From 80fa254a31d525dbc98bb3fe2d949f78c8e5872b Mon Sep 17 00:00:00 2001 From: Sergey Krylov Date: Thu, 17 Sep 2026 20:41:10 +0300 Subject: [PATCH 1/4] chore: point container images to Nexus #15 --- .env.compose.example | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.env.compose.example b/.env.compose.example index d9639ab..1d12743 100644 --- a/.env.compose.example +++ b/.env.compose.example @@ -1,7 +1,7 @@ # Copy to a restricted, untracked file. Never commit filled values. # Full release image references; use published version tags, not latest. -FRONTEND_IMAGE=git.personal.ksv741.ru/wealthledger/frontend:0.1.0 -BACKEND_IMAGE=git.personal.ksv741.ru/wealthledger/backend:0.1.0 +FRONTEND_IMAGE=nexus.ksv741.keenetic.pro/wealthledger/frontend:0.2.0 +BACKEND_IMAGE=nexus.ksv741.keenetic.pro/wealthledger/backend:0.2.0 FRONTEND_PORT=8080 FRONTEND_ORIGIN=https://wealthledger.example.com # Absolute directory, pre-created with owner UID/GID 1000:1000 and mode 0700. -- 2.54.0 From 9fbc23f7570ecb6ea13f7fae5490504d1a0d9ba8 Mon Sep 17 00:00:00 2001 From: Sergey Krylov Date: Sun, 20 Sep 2026 18:50:05 +0300 Subject: [PATCH 2/4] docs: link production deployment repository --- README.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index b2f54da..061e243 100644 --- a/README.md +++ b/README.md @@ -68,15 +68,14 @@ Nest работает в watch mode. Host `node_modules` и `.env` не монт Данные development хранятся отдельно в named volume `development-data` проекта `wealthledger-dev`; обычные restart/down их сохраняют. Изменение dependencies/config требует rebuild. -Production использует `compose.yaml` и restricted env по `.env.compose.example`: -две ссылки на опубликованные версии images, persistent absolute host data path, -постоянные JWT/encryption secrets и публичный HTTPS origin. Каталог данных -должен существовать и принадлежать UID/GID 1000:1000. Только frontend публикует -`127.0.0.1:8080`; серверный Caddy направляет туда весь домен. Backend port -остаётся внутренним, migration service использует тот же backend image. +Production использует отдельный [репозиторий deploy](https://git.personal.ksv741.ru/WealthLedger/deploy): +его Git-тег закрепляет пару images, а `./deploy.sh vX.Y.Z` выполняет обновление. +Рабочие данные, сертификат T-Bank и постоянные ключи находятся вне checkout. +Только frontend публикует `127.0.0.1:8080`; серверный Caddy направляет туда весь +домен. Backend port остаётся внутренним. Корневой Compose сохраняется для development. -Полная процедура установки, независимых обновлений, stopped-backend backup -и explicit restore — [документация](https://git.personal.ksv741.ru/WealthLedger/docs), +Пошаговая процедура установки, обновления и восстановления — README `deploy`; +архитектурные границы — [документация](https://git.personal.ksv741.ru/WealthLedger/docs), страница `architecture/deployment.md`. Перед backend update обязательны остановка, backup и успешная migration. Image rollback не восстанавливает старую базу. Публикация component images -- 2.54.0 From f27487b6a8cb59243a34e392059010dab38efd51 Mon Sep 17 00:00:00 2001 From: Sergey Krylov Date: Wed, 7 Oct 2026 15:36:45 +0300 Subject: [PATCH 3/4] fix(deps): refresh release security baseline --- .gitignore | 1 + .gitleaksignore | 3 +++ package-lock.json | 24 ++++++++++++------------ package.json | 6 ++++++ 4 files changed, 22 insertions(+), 12 deletions(-) create mode 100644 .gitleaksignore diff --git a/.gitignore b/.gitignore index 1dc0617..5f06120 100644 --- a/.gitignore +++ b/.gitignore @@ -28,6 +28,7 @@ !/.release-it.json !/CHANGELOG.md !/commitlint.config.cjs +!/.gitleaksignore !/renovate.json !/.gitea/ /.gitea/* diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 0000000..dfd29d7 --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,3 @@ +# Reviewed historical local-development fixture: base64 of the deterministic +# string 0123456789abcdef repeated twice, never a runtime secret. +7e382d460be296b6c88e17084fff17bb7728f6ea:.env.development.example:generic-api-key:9 diff --git a/package-lock.json b/package-lock.json index 877eea7..fbcc558 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1446,9 +1446,9 @@ } }, "node_modules/basic-ftp": { - "version": "5.3.1", - "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.3.1.tgz", - "integrity": "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==", + "version": "6.2.2", + "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-6.2.2.tgz", + "integrity": "sha512-LIkJcf/F6bTTfvE3k2YcTxrJsLKKVXiEpHZYkQP6JoqTb7khng7c13ckRTDQbqRh5IkehVH3F00sSlAa2F6DwA==", "dev": true, "license": "MIT", "engines": { @@ -2124,9 +2124,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.7", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", - "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", + "version": "3.1.8", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", + "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", "dev": true, "funding": [ { @@ -2355,9 +2355,9 @@ } }, "node_modules/ip-address": { - "version": "10.7.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.0.tgz", - "integrity": "sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==", + "version": "10.7.3", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.3.tgz", + "integrity": "sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg==", "dev": true, "license": "MIT", "engines": { @@ -3439,9 +3439,9 @@ } }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index 4af19e1..b4ffa6d 100644 --- a/package.json +++ b/package.json @@ -16,5 +16,11 @@ "@release-it/conventional-changelog": "12.0.0", "conventional-changelog-conventionalcommits": "10.4.0", "release-it": "21.0.2" + }, + "overrides": { + "basic-ftp": "6.2.2", + "fast-uri": "3.1.8", + "ip-address": "10.7.3", + "undici": "7.29.1" } } -- 2.54.0 From dc030f84c979cedb2628ef4bd97c62d6c63a9256 Mon Sep 17 00:00:00 2001 From: Sergey Krylov Date: Wed, 7 Oct 2026 18:13:55 +0300 Subject: [PATCH 4/4] chore(release): 0.2.1 --- CHANGELOG.md | 14 ++++++++++++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f3d9a5e..7311c40 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,19 @@ # Changelog +## [0.2.1](https://git.personal.ksv741.ru/WealthLedger/main/compare/v0.2.0...v0.2.1) (2026-10-07) + +### Bug Fixes + +* **deps:** refresh release security baseline ([f27487b](https://git.personal.ksv741.ru/WealthLedger/main/commit/f27487b6a8cb59243a34e392059010dab38efd51)) + +### Documentation + +* link production deployment repository ([9fbc23f](https://git.personal.ksv741.ru/WealthLedger/main/commit/9fbc23f7570ecb6ea13f7fae5490504d1a0d9ba8)) + +### Maintenance + +* point container images to Nexus [#15](https://git.personal.ksv741.ru/WealthLedger/main/issues/15) ([80fa254](https://git.personal.ksv741.ru/WealthLedger/main/commit/80fa254a31d525dbc98bb3fe2d949f78c8e5872b)) + ## [0.2.0](https://git.personal.ksv741.ru/WealthLedger/main/compare/v0.1.0...v0.2.0) (2026-09-16) ### Features diff --git a/package-lock.json b/package-lock.json index fbcc558..9787d53 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "wealth-ledger-workspace", - "version": "0.2.0", + "version": "0.2.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "wealth-ledger-workspace", - "version": "0.2.0", + "version": "0.2.1", "devDependencies": { "@commitlint/cli": "21.2.2", "@commitlint/config-conventional": "21.2.2", diff --git a/package.json b/package.json index b4ffa6d..ebff519 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "wealth-ledger-workspace", - "version": "0.2.0", + "version": "0.2.1", "private": true, "engines": { "node": "24.21.0" -- 2.54.0