Jakob Wennberg
ec27228a8e
Em dashes (—) and en dashes (–) had spread across comments, docs, tests, and a few UI strings, reading as AI-generated boilerplate rather than house style. Replaced each with punctuation matching its context: colon for explanatory clauses, comma for asides, plain hyphen for numeric/legal ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for paired-dash asides. messages/en.json and messages/sv.json were fixed by hand together to keep sv/en in sync. Left untouched where the dash is the functional subject rather than decorative punctuation: date-range-parser.ts's separator regex, charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the agent system-prompt files that already instruct against em dashes, and a golden iXBRL test fixture compared byte-for-byte. Also fixes two bugs surfaced along the way: an off-by-one in ApiKeysPanel's scope-label split (a leftover from an earlier partial pass), and a charset-repair test that had lost the literal en-dash it exists to verify. Regenerated the agent atom seed migration (skills:generate) since 27 SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes, with an explicit carve-out for the functional-dash cases above. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
77 lines
2.3 KiB
YAML
77 lines
2.3 KiB
YAML
services:
|
|
app:
|
|
image: ghcr.io/erp-mafia/gnubok:${IMAGE_TAG:-latest}
|
|
env_file: .env
|
|
# Bound to loopback by default: put a TLS-terminating reverse proxy in
|
|
# front (see docker-compose.caddy.yml). Override PORT in .env to change
|
|
# the host port, or use the caddy overlay to remove the host binding.
|
|
ports:
|
|
- "127.0.0.1:${PORT:-3000}:3000"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
read_only: true
|
|
init: true
|
|
# tmpfs ordering matters: the parent /app/.next must be mounted before
|
|
# any sub-mounts. The entrypoint cp's image-baked templates into these
|
|
# mounts at startup, then sed-substitutes the NEXT_PUBLIC_* placeholders,
|
|
# then drops the write bits.
|
|
#
|
|
# uid=1001 (nextjs), mode=750: the entrypoint runs UNPRIVILEGED as nextjs
|
|
# and owns these mounts, so it can populate them with no CAP_CHOWN/CAP_SETUID,
|
|
# which is what lets the container run under `cap_drop: ALL`. nodejs-group
|
|
# members can read the served bundle; nothing else on the host can.
|
|
tmpfs:
|
|
- /tmp
|
|
- /app/.next:uid=1001,gid=1001,mode=750,size=400m
|
|
- /app/public:uid=1001,gid=1001,mode=750,size=200m
|
|
mem_limit: 1g
|
|
cpus: 2
|
|
pids_limit: 200
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
# 127.0.0.1, not localhost: the app binds 0.0.0.0 (IPv4) but localhost can
|
|
# resolve to ::1 (IPv6), where nothing listens → false-unhealthy → the
|
|
# cron service (depends_on healthy) never starts.
|
|
test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/api/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 30s
|
|
start_interval: 5s
|
|
retries: 3
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|
|
|
|
cron:
|
|
build:
|
|
context: docker
|
|
dockerfile: cron.Dockerfile
|
|
depends_on:
|
|
app:
|
|
condition: service_healthy
|
|
environment:
|
|
- CRON_SECRET=${CRON_SECRET}
|
|
- APP_URL=http://app:3000
|
|
volumes:
|
|
- ./docker/crontab.self-hosted:/etc/supercronic/crontab:ro
|
|
init: true
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
mem_limit: 64m
|
|
pids_limit: 30
|
|
restart: unless-stopped
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|