tknuth/QR-master
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: tknuth:test
Branches Tags
tknuth:master tknuth:test tknuth:dynamisch tknuth:feature/mockup-landing-page tknuth:icons tknuth:analytics
..
compare: tknuth:master
Branches Tags
tknuth:master tknuth:test tknuth:dynamisch tknuth:feature/mockup-landing-page tknuth:icons tknuth:analytics

7 Commits
test ... master

Author SHA1 Message Date
Andreas Knuth
0982be2f58 condition: service_healthy 2026-08-20 21:52:18 +02:00
Andreas Knuth
ff70278be4 HOSTNAME: "0.0.0.0" 2026-08-20 21:45:48 +02:00
Andreas Knuth
5171669d4d fix 401 2026-08-20 21:28:01 +02:00
Andreas Knuth
5f0d5c0e72 Merge remote-tracking branch 'origin/test' 2026-08-20 17:58:51 +02:00
Timo Knuth
5541c0553c refactor: derive email sender address dynamically from SMTP_USER 2026-08-13 19:33:05 +02:00
Andreas Knuth
172730cf0f SMTP_USER 2026-08-13 18:30:34 +02:00
Andreas Knuth
9ccce7cbfd info instead of timo 2026-08-13 17:44:55 +02:00
2 changed files with 196 additions and 183 deletions
Expand all files Collapse all files

371
docker-compose.yml
View File

@@ -1,181 +1,190 @@
services: services:
# PostgreSQL Database # PostgreSQL Database
db: db:
image: postgres:16-alpine image: postgres:16-alpine
container_name: qrmaster-db container_name: qrmaster-db
restart: unless-stopped restart: unless-stopped
environment: environment:
POSTGRES_USER: ${POSTGRES_USER} POSTGRES_USER: ${POSTGRES_USER}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
POSTGRES_DB: ${POSTGRES_DB} POSTGRES_DB: ${POSTGRES_DB}
POSTGRES_INITDB_ARGS: "-E UTF8 --locale=en_US.utf8" POSTGRES_INITDB_ARGS: "-E UTF8 --locale=en_US.utf8"
ports: ports:
- "5435:5432" - "5435:5432"
volumes: volumes:
- dbdata:/var/lib/postgresql/data - dbdata:/var/lib/postgresql/data
- ./docker/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh - ./docker/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh
healthcheck: healthcheck:
test: [ "CMD-SHELL", "pg_isready -U postgres -d qrmaster" ] test: [ "CMD-SHELL", "pg_isready -U postgres -d qrmaster" ]
interval: 5s interval: 5s
timeout: 5s timeout: 5s
retries: 10 retries: 10
networks: networks:
- qrmaster-network - qrmaster-network
# Redis Cache # Redis Cache
redis: redis:
image: redis:7-alpine image: redis:7-alpine
container_name: qrmaster-redis container_name: qrmaster-redis
restart: unless-stopped restart: unless-stopped
command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
volumes: volumes:
- redisdata:/data - redisdata:/data
healthcheck: healthcheck:
test: [ "CMD", "redis-cli", "ping" ] test: [ "CMD", "redis-cli", "ping" ]
interval: 5s interval: 5s
timeout: 3s timeout: 3s
retries: 5 retries: 5
networks: networks:
- qrmaster-network - qrmaster-network
# Next.js Application # Next.js Application
web: web:
build: build:
context: . context: .
dockerfile: Dockerfile dockerfile: Dockerfile
args: args:
NEXT_PUBLIC_UMAMI_SRC: ${NEXT_PUBLIC_UMAMI_SRC:-} NEXT_PUBLIC_UMAMI_SRC: ${NEXT_PUBLIC_UMAMI_SRC:-}
NEXT_PUBLIC_UMAMI_ID: ${NEXT_PUBLIC_UMAMI_ID:-} NEXT_PUBLIC_UMAMI_ID: ${NEXT_PUBLIC_UMAMI_ID:-}
COOKIE_DOMAIN: ${COOKIE_DOMAIN:-} COOKIE_DOMAIN: ${COOKIE_DOMAIN:-}
AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-} AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-}
container_name: qrmaster-web container_name: qrmaster-web
restart: unless-stopped restart: unless-stopped
environment: environment:
NODE_ENV: production NODE_ENV: production
DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public # Docker sets HOSTNAME=<container-id>, and the Next.js standalone server binds to
DIRECT_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public # exactly that one interface - localhost (healthcheck) and the container's other
REDIS_URL: redis://redis:6379 # network addresses then answer with ECONNREFUSED.
NEXTAUTH_URL: ${NEXTAUTH_URL} HOSTNAME: "0.0.0.0"
NEXTAUTH_SECRET: ${NEXTAUTH_SECRET} DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public
NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3050} DIRECT_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public
NEXT_PUBLIC_WWW_URL: ${NEXT_PUBLIC_WWW_URL:-http://localhost:3050} REDIS_URL: redis://redis:6379
COOKIE_DOMAIN: ${COOKIE_DOMAIN:-} NEXTAUTH_URL: ${NEXTAUTH_URL}
AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-} NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
INTERNAL_API_SECRET: ${INTERNAL_API_SECRET} NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3050}
CRON_SECRET: ${CRON_SECRET:-} NEXT_PUBLIC_WWW_URL: ${NEXT_PUBLIC_WWW_URL:-http://localhost:3050}
SOCIAL_MILESTONE_THRESHOLDS: ${SOCIAL_MILESTONE_THRESHOLDS:-} COOKIE_DOMAIN: ${COOKIE_DOMAIN:-}
SOCIAL_MILESTONE_POST_DELAY_HOURS: ${SOCIAL_MILESTONE_POST_DELAY_HOURS:-} AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-}
SOCIAL_MILESTONE_MIN_GAP_HOURS: ${SOCIAL_MILESTONE_MIN_GAP_HOURS:-} INTERNAL_API_SECRET: ${INTERNAL_API_SECRET}
# Channels the consent dialog may ask for. Only extend this once the CRON_SECRET: ${CRON_SECRET:-}
# worker actually publishes that channel. SOCIAL_MILESTONE_THRESHOLDS: ${SOCIAL_MILESTONE_THRESHOLDS:-}
SOCIAL_MILESTONE_CHANNELS: ${SOCIAL_MILESTONE_CHANNELS:-x} SOCIAL_MILESTONE_POST_DELAY_HOURS: ${SOCIAL_MILESTONE_POST_DELAY_HOURS:-}
TIKTOK_CLIENT_KEY: ${TIKTOK_CLIENT_KEY:-} SOCIAL_MILESTONE_MIN_GAP_HOURS: ${SOCIAL_MILESTONE_MIN_GAP_HOURS:-}
TIKTOK_CLIENT_SECRET: ${TIKTOK_CLIENT_SECRET:-} # Channels the consent dialog may ask for. Only extend this once the
TIKTOK_REDIRECT_URI: ${TIKTOK_REDIRECT_URI:-https://qrmaster.net/api/tiktok/callback} # worker actually publishes that channel.
TIKTOK_ADMIN_KEY: ${TIKTOK_ADMIN_KEY:-} SOCIAL_MILESTONE_CHANNELS: ${SOCIAL_MILESTONE_CHANNELS:-x}
# Guards the asset upload route that Instagram (and TikTok) pull media TIKTOK_CLIENT_KEY: ${TIKTOK_CLIENT_KEY:-}
# from. Falls back to the TikTok key so existing setups keep working. TIKTOK_CLIENT_SECRET: ${TIKTOK_CLIENT_SECRET:-}
SOCIAL_ASSET_ADMIN_KEY: ${SOCIAL_ASSET_ADMIN_KEY:-} TIKTOK_REDIRECT_URI: ${TIKTOK_REDIRECT_URI:-https://qrmaster.net/api/tiktok/callback}
TIKTOK_EXPECTED_OPEN_ID: ${TIKTOK_EXPECTED_OPEN_ID:-} TIKTOK_ADMIN_KEY: ${TIKTOK_ADMIN_KEY:-}
IP_SALT: ${IP_SALT:-your-salt-change-in-production} # Guards the asset upload route that Instagram (and TikTok) pull media
ENABLE_DEMO: ${ENABLE_DEMO:-false} # from. Falls back to the TikTok key so existing setups keep working.
NEXT_PUBLIC_INDEXABLE: ${NEXT_PUBLIC_INDEXABLE:-true} SOCIAL_ASSET_ADMIN_KEY: ${SOCIAL_ASSET_ADMIN_KEY:-}
# Google OAuth TIKTOK_EXPECTED_OPEN_ID: ${TIKTOK_EXPECTED_OPEN_ID:-}
GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-} IP_SALT: ${IP_SALT:-your-salt-change-in-production}
GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-} ENABLE_DEMO: ${ENABLE_DEMO:-false}
# Stripe NEXT_PUBLIC_INDEXABLE: ${NEXT_PUBLIC_INDEXABLE:-true}
STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-} # Google OAuth
STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-} GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY:-} GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
STRIPE_PRICE_ID_PRO_MONTHLY: ${STRIPE_PRICE_ID_PRO_MONTHLY:-} # Stripe
STRIPE_PRICE_ID_PRO_YEARLY: ${STRIPE_PRICE_ID_PRO_YEARLY:-} STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
STRIPE_PRICE_ID_BUSINESS_MONTHLY: ${STRIPE_PRICE_ID_BUSINESS_MONTHLY:-} STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
STRIPE_PRICE_ID_BUSINESS_YEARLY: ${STRIPE_PRICE_ID_BUSINESS_YEARLY:-} NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY:-}
# Email & Analytics STRIPE_PRICE_ID_PRO_MONTHLY: ${STRIPE_PRICE_ID_PRO_MONTHLY:-}
RESEND_API_KEY: ${RESEND_API_KEY:-} STRIPE_PRICE_ID_PRO_YEARLY: ${STRIPE_PRICE_ID_PRO_YEARLY:-}
SMTP_HOST: ${SMTP_HOST:-smtp.qrmaster.net} STRIPE_PRICE_ID_BUSINESS_MONTHLY: ${STRIPE_PRICE_ID_BUSINESS_MONTHLY:-}
SMTP_PORT: ${SMTP_PORT:-465} STRIPE_PRICE_ID_BUSINESS_YEARLY: ${STRIPE_PRICE_ID_BUSINESS_YEARLY:-}
SMTP_USER: ${SMTP_USER:-info@qrmaster.net} # Email & Analytics
SMTP_PASS: ${SMTP_PASS:-} RESEND_API_KEY: ${RESEND_API_KEY:-}
NEWSLETTER_ADMIN_EMAIL: ${NEWSLETTER_ADMIN_EMAIL:-} SMTP_HOST: ${SMTP_HOST:-smtp.qrmaster.net}
NEWSLETTER_ADMIN_PASSWORD: ${NEWSLETTER_ADMIN_PASSWORD:-} SMTP_PORT: ${SMTP_PORT:-465}
NEWSLETTER_TEST_EMAIL: ${NEWSLETTER_TEST_EMAIL:-} SMTP_USER: ${SMTP_USER:-info@qrmaster.net}
EMAIL_UNSUBSCRIBE_SECRET: ${EMAIL_UNSUBSCRIBE_SECRET:-} SMTP_PASS: ${SMTP_PASS:-}
NEXT_PUBLIC_POSTHOG_KEY: ${NEXT_PUBLIC_POSTHOG_KEY:-} NEWSLETTER_ADMIN_EMAIL: ${NEWSLETTER_ADMIN_EMAIL:-}
NEXT_PUBLIC_POSTHOG_HOST: ${NEXT_PUBLIC_POSTHOG_HOST:-https://us.i.posthog.com} NEWSLETTER_ADMIN_PASSWORD: ${NEWSLETTER_ADMIN_PASSWORD:-}
# Cloudflare R2 Storage NEWSLETTER_TEST_EMAIL: ${NEWSLETTER_TEST_EMAIL:-}
R2_ACCOUNT_ID: ${R2_ACCOUNT_ID:-} EMAIL_UNSUBSCRIBE_SECRET: ${EMAIL_UNSUBSCRIBE_SECRET:-}
R2_ACCESS_KEY_ID: ${R2_ACCESS_KEY_ID:-} NEXT_PUBLIC_POSTHOG_KEY: ${NEXT_PUBLIC_POSTHOG_KEY:-}
R2_SECRET_ACCESS_KEY: ${R2_SECRET_ACCESS_KEY:-} NEXT_PUBLIC_POSTHOG_HOST: ${NEXT_PUBLIC_POSTHOG_HOST:-https://us.i.posthog.com}
R2_BUCKET_NAME: ${R2_BUCKET_NAME:-qrmaster-menus} # Cloudflare R2 Storage
R2_PUBLIC_URL: ${R2_PUBLIC_URL:-} R2_ACCOUNT_ID: ${R2_ACCOUNT_ID:-}
NEXT_PUBLIC_UMAMI_SRC: ${NEXT_PUBLIC_UMAMI_SRC:-} R2_ACCESS_KEY_ID: ${R2_ACCESS_KEY_ID:-}
NEXT_PUBLIC_UMAMI_ID: ${NEXT_PUBLIC_UMAMI_ID:-} R2_SECRET_ACCESS_KEY: ${R2_SECRET_ACCESS_KEY:-}
depends_on: R2_BUCKET_NAME: ${R2_BUCKET_NAME:-qrmaster-menus}
db: R2_PUBLIC_URL: ${R2_PUBLIC_URL:-}
condition: service_healthy NEXT_PUBLIC_UMAMI_SRC: ${NEXT_PUBLIC_UMAMI_SRC:-}
redis: NEXT_PUBLIC_UMAMI_ID: ${NEXT_PUBLIC_UMAMI_ID:-}
condition: service_healthy depends_on:
healthcheck: db:
test: [ "CMD", "node", "-e", "require('http').get('http://localhost:3000',()=>process.exit(0)).on('error',()=>process.exit(1))" ] condition: service_healthy
interval: 10s redis:
timeout: 3s condition: service_healthy
retries: 10 healthcheck:
networks: test: [ "CMD", "node", "-e", "require('http').get('http://localhost:3000',()=>process.exit(0)).on('error',()=>process.exit(1))" ]
- qrmaster-network interval: 10s
timeout: 3s
social-worker: retries: 10
build: networks:
context: ./scripts/social-worker - qrmaster-network
restart: unless-stopped
environment: social-worker:
QRMASTER_API_BASE: http://web:3000 build:
INTERNAL_API_SECRET: ${INTERNAL_API_SECRET} context: ./scripts/social-worker
SOCIAL_MILESTONE_POSTING_ENABLED: ${SOCIAL_MILESTONE_POSTING_ENABLED:-false} restart: unless-stopped
SOCIAL_WORKER_INTERVAL_SECONDS: ${SOCIAL_WORKER_INTERVAL_SECONDS:-10} environment:
X_API_KEY: ${X_API_KEY:-} # Container name, not the `web` service alias: the staging stack joins this same
X_API_SECRET: ${X_API_SECRET:-} # external network and registers `web` as an alias too, so the alias can resolve
X_ACCESS_TOKEN: ${X_ACCESS_TOKEN:-} # to the staging app - which has a different INTERNAL_API_SECRET and answers 401.
X_ACCESS_TOKEN_SECRET: ${X_ACCESS_TOKEN_SECRET:-} QRMASTER_API_BASE: http://qrmaster-web:3000
# Channels this worker publishes. Must stay a subset of the app's INTERNAL_API_SECRET: ${INTERNAL_API_SECRET}
# SOCIAL_MILESTONE_CHANNELS - a channel the dialog offers but nobody SOCIAL_MILESTONE_POSTING_ENABLED: ${SOCIAL_MILESTONE_POSTING_ENABLED:-false}
# publishes would leave approvals sitting in the queue. SOCIAL_WORKER_INTERVAL_SECONDS: ${SOCIAL_WORKER_INTERVAL_SECONDS:-10}
SOCIAL_WORKER_CHANNELS: ${SOCIAL_WORKER_CHANNELS:-x} X_API_KEY: ${X_API_KEY:-}
INSTAGRAM_USER_ID: ${INSTAGRAM_USER_ID:-} X_API_SECRET: ${X_API_SECRET:-}
INSTAGRAM_ACCESS_TOKEN: ${INSTAGRAM_ACCESS_TOKEN:-} X_ACCESS_TOKEN: ${X_ACCESS_TOKEN:-}
GRAPH_API_VERSION: ${GRAPH_API_VERSION:-v22.0} X_ACCESS_TOKEN_SECRET: ${X_ACCESS_TOKEN_SECRET:-}
# Instagram downloads the image itself, so the worker hosts it through # Channels this worker publishes. Must stay a subset of the app's
# /api/social-assets on the verified domain. Same key as the web service. # SOCIAL_MILESTONE_CHANNELS - a channel the dialog offers but nobody
SOCIAL_ASSET_ADMIN_KEY: ${SOCIAL_ASSET_ADMIN_KEY:-${TIKTOK_ADMIN_KEY:-}} # publishes would leave approvals sitting in the queue.
depends_on: SOCIAL_WORKER_CHANNELS: ${SOCIAL_WORKER_CHANNELS:-x}
web: INSTAGRAM_USER_ID: ${INSTAGRAM_USER_ID:-}
condition: service_started INSTAGRAM_ACCESS_TOKEN: ${INSTAGRAM_ACCESS_TOKEN:-}
networks: GRAPH_API_VERSION: ${GRAPH_API_VERSION:-v22.0}
- qrmaster-network # Instagram downloads the image itself, so the worker hosts it through
# /api/social-assets on the verified domain. Same key as the web service.
SOCIAL_ASSET_ADMIN_KEY: ${SOCIAL_ASSET_ADMIN_KEY:-${TIKTOK_ADMIN_KEY:-}}
# Adminer - Database Management UI (Optional) depends_on:
adminer: web:
image: adminer:latest # Not service_started: the worker's first cycle would otherwise run while web is
container_name: qrmaster-adminer # still applying migrations and booting, logging a connection error per channel.
restart: unless-stopped condition: service_healthy
ports: networks:
- "8080:8080" - qrmaster-network
environment:
ADMINER_DEFAULT_SERVER: db
depends_on: # Adminer - Database Management UI (Optional)
- db adminer:
networks: image: adminer:latest
- qrmaster-network container_name: qrmaster-adminer
profiles: restart: unless-stopped
- dev ports:
- "8080:8080"
volumes: environment:
dbdata: ADMINER_DEFAULT_SERVER: db
driver: local depends_on:
redisdata: - db
driver: local networks:
- qrmaster-network
networks: profiles:
qrmaster-network: - dev
external: true
volumes:
dbdata:
driver: local
redisdata:
driver: local
networks:
qrmaster-network:
external: true

8
src/app/(main)/api/internal/social-milestones/route.ts
View File

@@ -5,9 +5,13 @@ import { isSocialChannel, SOCIAL_CHANNELS, SocialChannel } from '@/lib/social-mi
export const dynamic = 'force-dynamic'; export const dynamic = 'force-dynamic';
// The worker trims its own copy of the secret before sending it, so a stray
// trailing space or CR in the compose env file would otherwise show up here as a
// permanent 401 while both sides still look identical in a hash comparison.
function isAuthorized(request: NextRequest) { function isAuthorized(request: NextRequest) {
const secret = process.env.INTERNAL_API_SECRET; const secret = process.env.INTERNAL_API_SECRET?.trim();
return Boolean(secret) && request.headers.get('authorization') === `Bearer ${secret}`; const presented = request.headers.get('authorization')?.trim().replace(/^Bearer\s+/i, '');
return Boolean(secret) && presented === secret;
} }
function approvalDelayHours() { function approvalDelayHours() {