[pull] master from Ocelot-Social-Community:master

.env

@@ -1 +1 @@
-OCELOT_VERSION=sha-9e68997
+OCELOT_VERSION=sha-f91e279

.github/workflows/publish.yml

@@ -54,7 +54,7 @@ jobs:
         uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
         with:
           file:  ${{ matrix.app.file }}
-          context: .
+          context: ${{ matrix.app.context || '.' }}
           push: true
           build-args: |
               OCELOT_VERSION=${{ env.OCELOT_VERSION }}

.gitignore

@@ -0,0 +1 @@
+.DS_Store

.sops.yaml

@@ -5,11 +5,13 @@ creation_rules:
       age1zycwtk6dkxj6vuqhj9jw7932ythky9p3att6df4z9qasyw8v5dxquejcmp,
       age15arcg8x6ltnsacwalvny0h2d4d4wkdmax328mw3v5vda9zm97uqshtavmr,
       age1khw2eps099audp3uu5s9rk07qznllh5c8a43gv5dtpnq2a7lue6qrehn5s,
-      age1f6mzqe0cejajzt0c7nwdjz4xvs4hjct9d8hrgj60e7unzyfd7prsn0npe5
+      age1f6mzqe0cejajzt0c7nwdjz4xvs4hjct9d8hrgj60e7unzyfd7prsn0npe5,
+      age1t0ufylv5xfwhmcamu4gpwtay4wcuyqgzlkht4t04s9qjl8xjks9skxrt02
 
 # age1al36hkk8can83zpxq8qyy07gpv83hdw9vchfly5f264kanz405as283a00 SOPS_KEY github secret
 # age1llp6k66265q3rzqemxpnq0x3562u20989vcjf65fl9s3hjhgcscq6mhnjw @roschaefer
 # age1zycwtk6dkxj6vuqhj9jw7932ythky9p3att6df4z9qasyw8v5dxquejcmp @mahula
 # age15arcg8x6ltnsacwalvny0h2d4d4wkdmax328mw3v5vda9zm97uqshtavmr @Elweyn
 # age1khw2eps099audp3uu5s9rk07qznllh5c8a43gv5dtpnq2a7lue6qrehn5s @ulfgebhardt
 # age1f6mzqe0cejajzt0c7nwdjz4xvs4hjct9d8hrgj60e7unzyfd7prsn0npe5 @Tirokk
+# age1t0ufylv5xfwhmcamu4gpwtay4wcuyqgzlkht4t04s9qjl8xjks9skxrt02 @Bettelstab

branding/constants/groups.js

@@ -1,5 +1,5 @@
 // this file is duplicated in `backend/src/constants/group.js` and `webapp/constants/group.js`
 export const NAME_LENGTH_MIN = 3
 export const NAME_LENGTH_MAX = 50
-export const DESCRIPTION_WITHOUT_HTML_LENGTH_MIN = 100 // with removed HTML tags
+export const DESCRIPTION_WITHOUT_HTML_LENGTH_MIN = 10 // with removed HTML tags
 export const SHOW_GROUP_BUTTON_IN_HEADER = true

docker-compose.yml

@@ -12,6 +12,12 @@ services:
       WEBSOCKETS_URI: ws://localhost:3000/api/graphql
       GRAPHQL_URI: http://backend:4000/
       MAPBOX_TOKEN: "pk.eyJ1IjoiYnVzZmFrdG9yIiwiYSI6ImNraDNiM3JxcDBhaWQydG1uczhpZWtpOW4ifQ.7TNRTO-o9aK1Y6MyW_Nd4g"
+      PUBLIC_REGISTRATION: "true"
+      INVITE_REGISTRATION: "true"
+      CATEGORIES_ACTIVE: "true"
+      BADGES_ENABLED: "true"
+      NETWORK_NAME: "stage.ocelot.social"
+      ASK_FOR_REAL_NAME: "false"
     ports:
       - 3000:3000
     depends_on:
@@ -31,7 +37,19 @@ services:
       NEO4J_URI: bolt://neo4j:7687
       MAPBOX_TOKEN: "pk.eyJ1IjoiYnVzZmFrdG9yIiwiYSI6ImNraDNiM3JxcDBhaWQydG1uczhpZWtpOW4ifQ.7TNRTO-o9aK1Y6MyW_Nd4g"
       JWT_SECRET: "b/&&7b78BF&fv/Vd"
-      PRIVATE_KEY_PASSPHRASE: "a7dsf78sadg87ad87sfagsadg78"
+      PUBLIC_REGISTRATION: "true"
+      INVITE_REGISTRATION: "true"
+      CATEGORIES_ACTIVE: "true"
+      MAX_PINNED_POSTS: "1"
+      SMTP_HOST: "mailserver"
+      SMTP_PORT: "1025"
+      SMTP_IGNORE_TLS: "true"
+      SMTP_USERNAME:
+      SMTP_PASSWORD:
+      SMTP_MAX_CONNECTIONS: "1"
+      SMTP_MAX_MESSAGES: "10"
+      EMAIL_DEFAULT_SENDER: "hello@ocelot.social"
+      EMAIL_SUPPORT: "hello@ocelot.social"
     ports:
       - 4000:4000
     depends_on:
@@ -50,6 +68,10 @@ services:
 
   neo4j:
     image: ghcr.io/ocelot-social-community/ocelot-social/neo4j:master
+    ports:
+      - 7473:7473
+      - 7474:7474
+      - 7687:7687
     environment:
       NEO4J_AUTH: none
       NEO4J_dbms_allow__format__migration: "true"

docker/maintenance.Dockerfile

@@ -3,5 +3,5 @@ ARG OCELOT_VERSION=master
 FROM ghcr.io/ocelot-social-community/ocelot-social/maintenance-build:${OCELOT_VERSION} AS build
 
 FROM ghcr.io/ocelot-social-community/ocelot-social/maintenance-base:${OCELOT_VERSION} AS branded
-COPY --from=build ./app/dist/ /usr/share/nginx/html/
-COPY --from=build ./app/maintenance/nginx/custom.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/.output/public/ /usr/share/nginx/html/
+COPY --from=build /app/nginx/custom.conf /etc/nginx/conf.d/default.conf

helmfile/environments/default.secrets.yaml

@@ -0,0 +1,101 @@
+deploy:
+    ACME_EMAIL: ENC[AES256_GCM,data:kmD2u4WBF4t7VZBCrQye6g6jsD4=,iv:iU3Kka2logDrGpIv7mvU2w9/NtLhUhir1KNum35SmFY=,tag:etn5b0vZurGr/dKbi0ONlA==,type:str]
+jwt:
+    JWT_SECRET: ENC[AES256_GCM,data:g+PuDCyOup6tSupdvXplQSYpTjWeDghj,iv:ETfdU1O1wU2EkZtnqy/s5MgS4D4lOMMdBeZ8ps2jlwE=,tag:fsTKMuttYaWWo8aknOW7nQ==,type:str]
+s3:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:HAxUYdG8h0xY0oVSd8cngv5sIQM=,iv:XNBEipivgW4/ZWIiOwFOeQcKWPWD1MwK4u5M06Y5zvk=,tag:lLUcTSnE/np66btTzVm91w==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:QaP7i3i6gcVsPtT9C+vjWtK4qwatumH/xSfNClnT3iSHETCzbt/P0w==,iv:NvNlI9LZq0gYUdNH62s18pNVtyNAi5aZ+gEOXXVBDMM=,tag:rA6zUU4izoyWuijXNFUdhg==,type:str]
+    AWS_ENDPOINT: ENC[AES256_GCM,data:R0DA8FYto2QThumIb5LwddkB2mz1W2YckUuBvIB8svmZP7Y=,iv:Vl3IsRXKHJovrB9wAwq6kpWvCOx4gAmaMZO9FwB4OT8=,tag:TElpGx//7Y4TmWNV9S/NRA==,type:str]
+    AWS_REGION: ENC[AES256_GCM,data:/yHagQ==,iv:xlg2Q3zNkVS5aMPoKFFwgeZEl2gmIWUuuRwreQNO6Hk=,tag:dVRPNSlY4KOhWGImHyiT4Q==,type:str]
+    AWS_BUCKET: ENC[AES256_GCM,data:+SCuUMhyAV5qPaJvyIYlSwbp3Kd7,iv:mudkJbvGzvtI6StOajJoYR4XUjlJ8315Yf3IZdcxb00=,tag:uA+z7dDja5D2F4i1hPCmog==,type:str]
+email:
+    EMAIL_DEFAULT_SENDER: ENC[AES256_GCM,data:jWxjlQlBJL6LROw09ipPXObsioE=,iv:Hq6Wjhn6tuYzloS0m5/lIrY5Fc4Etu5E3mQKGa0im9Y=,tag:vY/lmb3AcIjF2O9ez+qQXQ==,type:str]
+    SMTP_HOST: ENC[AES256_GCM,data:2IM+567JWBKTaNed,iv:r5IKf+xhQu5UDomQFBeAK4HFLevvLIpAGYTDEWla4qU=,tag:9CXbXyGBS7Wsy8hj77aw+g==,type:str]
+    SMTP_USERNAME: ENC[AES256_GCM,data:qHiNyGbh,iv:+M+m2ExbgRDaeW86EMKduwABwCOeSL5e5toHbZQseC0=,tag:Y0xo6m9apFrNm2OLCkxp5w==,type:str]
+    SMTP_PASSWORD: ENC[AES256_GCM,data:9a32IxgqYNOV/SZrE5/faDXlZCnms4iGZeCPbqUOy2k=,iv:bYyclI+GryY2DdCTsOBTPz2IbxkCWTxNJOxCVDAcDDo=,tag:B1xfizO+KjVQzQmO9XKS5g==,type:str]
+    SMTP_PORT: ENC[AES256_GCM,data:z2mi,iv:GxhWj1xu4Q5hPdgEdDKvofNiM2H001KwDnmwBOkZreQ=,tag:FR26qyT++nuBWYCdIaD8aA==,type:str]
+    SMTP_IGNORE_TLS: ENC[AES256_GCM,data:4kGb1Mg=,iv:vEmSMb2YO+V3TXi7zknAQnTi/+4P3tURYCe++W9cMPQ=,tag:t/ABaQ3xTgtAujJhI57KZA==,type:str]
+    #ENC[AES256_GCM,data:A27ANKNxRZzYfNIpp+zmxCYHsYuw/Yb3Me2gZ2lecaGpaD/L,iv:GJKErFFmUKoF8nVAL71VRIlKrD1LwKLCOW6w3676r30=,tag:oQCcqZcHoDsTLGPSPQXPSg==,type:comment]
+    SMTP_SECURE: ENC[AES256_GCM,data:n7fBfDU=,iv:f/0IlQhkuO10aUkbPFg8Ch7eG3yuzbE2kFYePoJBbck=,tag:5S0GdaqBDacD6YMdpzh6jA==,type:str]
+    SMTP_DKIM_PRIVATEKEY: null
+    SMTP_DKIM_DOMAINNAME: null
+    SMTP_DKIM_KEYSELECTOR: null
+    SMTP_MAX_CONNECTIONS: ENC[AES256_GCM,data:pQ==,iv:HSZe1mkKGsXVdxOes9QPhveHZGs+13l58uszcqoxU+k=,tag:S0eQqlrQ6wWrHknNnWonJQ==,type:str]
+redis:
+    REDIS_PASSWORD: null
+imagor:
+    IMAGOR_SECRET: ENC[AES256_GCM,data:pvZNYv3vAUiCW65Mtu7W8dZ1B16dC+0Pc+kG/1WD+Hw=,iv:CIcJRqeDztLQb4a0WsDSlQCkZ6dpqzvotYQ3A424SKc=,tag:b1em2uJyQLzEenPU2U6VYw==,type:str]
+neo4j:
+    NEO4J_USERNAME: null
+    NEO4J_PASSWORD: null
+map:
+    MAPBOX_TOKEN: ENC[AES256_GCM,data:2Xq6+LyNVDSwZpl3m0KLsEVKYzVbtvBLwgzqhZiYGDSXtEOrw+1xVwArPUQlNrc71gvWGwDZeFzo8VztjoEZ18nMQovOmEICU8aEqzsDt3PESUCICTkx4+z2dqc=,iv:OXjYCZOV+WPrsg9OuRIpGjkZcu0AQoeggfA583yP5Ms=,tag:T68lf/kaT7PZBep7ZBrYpA==,type:str]
+sops:
+    age:
+        - recipient: age1al36hkk8can83zpxq8qyy07gpv83hdw9vchfly5f264kanz405as283a00
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLd1BvUUVRbFZQemNtcFZ6
+            dUliNmpIUDcvL2F1cENvWldsUE9FWVFxZ21rCm9GWkxKZ05qVjhMNy9ueW43d1Mz
+            TTI2RzFsR1B3RlFWVitwcUpqRTdEQjQKLS0tIENZeEJCSlJMcHVMaXB1dFB3YmhL
+            enVVbGVWcmJoM1hJNTlzSlhpaS8rUWsK9Y1sjUnFjB3s2wHVvMU3bVC1LIYvrz8t
+            n/QaIHUIEf0NB/ZPj6r6hplCnf+EJVKuVl5pu4xw2ED9PvXQ6UUZvQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1llp6k66265q3rzqemxpnq0x3562u20989vcjf65fl9s3hjhgcscq6mhnjw
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAydThhbUlBTGFIOElBUStr
+            WHdMNzBSbnlyYlFyVHhMbGJUSmozUjRINUhFCkNFbVBzTTl1cmVSRlRFL29VUFF0
+            Qy9sQk8yc0Q1aGljMk1Ob1NFVkZQd2sKLS0tIGpidFhscFAwc2pVRWxtVFY1OFo3
+            bzljNTc1MDQ4ckNQNzFjNDFGeVV5TzQKdIqZMcxhtjmPD8nsIHi8XbcZHcefo32l
+            AXXquc/+5+OBocUvAMZ9UWOdx8QCQAmaZ5YtXEePp+FFZKBcnPCRMQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zycwtk6dkxj6vuqhj9jw7932ythky9p3att6df4z9qasyw8v5dxquejcmp
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3clQ3NVM4eEpJTzgxVTR1
+            cm9vMm1qTGkvWElpckxvOXBRMzMrUlNLaVhZCjJvRElJa1ptU2szZXZjUEZ0RXd5
+            cndZWXI2RHhuYzRnOFBLV0lZelQzKzAKLS0tIGpnVzdqWEV5RlV0UVdLUTVneklT
+            SEw3RkdrN0xOWndLb01nd1ovR01JZ1EKCvlakyb1WQeDaeDHHdrQEzO9fIynZsjk
+            ci8ccnOuZYjCHOc6U4enjlD559IZdniOPA72qdEFgquCtMwDi72buA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15arcg8x6ltnsacwalvny0h2d4d4wkdmax328mw3v5vda9zm97uqshtavmr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhcys4T2J1MkRHNHN2b2hB
+            akt4OEdYclBHaC9WNVdUdVhhalFaRzdDL1JVCkZDcElHclowaXFIRHJhaHluVW9j
+            d0VoVUZMcWlQclBrUXlRb3R3UzdpVzQKLS0tIEdyZ0dTc0lKOGJDTlNBUnZlcnp6
+            Z1dZeWRsUkVpMzF4RWtMd0pqV3g5RHcKdmPPkfoMaHwmdfVm+vnaWpuzgEK4NREx
+            NSt4JDmqxDV0j4iQMzMyULgHdeyvxnXpHiyNh4FnKzZljh8J1O8/yw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1khw2eps099audp3uu5s9rk07qznllh5c8a43gv5dtpnq2a7lue6qrehn5s
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYL3lnR2dZMmVpS3lMa1kz
+            b0lIeVVsUzUwSWszNzBVdWpCak5Rb0lKcFY4CnN0ckFjcDZtRDZsMkcxRWMvOHo4
+            d01ySkJRemEzQ3dGK2NBU3pIZ0ROU0EKLS0tIFIwaVlhc2h0ZThwclBBMWNTc2dF
+            emdXSnhBV1VMbXp6ai9MaTBSZkNzYUUKkvZSOuYITTnDdm8RLk6h4inF3AqpfjX6
+            TByKxFuoRWQNu0mB1RNniwwYegfY/hIoXQ8hFEBaYLqapqadz+X+Kg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1f6mzqe0cejajzt0c7nwdjz4xvs4hjct9d8hrgj60e7unzyfd7prsn0npe5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWK1lPTE9ac01kazdEVHd1
+            c25FWFVZVDhkeUYyeXdqeGFabEZtY0haeGhBCnpRQ2wwTG96cmlTZXl3WHc2UytL
+            YzVYdEZ1U2EzVXltZ2FibERnRWM3Yk0KLS0tIHVpaDVIM1N5M2hMNHY0anNmK0c0
+            cnp5ZU1lMzJrRlNFQ2VLSmxGUElOMjQKrbR6dL1UwkRTwdHFrq6HAvt4R8SsAbqE
+            V3tS9utgx5PEDQkVC/7ueuXFyeQyJFya7lvZREvJOLRTRDl6PbC/Ew==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1t0ufylv5xfwhmcamu4gpwtay4wcuyqgzlkht4t04s9qjl8xjks9skxrt02
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdDFhVU16KzhwMmdpUHRo
+            TWNTaWdlN1FWYzhFb00zWGpON29JTEhuRDE0CmxmdkQ4ZkYrWnJIblBDK3dIVUN5
+            K2pKNmRkWnB4OVNreVJOV3JCUjNPY0UKLS0tIGVBaUN3VTZWOUkrcFZNTVV4S0RH
+            TTVLamdEaEZOYk55cldCVzBuWm1UTEEKjrVRYcy6P3JyPlgSrAxm127TqQzfi7mj
+            McQxS+qNleBjIvfWDhb8I7dsVt/3CSfZ+HHVZ3APhHLAT+av+pyi3w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-11T13:23:59Z"
+    mac: ENC[AES256_GCM,data:EqtytB/3Pv8qn/bmciwSKhYZL2dEcKaXf3aMlJgrghMPNSe5Hj6PvtfYCj5oUGTunrF17FyaHkqLNuu+LuXihiMGxSLbMCtfs/6VZNxNlkqpvTmx55iJubUX0s2SoUuQaKApzASILDwnMfOs1ODWlTjb1SP36O9osLWLe5cR2xQ=,iv:RpkmsbolmWashtGmJZRua1NOk6xvaWcdvGZulf8T46U=,tag:C5uQLL7mAHlN2ivQETKUGg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1

helmfile/environments/default.yaml.gotmpl

@@ -1,6 +1,25 @@
-{{ $image_tag := env "IMAGE_TAG" | default  (exec "../scripts/image_tag.sh" (list) | trim) }}
+{{ $image_tag := env "IMAGE_TAG" | default  (exec "../scripts/branded_image_tag.sh" (list) | trim) }}
 
-domain: staging.ocelot-social.it4c.org
-namespace: ocelot-staging
-image_tag: {{ $image_tag }}
-github_repository: ocelot-social-community/stage.ocelot.social
+deploy:
+    GITHUB_REPOSITORY: ocelot-social-community/stage.ocelot.social
+    IMAGE_TAG: {{ $image_tag }}
+    DOMAIN: stage.ocelot.social
+    REDIRECT_DOMAINS: []
+    NAMESPACE: ocelot-staging
+    RELEASE_NAME_OCELOT: ocelot-social
+    NEO4J_STORAGE: "5Gi"
+
+ocelot:
+    options:
+        PRODUCTION_DB_CLEAN_ALLOW: "false"
+        PUBLIC_REGISTRATION: "true"
+        INVITE_REGISTRATION: "true"
+        CATEGORIES_ACTIVE: "true"
+        MAX_PINNED_POSTS: "1"
+        BADGES_ENABLED: "true"
+        NETWORK_NAME: "stage.ocelot.social"
+        ASK_FOR_REAL_NAME: "false"
+        REQUIRE_LOCATION: "false"
+        MAX_GROUP_PINNED_POSTS: "1"
+        API_KEYS_ENABLED: "true"
+        API_KEYS_MAX_PER_USER: "5"

helmfile/helmfile.yaml.gotmpl

@@ -3,24 +3,31 @@ environments:
   default:
     values:
       - ./environments/default.yaml.gotmpl
+    secrets:
+      - ./environments/default.secrets.yaml
+  production:
+    values:
+      - ./environments/production.yaml.gotmpl
+    secrets:
+      - ./environments/production.secrets.yaml
 ---
 repositories:
   - name: ocelot-social
-    url: git+https://github.com/Ocelot-Social-Community/Ocelot-Social@deployment/helm/charts?ref=hetzner
+    url: git+https://github.com/Ocelot-Social-Community/Ocelot-Social@deployment/helm/charts
 
 releases:
-  - name: ocelot-social
-    namespace: {{ .StateValues.namespace }}
+  - name: {{ .StateValues.deploy.RELEASE_NAME_OCELOT }}
+    namespace: {{ .StateValues.deploy.NAMESPACE }}
     chart: ocelot-social/ocelot-social
     values:
     - ./values/ocelot.yaml.gotmpl
     secrets:
-      - ./secrets/ocelot.yaml
+    - ./secrets/ocelot.yaml.gotmpl
 
   - name: ocelot-neo4j
-    namespace: {{ .StateValues.namespace }}
+    namespace: {{ .StateValues.deploy.NAMESPACE }}
     chart: ocelot-social/ocelot-neo4j
     values:
     - ./values/ocelot.yaml.gotmpl
     secrets:
-      - ./secrets/ocelot.yaml
+    - ./secrets/ocelot.yaml.gotmpl

helmfile/scripts/ocelot_image_tag.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+SCRIPT_PATH=$(realpath $0)
+SCRIPT_DIR=$(dirname $SCRIPT_PATH)
+
+set -a; . ${SCRIPT_DIR}/../../.env; set +a;
+echo $OCELOT_VERSION