fix(docker): repair the Coolify preview deployment

docker/preview/* was never updated for the native-auth cutover (#1317) or the Java
webhook receiver (#1300, #1306), and had drifted far enough that no stack could boot.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: FelixTJDietrich

docker/preview/compose.app.yaml

@@ -13,17 +13,17 @@
 #   5. Configure environment variables (see .env.example)
 #   6. Configure domains in Coolify UI (General tab) on the MAIN application:
 #      - webapp: https://hephaestus.example.com
-#      - application-server: https://api.hephaestus.example.com
+#      - appserver: https://api.hephaestus.example.com
 #
 #   Preview deployments will AUTOMATICALLY get domains like:
 #      - webapp: https://{{pr_id}}.hephaestus.example.com
-#      - application-server: https://{{pr_id}}.api.hephaestus.example.com
+#      - appserver: https://{{pr_id}}.api.hephaestus.example.com
 #
 # Coolify Auto-Generated Variables:
 #   - SERVICE_FQDN_WEBAPP: Domain for webapp (host only, no scheme)
 #   - SERVICE_URL_WEBAPP: Full URL for webapp (with https://)
-#   - SERVICE_FQDN_APPLICATION_SERVER: Domain for API (host only)
-#   - SERVICE_URL_APPLICATION_SERVER: Full URL for API (with https://)
+#   - SERVICE_FQDN_APPSERVER: Domain for API (host only)
+#   - SERVICE_URL_APPSERVER: Full URL for API (with https://)
 #   - SERVICE_NAME_<SERVICE>: Container name (e.g., postgres-wg44k0c-pr-557)
 #   - COOLIFY_CONTAINER_NAME: Unique container identifier
 #
@@ -44,9 +44,13 @@ services:
   # SEEDING HACK: Uses init container to populate via psql commands
   # after postgres starts, rather than relying on /docker-entrypoint-initdb.d
   # ---------------------------------------------------------------------------
+  # No `hostname:` override. Coolify attaches every stack to the shared `coolify`
+  # network, where a fixed hostname would make each preview's postgres answer to the
+  # same `postgres` name — an app-server could then reach another PR's database.
+  # The compose service key is already a per-deploy-unique alias (`postgres` on the
+  # base deploy, `postgres-pr-<id>` on previews); reference it via SERVICE_NAME_POSTGRES.
   postgres:
     image: ghcr.io/ls1intum/hephaestus/postgres:${IMAGE_TAG:-latest}
-    hostname: postgres
     restart: unless-stopped
     environment:
       POSTGRES_DB: hephaestus
@@ -81,14 +85,14 @@ services:
     environment:
       PGPASSWORD: ${POSTGRES_PASSWORD:-hephaestus-preview}
       SERVICE_NAME_POSTGRES: ${SERVICE_NAME_POSTGRES:-}
-      SERVICE_FQDN_APPLICATION_SERVER: ${SERVICE_FQDN_APPLICATION_SERVER:-}
+      SERVICE_FQDN_APPSERVER: ${SERVICE_FQDN_APPSERVER:-}
       SERVICE_FQDN_WEBAPP: ${SERVICE_FQDN_WEBAPP:-}
     command: |
       sh -c '
         set -e
         apk add --no-cache docker-cli >/tmp/apk.log 2>&1
 
-        APP_FQDN="${SERVICE_FQDN_APPLICATION_SERVER:-${SERVICE_FQDN_WEBAPP:-}}"
+        APP_FQDN="${SERVICE_FQDN_APPSERVER:-${SERVICE_FQDN_WEBAPP:-}}"
         if ! echo "$$APP_FQDN" | grep -Eq "^pr[0-9]+"; then
           echo "Skipping seed-loader: non-PR deployment detected"
           exit 0
@@ -183,36 +187,104 @@ services:
   # labels from docker/compose.app.yaml are intentionally omitted here — they would be a
   # no-op. See docs/contributor/unified-pi-runtime.mdx.
   # ---------------------------------------------------------------------------
-  application-server:
-    build:
-      context: ./server
-      dockerfile: Dockerfile
-    hostname: application-server
+  # Docker creates named volumes owned by root:root, but the buildpack image runs as the
+  # unprivileged `cnb` user (1002:1001). Without this, GitRepositoryManager cannot mkdir under
+  # /data/git-repos ("Failed to ensure repository" on every checkout) and Tomcat's AccessLogValve
+  # cannot open /var/log/hephaestus/access. Previews get fresh root-owned volumes on every deploy,
+  # so this cannot be a one-off fix applied by hand.
+  volume-init:
+    image: alpine:3
+    command:
+      - sh
+      - -c
+      - chown -R 1002:1001 /data/git-repos /var/log/hephaestus && chmod 0755 /data/git-repos /var/log/hephaestus
+    volumes:
+      - git-repos:/data/git-repos
+      - appserver-logs:/var/log/hephaestus
+    restart: "no"
+
+  # Never use `${VAR:?message}` in this file. Coolify's compose parser seeds its own environment
+  # store from these placeholders and keeps the *message* as the value, so `:?Required` becomes the
+  # literal string "Required" — which then fails the boot far from the cause (a base64 "Required" is
+  # 6 bytes, not the 32 the state-cookie key needs). Leave required vars as a bare `${VAR}` and let
+  # the app's own fail-fast report them.
+  #
+  # There is no server/Dockerfile: the image comes from Paketo buildpacks (spring-boot:build-image,
+  # server/pom.xml), which also supplies the /workspace/health-check binary the healthcheck invokes.
+  # ci-docker-build.yml publishes `latest` (main), `pr-<id>` (PRs), `<sha>`, `<branch>`. The webapp
+  # below builds from source, so a preview always exercises the PR's frontend; set IMAGE_TAG=pr-<id>
+  # to exercise the PR's server too (that tag exists only if the PR touched server/).
+  #
+  # The service name is `appserver`, not `application-server`, and it is load-bearing. Coolify stores
+  # a service's configured domain under the service name but resolves it at deploy time with dashes
+  # replaced by underscores; with a dashed name it did not find the entry and replaced the domain
+  # with an auto-generated <service>-<uuid>.<wildcard> host on every deploy. A dash-free name makes
+  # the two forms identical and the configured api.<domain> sticks.
+  appserver:
+    image: ghcr.io/ls1intum/hephaestus/application-server:${IMAGE_TAG:-latest}
     restart: unless-stopped
+    expose:
+      - "8080"
     environment:
       SPRING_PROFILES_ACTIVE: prod
       # prod runs forward-headers=native, so ProxyTrustGuard aborts the boot unless this is set.
       # Coolify fronts previews with its own proxy — set its ingress regex, not staging's range.
-      HEPHAESTUS_TRUSTED_PROXIES: ${HEPHAESTUS_TRUSTED_PROXIES:?Required}
+      #
+      # Write this Tomcat internal-proxies regex WITHOUT backslashes. Coolify re-escapes them when
+      # it writes the stack's .env, so "172\.18\." arrives in the container as "172\\.18\\." — which
+      # as a Java regex matches a literal backslash and therefore never matches an IP. The valve then
+      # silently distrusts Traefik, X-Forwarded-Proto is ignored, and every OAuth redirect_uri is
+      # built as http:// (which the IdP rejects). An unescaped '.' matches any char, which is
+      # harmless here: e.g. 172.(1[6-9]|2[0-9]|3[01]).[0-9]{1,3}.[0-9]{1,3}
+      HEPHAESTUS_TRUSTED_PROXIES: ${HEPHAESTUS_TRUSTED_PROXIES}
       # Previews run non-release images with no release-pin, so don't require a digest-pinned agent image.
       HEPHAESTUS_AGENT_IMAGE_REQUIRE_DIGEST: ${HEPHAESTUS_AGENT_IMAGE_REQUIRE_DIGEST:-false}
-      # URL - Coolify provides SERVICE_FQDN_WEBAPP
+      # The SPA's origin — NOT this server's. It feeds hephaestus.cors.allowed-origins,
+      # hephaestus.webapp.url and the links the app hands to users.
       APPLICATION_HOST_URL: https://${SERVICE_FQDN_WEBAPP}
+      # The API is served at the ROOT of its own host here (Coolify cannot route a compose service
+      # on a path — it regenerates a host-only domain — so the SPA and the API get sibling hosts).
+      # application-prod.yml pins api-base-path=/api for the production stack, where Traefik strips
+      # that prefix. Nothing strips it here, so it must be cleared or every OAuth callback is built
+      # as https://<api-host>/api/login/oauth2/code/... and 404s. An env var outranks the profile
+      # YAML, and the callback's {baseUrl} comes from the request.
+      HEPHAESTUS_AUTH_API_BASE_PATH: ""
       # Internal, trusted docker-network DB: skip TLS. pgJDBC doesn't validate Postgres' self-signed cert
       # so it adds no authentication, only the SSL handshake's NIO direct buffers that OOM the JVM off-heap
       # default; confidentiality is fine to drop here (creds already sit in plaintext compose env).
-      DATABASE_URL: postgresql://postgres:5432/hephaestus?sslmode=disable
+      # SERVICE_NAME_POSTGRES is Coolify's per-deploy service key, so a preview can only ever
+      # reach its own database (see the note on the postgres service).
+      DATABASE_URL: postgresql://${SERVICE_NAME_POSTGRES:-postgres}:5432/hephaestus?sslmode=disable
       DATABASE_USERNAME: hephaestus
       DATABASE_PASSWORD: ${POSTGRES_PASSWORD:-hephaestus-preview}
-      # Shared infrastructure (must match shared-infra service names with UUID suffix)
-      # When "Connect to Predefined Network" is enabled, use the full container names
+      # Shared infrastructure, reached over Coolify's predefined `coolify` network.
       NATS_SERVER: nats://nats-server:4222
+      # hephaestus.sync.nats.server and hephaestus.agent.nats.server BOTH default to ${NATS_SERVER},
+      # so they must be pinned separately — otherwise aiming the integration consumer at another
+      # environment's NATS would also submit this stack's agent jobs into that environment's AGENT
+      # queue, where its workers would execute them.
+      #
+      # The integration consumer may point at an upstream NATS (e.g. staging's) to consume webhook
+      # events that a shared GitHub App delivers there, instead of receiving deliveries locally.
+      # durable-consumer-name is per-deploy (below), so this stack cannot steal that environment's
+      # messages — it gets its own JetStream consumers.
+      HEPHAESTUS_SYNC_NATS_SERVER: ${HEPHAESTUS_SYNC_NATS_SERVER:-nats://nats-server:4222}
+      # Agent job queue stays local, always.
+      HEPHAESTUS_AGENT_NATS_SERVER: nats://nats-server:4222
       NATS_ENABLED: ${NATS_ENABLED:-true}
-      NATS_DURABLE_CONSUMER_NAME: ${COOLIFY_CONTAINER_NAME:-preview}-consumer
-      # Auth (Hephaestus-native; ADR 0017).
-      # Public URL for issuer validation (must match token's iss claim).
-      HEPHAESTUS_AUTH_ISSUER: https://${PREVIEW_DOMAIN:?Required}
-      HEPHAESTUS_AUTH_STATE_COOKIE_KEY: ${HEPHAESTUS_AUTH_STATE_COOKIE_KEY:?Required}
+      # Per-deploy durable name: a shared one would make base and every preview compete for the
+      # same JetStream consumer and steal each other's messages.
+      NATS_DURABLE_CONSUMER_NAME: ${SERVICE_NAME_APPSERVER:-appserver}-consumer
+      # Auth (Hephaestus-native; ADR 0017). Issuer is this deploy's own origin, so a preview's
+      # tokens validate against the preview it was issued by.
+      HEPHAESTUS_AUTH_ISSUER: https://${SERVICE_FQDN_WEBAPP}
+      HEPHAESTUS_AUTH_STATE_COOKIE_KEY: ${HEPHAESTUS_AUTH_STATE_COOKIE_KEY}
+      # First super-admin: the admin UI is admin-gated, so it must come from operator config.
+      HEPHAESTUS_AUTH_BOOTSTRAP_ADMINS: ${HEPHAESTUS_AUTH_BOOTSTRAP_ADMINS:-}
+      # AES-256-GCM key (exactly 32 chars) for credentials encrypted at rest in `connection`.
+      # Required in prod by EncryptedStringConverter + JwtSigningKeySealer, and the Liquibase
+      # backfill re-encrypts on boot — so it MUST be present wherever Liquibase runs.
+      HEPHAESTUS_SECURITY_ENCRYPTION_KEY: ${HEPHAESTUS_SECURITY_ENCRYPTION_KEY}
       # Sourced from GH_OAUTH_* — GitHub Actions reserves the GITHUB_ prefix for secret/variable names.
       GITHUB_OAUTH_CLIENT_ID: ${GH_OAUTH_CLIENT_ID:-}
       GITHUB_OAUTH_CLIENT_SECRET: ${GH_OAUTH_CLIENT_SECRET:-}
@@ -221,10 +293,52 @@ services:
       GITLAB_OAUTH_BASE_URL: ${GITLAB_OAUTH_BASE_URL:-https://gitlab.com}
       GITLAB_OAUTH_DISPLAY_NAME: ${GITLAB_OAUTH_DISPLAY_NAME:-GitLab}
       # GitHub integration
-      GH_APP_ID: ${GH_APP_ID:?Required}
-      GH_APP_PRIVATE_KEY: ${GH_APP_PRIVATE_KEY:?Required}
+      GH_APP_ID: ${GH_APP_ID}
+      GH_APP_PRIVATE_KEY: ${GH_APP_PRIVATE_KEY}
       GH_APP_INSTALLATION_URL: ${GH_APP_INSTALLATION_URL:-}
-      GH_AUTH_TOKEN: ${GH_AUTH_TOKEN:?Required}
+      GH_AUTH_TOKEN: ${GH_AUTH_TOKEN}
+      # GitLab integration
+      GITLAB_ENABLED: ${GITLAB_ENABLED:-false}
+      GITLAB_DEFAULT_SERVER_URL: ${GITLAB_DEFAULT_SERVER_URL:-https://gitlab.lrz.de}
+      HEPHAESTUS_FEATURES_FLAGS_GITLAB_WORKSPACE_CREATION: ${GITLAB_WORKSPACE_CREATION:-false}
+      # Slack. OAuth/admin and mentor replies run here; inbound Events API + interactivity are
+      # verified on webhook-server (shared infra), which needs the same signing secret.
+      HEPHAESTUS_INTEGRATION_SLACK_ENABLED: ${HEPHAESTUS_INTEGRATION_SLACK_ENABLED:-false}
+      HEPHAESTUS_INTEGRATION_SLACK_CLIENT_ID: ${HEPHAESTUS_INTEGRATION_SLACK_CLIENT_ID:-}
+      HEPHAESTUS_INTEGRATION_SLACK_CLIENT_SECRET: ${HEPHAESTUS_INTEGRATION_SLACK_CLIENT_SECRET:-}
+      HEPHAESTUS_INTEGRATION_SLACK_SIGNING_SECRET: ${HEPHAESTUS_INTEGRATION_SLACK_SIGNING_SECRET:-}
+      HEPHAESTUS_INTEGRATION_SLACK_REDIRECT_URI: ${HEPHAESTUS_INTEGRATION_SLACK_REDIRECT_URI:-}
+      # Practice review + Pi mentor. Execution happens on application-worker; these gate it.
+      PRACTICE_REVIEW_FOR_ALL: ${PRACTICE_REVIEW_FOR_ALL:-false}
+      HEPHAESTUS_FEATURES_FLAGS_PRACTICE_REVIEW_FOR_ALL: ${PRACTICE_REVIEW_FOR_ALL:-false}
+      AGENT_NATS_ENABLED: ${AGENT_NATS_ENABLED:-false}
+      GIT_CHECKOUT_ENABLED: ${GIT_CHECKOUT_ENABLED:-false}
+      GIT_STORAGE_PATH: /data/git-repos
+      # Agent sandbox. There is no separate application-worker container here on purpose:
+      # hephaestus.runtime.worker.enabled defaults to true, so this pod runs the worker role
+      # in-process and executes practice reviews / Pi mentor turns itself. That only works if it
+      # can reach the host Docker daemon — hence the docker.sock mount below (prod does the same).
+      SANDBOX_DOCKER_HOST: ${SANDBOX_DOCKER_HOST:-unix:///var/run/docker.sock}
+      # Previews share one host — keep the sandbox footprint small.
+      SANDBOX_MAX_CONCURRENT: ${SANDBOX_MAX_CONCURRENT:-2}
+      SANDBOX_MEMORY_BYTES: ${SANDBOX_MEMORY_BYTES:-4294967296}
+      SANDBOX_CPUS: ${SANDBOX_CPUS:-2.0}
+      # LLM proxy (OpenAI-compatible route). This is a verbatim path passthrough — the sandbox's
+      # request path is appended to the base as-is, so give it the API ROOT and let the client add
+      # /v1/chat/completions (same convention as the https://api.openai.com default).
+      LLM_PROXY_OPENAI_URL: ${LLM_PROXY_OPENAI_URL:-https://api.openai.com}
+      LLM_PROXY_OPENAI_AUTH_HEADER: ${LLM_PROXY_OPENAI_AUTH_HEADER:-Authorization}
+      LLM_PROXY_OPENAI_USE_BEARER: ${LLM_PROXY_OPENAI_USE_BEARER:-true}
+      # The LLM key + model are per-workspace (AgentConfig, encrypted at rest), not env-based.
+      # A preview starts from an empty/seeded DB with no admin to fill that in, so seed a default
+      # AgentConfig at boot — without a model name the Pi provider is never registered and the
+      # mentor silently has no LLM.
+      AGENT_DEFAULT_CONFIG_ENABLED: ${AGENT_DEFAULT_CONFIG_ENABLED:-false}
+      AGENT_DEFAULT_CONFIG_NAME: ${AGENT_DEFAULT_CONFIG_NAME:-Default}
+      AGENT_DEFAULT_CONFIG_PROVIDER: ${AGENT_DEFAULT_CONFIG_PROVIDER:-OPENAI}
+      AGENT_DEFAULT_CONFIG_MODEL_NAME: ${AGENT_DEFAULT_CONFIG_MODEL_NAME:-}
+      AGENT_DEFAULT_CONFIG_API_KEY: ${AGENT_DEFAULT_CONFIG_API_KEY:-}
+      AGENT_DEFAULT_CONFIG_BASE_URL: ${AGENT_DEFAULT_CONFIG_BASE_URL:-}
       # Monitoring (relaxed for previews)
       MONITORING_TIMEFRAME: ${MONITORING_TIMEFRAME:-14}
       MONITORING_RUN_ON_STARTUP: ${MONITORING_RUN_ON_STARTUP:-false}
@@ -234,19 +348,25 @@ services:
       LEADERBOARD_NOTIFICATION_ENABLED: "false"
       # Observability (optional)
       SENTRY_DSN: ${SENTRY_DSN:-}
-      # Webhook auto-registration. Override (not the APPLICATION_HOST_URL default) because previews
-      # route webhooks via PREVIEW_DOMAIN, not the webapp's SERVICE_FQDN_WEBAPP. Bare origin:
-      # GitLabWebhookService appends /webhooks/gitlab itself.
+      # Webhook auto-registration. Points at the shared-infra receiver's own host, not this
+      # deploy's origin: webhook-server lives in the shared-infra stack and is routed there.
+      # Bare origin — GitLabWebhookService appends /webhooks/gitlab itself.
       WEBHOOK_SECRET: ${WEBHOOK_SECRET:-}
-      WEBHOOK_EXTERNAL_URL: https://${PREVIEW_DOMAIN:?Required}
+      WEBHOOK_EXTERNAL_URL: ${WEBHOOK_EXTERNAL_URL:-https://${PREVIEW_DOMAIN}}
       # thc healthcheck target: actuator liveness on the management port.
       THC_PORT: "8080"
       THC_PATH: /actuator/health/liveness
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - git-repos:/data/git-repos
+      - appserver-logs:/var/log/hephaestus
     depends_on:
       postgres:
         condition: service_healthy
       seed-loader:
         condition: service_completed_successfully
+      volume-init:
+        condition: service_completed_successfully
     # thc healthcheck (see docker/compose.app.yaml).
     healthcheck:
       test: ["CMD", "/workspace/health-check"]
@@ -271,23 +391,24 @@ services:
       args:
         COOLIFY_BRANCH: ${COOLIFY_BRANCH:-}
         SOURCE_COMMIT: ${SOURCE_COMMIT:-}
-    hostname: webapp
     restart: unless-stopped
     environment:
       APPLICATION_VERSION: preview
       # Coolify provides SERVICE_FQDN_WEBAPP automatically
       APPLICATION_CLIENT_URL: https://${SERVICE_FQDN_WEBAPP}
       GIT_BRANCH: ${COOLIFY_BRANCH:-}
       GIT_COMMIT: ${SOURCE_COMMIT:-}
-      # Coolify provides SERVICE_FQDN_APPLICATION_SERVER (e.g., {{pr_id}}.api.example.com)
-      APPLICATION_SERVER_URL: https://${SERVICE_FQDN_APPLICATION_SERVER}
+      # The API's own host (Coolify assigns it per deploy). It is a sibling of the SPA host under
+      # the same registrable domain, so the session cookie is same-site and rides XHR normally;
+      # CORS allows this SPA origin via hephaestus.cors.allowed-origins=${APPLICATION_HOST_URL}.
+      APPLICATION_SERVER_URL: https://${SERVICE_FQDN_APPSERVER}
       TANSTACK_DEVTOOLS_ENABLED: ${TANSTACK_DEVTOOLS_ENABLED:-true}
       # Optional
       SENTRY_ENVIRONMENT: preview
       SENTRY_DSN: ${SENTRY_DSN:-}
       POSTHOG_ENABLED: "false"
     depends_on:
-      application-server:
+      appserver:
         # Gate on app-server readiness so the SPA isn't served before the API answers.
         condition: service_healthy
     healthcheck:
@@ -307,3 +428,5 @@ services:
 # =============================================================================
 volumes:
   postgres-data:
+  git-repos:
+  appserver-logs: