Fix .gitleaks.toml config syntax
 2026-03-25 11:59:32 +01:00
Ullrich Schäfer
38e5b1ce25
Fix .gitleaks.toml config syntax 
regexTarget is a string field, not an array of objects. Use the correct
allowlist format with regexes array.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 11:59:26 +01:00
Ullrich Schäfer
f009ae80b6
Merge pull request #72 from trails-cool/fix-gitleaks-permissions 
Fix gitleaks permissions for dependabot PRs
 2026-03-25 10:52:18 +01:00
Ullrich Schäfer
52382427ef
Fix gitleaks permissions for dependabot PRs 
Gitleaks needs explicit contents:read and pull-requests:read permissions
to scan dependabot PR commits. Without them, the GitHub API returns 403.

Ref: https://github.com/gitleaks/gitleaks/issues/1343#issuecomment-2690243151

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 10:52:03 +01:00
Ullrich Schäfer
5201bbfca2
Merge pull request #68 from trails-cool/add-fastmail-dns 
Add Fastmail DNS records
 2026-03-25 10:15:49 +01:00
Ullrich Schäfer
0e98efe1ab Add Fastmail DNS records to Terraform 
MX, SPF, DMARC, DKIM (4 keys), mail A record, and SRV records for
autodiscover, IMAP, JMAP, CalDAV, CardDAV, SMTP submission.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 09:11:42 +00:00
Ullrich Schäfer
dbc3491c1a
Merge pull request #71 from trails-cool/fix-gitleaks-license 
Add GITLEAKS_LICENSE to gitleaks action
 2026-03-25 10:10:10 +01:00
Ullrich Schäfer
0604f5b5ca
Add GITLEAKS_LICENSE secret for org repos 
Required for gitleaks-action on GitHub Organization repositories.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 10:09:55 +01:00
Ullrich Schäfer
aa798999cb
Merge pull request #63 from trails-cool/implement-security-hardening 
Security hardening: headers, scanning, Docker, firewall
 2026-03-25 09:58:19 +01:00
Ullrich Schäfer
be3e69c10b
Security hardening: headers, scanning, Docker, firewall 
- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy,
  Permissions-Policy on all responses
- Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403
- CI: Gitleaks secret scanning + pnpm audit for vulnerabilities
- Dependabot: Weekly npm + GitHub Actions + monthly Docker updates
- Docker: Non-root user in journal, planner, and brouter containers
- Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned)
- SECURITY.md: Vulnerability disclosure policy
- Privacy page: Security practices section added

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 09:58:12 +01:00
Ullrich Schäfer
0499133982
Merge pull request #62 from trails-cool/add-new-proposals 
Add observability and security-hardening proposals
 2026-03-25 09:48:24 +01:00
Ullrich Schäfer
7d20dbb12f
Add observability and security-hardening proposals, gitignore settings.local 
Two new OpenSpec changes:
- observability (30 tasks): health endpoints, Prometheus, Grafana+Loki,
  structured logging, dashboards, alerting
- security-hardening (24 tasks): Caddy headers, scanner blocking,
  gitleaks, pnpm audit, dependabot, non-root Docker, fail2ban

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 09:48:08 +01:00
Ullrich Schäfer
734b022004
Merge pull request #59 from trails-cool/add-mcp-and-gitignore 
Add Sentry MCP config, gitignore worktrees
 2026-03-25 09:46:59 +01:00
github-actions[bot]
b0fe60fcd2
Merge pull request #61 from trails-cool/filter-404-from-sentry 2026-03-25 08:05:00 +00:00
Ullrich Schäfer
cb2a202a0f Filter 404s from Sentry on client and server 
Client ErrorBoundary: skip captureException for HTTP errors < 500.
Server beforeSend: drop events where __serialized__.status is 404.

Resolves JOURNAL-2 and JOURNAL-8 (scanner bot noise).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 08:02:26 +00:00
github-actions[bot]
e58f182221
Merge pull request #60 from trails-cool/fix-docker-image-cleanup 2026-03-25 07:59:23 +00:00
Ullrich Schäfer
c41cf06cc9
Prune old Docker images after deploy 
The 38GB disk filled up with 36.5GB of old Docker images from repeated
deploys. Add docker image prune -af after each deploy to prevent this.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 08:56:33 +01:00
Ullrich Schäfer
66baca3635 Add Sentry MCP server config, ignore worktrees 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 07:43:58 +00:00
github-actions[bot]
71dec3f2f8
Merge pull request #58 from trails-cool/implement-multiplayer-awareness 2026-03-25 07:43:33 +00:00
Ullrich Schäfer
9b4f4c6759
Add multiplayer awareness: participant list, name editing, cursor styling, join/leave toasts 
Implement the planner-multiplayer-awareness OpenSpec change:

- Add setUserName to use-yjs.ts that persists to localStorage and syncs via awareness
- Create ParticipantList component showing all session participants with color dots,
  host badge, and inline name editing for the local user
- Replace plain text cursor labels with SVG pointer arrows and styled name tags
  (colored background, drop shadow, rounded corners, z-index below map controls)
- Track awareness add/remove events and display auto-dismissing toasts (3s)
  when participants join or leave the session
- Add i18n keys for participant UI in English and German

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-25 08:40:35 +01:00