Repository navigation
feat: kthais-backend and kthais-frontend, with Postgres and Redis - #24
Merged
Merged
Conversation
This was referenced Oct 27, 2026
Merged
pspanoudakis
approved these changes
Oct 30, 2026
pspanoudakis
force-pushed
the
feat/it-28-landingpage-projects
branch
from
October 30, 2026 20:35
c6416da to
8e46b62
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This was referenced Nov 1, 2026
Daniel3178
force-pushed
the
feat/it-28-landingpage-projects
branch
from
November 1, 2026 21:58
8e46b62 to
d5e80b5
Compare
Daniel3178
changed the title
… Redis The backend gets Postgres and Redis from defaults.databases (DATABASE_URL, REDIS_*), and reads JWT_PUBLIC_KEY and ONBOARDING_SERVICE_SECRET from the shared store. The frontend reads the same JWT_PUBLIC_KEY there, and gets BACKEND_URL at runtime, so one image serves both environments. Staging (landingpage-frontend-staging.kthais.com, landingpage-backend-staging.kthais.com) and production (kthais.com, api.kthais.com) are isolated: their own hosts, databases, secrets, onboarding-service, and jwt cookie name. Production keeps its hosts, which move in their own PR at the switchover (app-migration.md §7.4). Needs kthaisociety/infrastructure's projects.yaml lines first. Refs: IT-28
Staging gets one host, landingpage-staging.kthais.com, with the backend at /api/v1 and the frontend everywhere else; production does the same on kthais.com at the switchover. The cookie becomes host-only (__Host-jwt), so COOKIE_DOMAIN and JWT_COOKIE_NAME go. Mailchimp and MCP_SERVICE_SECRET are left out: neither is used in production. Refs: IT-28
The team settled the repo names. The one staging host becomes kthais-staging.kthais.com. Refs: IT-28
Staging runs every commit on main, so working SES credentials could send real email to real people. Without them the backend still starts; sending fails and is logged. Secrets are per project, so production gets them back in the switchover PR. Refs: IT-28
…IT-93 Refs: IT-28
Daniel3178
force-pushed
the
feat/it-28-landingpage-projects
branch
from
November 2, 2026 19:27
d5e80b5 to
1f6f0a9
Compare
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
sammosios
approved these changes
Nov 4, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Registers kthais.com's two apps (Linear IT-28), following
docs/project-yaml.mdandapp-migration.md.kthais-backend
defaults.databases; the app getsDATABASE_URLandREDIS_HOST/REDIS_PORT/REDIS_PASSWORD(no hand-setDB_*hosts).shared: [JWT_PUBLIC_KEY, ONBOARDING_SERVICE_SECRET];JWT_PRIVATE_KEYstays a project secret.staging.kthais.comatpath: /api/v1(nostrip_path: the routes start with/api/v1).BACKEND_URLandALLOWED_ORIGINSare the site's own host, so the OAuth redirect URI ishttps://staging.kthais.com/api/v1/auth/google/callback.MCP_SERVICE_SECRET: neither is used in production.AWS_ACCESS_KEY_IDorAWS_SECRET_ACCESS_KEY: staging must not send real email. Names are per project, so the PR for production's temporary host adds them back, with dummy values on staging.kthais-frontend
secrets: [LUMA_API_KEY],shared: [JWT_PUBLIC_KEY];BACKEND_URLread at runtime, so one image serves both environments.staging.kthais.comat/, the same host as the backend.Isolation: staging and production have their own hosts, databases, secrets and onboarding-service (
onboarding-service-staging-fm3uek/-production-km3a0y). The jwt cookie is host-only (__Host-jwt, noCOOKIE_DOMAIN), so neither environment ever receives the other's sessions.Not in this PR: production's domains (
kthais.comfor the frontend,kthais.comat/api/v1for the backend;api.kthais.comis dropped), added in their own PR at the switchover (§7.4); onboarding-service's stagingBACKEND_URL, once the new staging backend exists.Merge order:
checkfails until it is merged and applied)feat/it-28-*first, thenci/it-28-delivery-pipelineReplaces
feat/add-backend-and-frontend-projects, which predated the schema check, databases and the shared store.Refs: IT-28