Wired up the Website deployment for the POC prototype.

Services/Website/.env.local

@@ -51,36 +51,11 @@ ANALYTICS_DOMAINS=
 # Whether the pages also embed the session recorder script: true | false
 ANALYTICS_RECORDER=false
 
-# --- Security ----------------------------------------------------------------
+# --- Passkeys ----------------------------------------------------------------
 
-# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and
+# Origin the sign-in screen is served at; browsers bind passkeys to it.
-# `connect-src`, or the tracker is blocked; drop those two once analytics is off.
+# WebAuthn only runs on HTTPS or on localhost (not 127.0.0.1). In production it follows SITE_ORIGIN.
-SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
+PASSKEYS_ORIGIN=http://localhost:8080
-
-# `X-Content-Type-Options`: disables MIME sniffing.
-SECURITY_CONTENT_TYPE_OPTIONS=nosniff
-
-# `X-Frame-Options`: DENY | SAMEORIGIN
-SECURITY_FRAME_OPTIONS=DENY
-
-# `Referrer-Policy`.
-SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin
-
-# `Permissions-Policy`: denies browser features the site does not use.
-SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
-
-# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but
-# remember it stickily once seen, so it stays off in local development.
-# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains
-
-# --- Reverse proxy -----------------------------------------------------------
-
-# Both assert a TLS-terminating reverse proxy that sets the forwarded headers, so
-# set them together; off for a directly reachable server, where clients can forge
-# the headers. The former drives the HTTPS redirect, the latter keys the rate-limit
-# buckets by the first `X-Forwarded-For` entry.
-HTTPS_TRUST_FORWARDED_PROTO=false
-RATE_LIMIT_TRUST_FORWARDED_FOR=false
 
 # --- Persistence -------------------------------------------------------------
 
@@ -110,8 +85,39 @@ DATABASE_TLS=off
 # Username of the database to connect as.
 DATABASE_USERNAME=ccn
 
-# --- Passkeys ----------------------------------------------------------------
+# --- Reverse proxy -----------------------------------------------------------
 
-# Origin the sign-in screen is served at; browsers bind passkeys to it.
+# Both assert a TLS-terminating reverse proxy that sets the forwarded headers, so
-# WebAuthn only runs on HTTPS or on localhost (not 127.0.0.1).
+# set them together; off for a directly reachable server, where clients can forge
-PASSKEYS_ORIGIN=http://localhost:8080
+# the headers. The former drives the HTTPS redirect, the latter keys the rate-limit
+# buckets by the first `X-Forwarded-For` entry.
+HTTPS_TRUST_FORWARDED_PROTO=false
+RATE_LIMIT_TRUST_FORWARDED_FOR=false
+
+# --- Security ----------------------------------------------------------------
+
+# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and
+# `connect-src`, or the tracker is blocked; drop those two once analytics is off.
+SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
+
+# `X-Content-Type-Options`: disables MIME sniffing.
+SECURITY_CONTENT_TYPE_OPTIONS=nosniff
+
+# `X-Frame-Options`: DENY | SAMEORIGIN
+SECURITY_FRAME_OPTIONS=DENY
+
+# `Referrer-Policy`.
+SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin
+
+# `Permissions-Policy`: denies browser features the site does not use.
+SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
+
+# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but
+# remember it stickily once seen, so it stays off in local development.
+# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains
+
+# --- Site --------------------------------------------------------------------
+
+# Public origin of the site (scheme and host, no trailing slash). Leave unset locally: the app's default applies, and
+# the local Compose override points it at http://localhost.
+# SITE_ORIGIN=https://ccn.rock-n-co.de

Services/Website/Dockerfile

@@ -128,6 +128,12 @@ COPY --from=build --chown=hummingbird:hummingbird /staging /app
 # Provide configuration needed by the built-in crash reporter and some sensible default behaviors.
 ENV SWIFT_BACKTRACE=enable=yes,sanitize=yes,threads=all,images=all,interactive=no,swift-backtrace=./swift-backtrace-static
 
+# The photos sellers upload are the one thing written at runtime: their folder alone is writable, and it is where the
+# Compose file mounts a volume. A named volume takes the ownership of the folder it is first mounted over.
+RUN mkdir -p /app/Resources/Static/uploads \
+    && chown hummingbird:hummingbird /app/Resources/Static/uploads \
+    && chmod 750 /app/Resources/Static/uploads
+
 # Ensure all further commands run as the hummingbird user
 USER hummingbird:hummingbird
 

Services/Website/README.md

@@ -478,10 +478,19 @@ The Makefile and Compose files read these from `.env` (or the environment). Prov
 | `LOG_LEVEL` | Runtime log level (default `info`). |
 | `HTTP_SERVER_NAME` | Runtime server name (default `CCNWebsite`). |
 | `SECURITY_STRICT_TRANSPORT_SECURITY` | HSTS header value (default `max-age=31536000; includeSubDomains`). |
+| `SITE_ORIGIN` | The public origin: scheme and host, no trailing slash. The local override points it at `http://localhost`. |
+| `PASSKEYS_ORIGIN` | The origin browsers bind passkeys to: exactly where the sign-in screen is served, over HTTPS. Follows `SITE_ORIGIN` unless set apart. Left at the app's default (`http://localhost:8080`) every ceremony fails; changed later, it strands every passkey already registered. |
+| `ANALYTICS_WEBSITE_ID`, `ANALYTICS_DOMAINS`, `ANALYTICS_RECORDER` | Passed through to the tracker; an empty identifier leaves it off. |
 | `DATABASE_DRIVER` | `inMemory` or `postgres`. The production Compose file defaults it to `postgres`; the local override defaults back to the in-memory backend. |
 | `DATABASE_HOST`, `DATABASE_PASSWORD` | **Mandatory** — the production Compose file carries no default for either, since none can be correct: `localhost` inside the container is the container itself, and a blank password authenticates as nobody. It refuses to start without them rather than booting a website that serves 503s. Both come from `.env`, which is git-ignored — never commit the password. Compose interpolates each file before merging, so both must be set for a local `docker compose up` too, even though the override pins the host. |
 | `DATABASE_PORT`, `DATABASE_NAME`, `DATABASE_USERNAME` | The rest of the PostgreSQL connection (when `DATABASE_DRIVER=postgres`); these do default (`5432`, `ccn`, `ccn`). |
 | `DATABASE_POOL_MAX_PER_EVENT_LOOP` | Pooled connections per event loop (default `4`) — see the [connection budget](#persistence) before scaling out. |
 | `DATABASE_TLS` | TLS posture: `off`, `prefer`, or `require`. The production Compose file defaults it to `require`, which refuses a server offering no TLS; the local override defaults it to `off` for the plaintext development container. `prefer` continues in plaintext when the upgrade is stripped, handing over the password — so it is not a safe production posture. |
 
-Run the migrations against the production database once before (or during) rollout: `docker compose -f docker-compose.yml run --rm website --database-migrate`.
+Run the migrations against the production database once before (or during) rollout: `docker compose -f docker-compose.yml run --rm website --database-migrate`. They seed the prototype's demo shops, listings, and accounts too.
+
+What else a deployment needs:
+- **HTTPS in front**: browsers run WebAuthn nowhere else, and `HTTPS_TRUST_FORWARDED_PROTO` (on by default in the production Compose file) is what marks the session cookie `Secure`.
+- **The uploads volume**: the image is read-only but for `Resources/Static/uploads`, where the Compose file mounts `website-uploads` so sellers' photos outlive a redeploy.
+- **Room for uploads in the proxy**: a listing form carries up to 13 MB of photos — nginx allows 1 MB by default (`client_max_body_size`).
+- **One replica**: sessions, passkey ceremonies, and recovery links live in the process's memory; a restart signs everyone out.

Services/Website/docker-compose.override.yml

@@ -18,6 +18,9 @@ services:
       dockerfile: Services/Website/Dockerfile
     environment:
       LOG_LEVEL: debug
+      # Served over plain HTTP on localhost — the one place browsers run WebAuthn without HTTPS. Not 127.0.0.1.
+      SITE_ORIGIN: http://localhost:${HOST_PORT:-8080}
+      PASSKEYS_ORIGIN: http://localhost:${HOST_PORT:-8080}
       HTTPS_TRUST_FORWARDED_PROTO: "false"
       RATE_LIMIT_TRUST_FORWARDED_FOR: "false"
       DATABASE_DRIVER: ${DATABASE_DRIVER:-inMemory}

Services/Website/docker-compose.yml

@@ -8,6 +8,9 @@ name: ccn-platform
 #
 # The `-f docker-compose.yml` flag is important in production: it skips the docker-compose.override.yml file, which
 # Compose would otherwise merge in automatically for local development.
+#
+# Run one replica: sessions, passkey ceremonies, and recovery links live in the process's memory, so a second instance
+# would not know the first one's sign-ins — and a restart signs everyone out.
 services:
   website:
     image: ${HOST_CONTAINER}/${HOST_OWNER}/${IMAGE_NAME}:${IMAGE_TAG:-latest}
@@ -19,6 +22,17 @@ services:
     environment:
       LOG_LEVEL: ${LOG_LEVEL:-info}
       HTTP_SERVER_NAME: ${HTTP_SERVER_NAME:-CCNWebsite}
+      # The public origin: scheme and host, no trailing slash. The HTTPS redirect and the canonical links derive from it.
+      SITE_ORIGIN: ${SITE_ORIGIN:-https://ccn.rock-n-co.de}
+      # The origin browsers bind passkeys to: exactly where the sign-in screen is served — same scheme, same host, no
+      # `www.` either way. Left at the app's default (http://localhost:8080) every ceremony fails, so it follows
+      # SITE_ORIGIN unless set apart. It must be HTTPS: browsers run WebAuthn nowhere else but localhost, and it is
+      # what marks the session cookie `Secure`.
+      PASSKEYS_ORIGIN: ${PASSKEYS_ORIGIN:-${SITE_ORIGIN:-https://ccn.rock-n-co.de}}
+      # Empty leaves the tracker off.
+      ANALYTICS_WEBSITE_ID: ${ANALYTICS_WEBSITE_ID:-}
+      ANALYTICS_DOMAINS: ${ANALYTICS_DOMAINS:-}
+      ANALYTICS_RECORDER: ${ANALYTICS_RECORDER:-false}
       # Falls back to the policy the app ships with; set it in `.env` to allow the analytics origin,
       # which must match `String.Analytics.origin`.
       SECURITY_CONTENT_SECURITY_POLICY: "${SECURITY_CONTENT_SECURITY_POLICY:-default-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'}"
@@ -33,9 +47,14 @@ services:
       DATABASE_PASSWORD: ${DATABASE_PASSWORD:?DATABASE_PASSWORD is required}
       DATABASE_TLS: ${DATABASE_TLS:-require}
       DATABASE_POOL_MAX_PER_EVENT_LOOP: ${DATABASE_POOL_MAX_PER_EVENT_LOOP:-4}
+    volumes:
+      # The photos sellers upload. The rest of the image is read-only, and without the volume a redeploy would lose them.
+      - website-uploads:/app/Resources/Static/uploads
     healthcheck:
       test: ["CMD", "curl", "--fail", "--silent", "--show-error", "http://127.0.0.1:8080/health"]
       interval: 30s
       timeout: 5s
       retries: 3
       start_period: 10s
+volumes:
+  website-uploads: