From 930ab377ce2d88371721552542c1a0922a36393e Mon Sep 17 00:00:00 2001 From: NikoKS Date: Thu, 15 Oct 2026 08:16:42 +0700 Subject: [PATCH] change desc --- .env.example | 3 ++- README.md | 2 +- docs/deployment.md | 34 ++++++++++++++++++++-------------- 3 files changed, 23 insertions(+), 16 deletions(-) diff --git a/.env.example b/.env.example index 53a3df6..10f22d6 100644 --- a/.env.example +++ b/.env.example @@ -6,7 +6,8 @@ MYSQL_PASSWORD=CHANGE_ME_APP_PASSWORD MYSQL_ROOT_PASSWORD=CHANGE_ME_ROOT_PASSWORD # Read-only SQL mount for automatic first-time setup; never included in the image. -# On a server, use an absolute private path OUTSIDE the checkout/document root. +# Default: tracked export in the repository checkout; keep repository access private. +# For a separate export, use an absolute private path outside the document root. # The file must exist on the Docker host, even when the database is initialized. DB_INIT_SQL_PATH=./DB/recruitment_local_2026-10-14.sql diff --git a/README.md b/README.md index 95f249b..5dcd8bc 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Untuk deployment PHP tanpa Docker, salin `includes/conn.example.php` ke `include - `assets/`: tampilan dan perilaku tes peserta. - `includes/`: koneksi, autentikasi peserta, dan layanan sesi tes. - `dashboard/`: halaman admin, aset merek, migrasi, dan CLI pembuat admin. -- `DB/`: export database lokal; berisi data pribadi dan diabaikan Git. +- `DB/`: export database lokal; dump awal dilacak Git untuk inisialisasi. Berisi data pribadi, jadi akses repository harus dibatasi. - `dev/`: alat preview dan pengujian lokal. - `.local/`: konfigurasi pribadi, backup, log, dan phpMyAdmin lokal; diabaikan Git. diff --git a/docs/deployment.md b/docs/deployment.md index b270abe..2e2887f 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -41,8 +41,8 @@ For a private package, configure Komodo's Registry provider/account for `gitea.cptckp.com` with a token allowed to read the image. Keep these credentials separate from the CI write token. -Before deploying, transfer your trusted initial SQL dump to the Docker host and -set `DB_INIT_SQL_PATH` as described below. Deploy the Stack: startup waits for +Before deploying, set `DB_INIT_SQL_PATH` to the tracked repository dump or a +separately transferred private file, as described below. Deploy the Stack: startup waits for MySQL, runs `db-init`, runs `migrate`, then starts the app. The one-shot services should finish with exit code 0; they do not remain running. @@ -54,22 +54,28 @@ Official reference: [Komodo Compose Stacks](https://komo.do/docs/deploy/compose) ## 2. Automatic database initialization -Obtain a trusted recruitment SQL export containing `in_daper`, `in_soal`, and -`in_jawab`. Transfer it privately to the **Docker host**, outside the -checkout/document root, for example `/srv/recruitment-private/initial.sql`. -Restrict access to the file and set this in the Stack Environment (or `.env`): +The initial dump `DB/recruitment_local_2026-10-14.sql` is tracked in this repository. +The `recruitment-hc` Komodo Stack and `.env.example` use a read-only mount from the +repository checkout, so no separate upload is required: ```dotenv -DB_INIT_SQL_PATH=/srv/recruitment-private/initial.sql +DB_INIT_SQL_PATH=./DB/recruitment_local_2026-10-14.sql ``` -For local Docker use, the default is -`./DB/recruitment_local_2026-10-14.sql`. That dump contains personal data and -existing accounts, not just schema. Review/sanitize production exports and remove -unwanted demo/test access before opening the site. Dumps are not shipped in the -app image or fetched from Git. The file is mounted read-only into `db-init`; -it must exist on the Docker host even on later deployments. A missing path fails -startup instead of silently creating a directory. Dumps must not reference the +The relative path resolves on the **Docker host** within the checked-out Compose +project, not on your local computer. Ensure the deployed commit includes the dump. +It contains personal data and existing accounts, not just schema: keep repository +access restricted, review/sanitize production exports, and remove unwanted +demo/test access before opening the site. The SQL is excluded from the app image. + +To use a different trusted export containing `in_daper`, `in_soal`, and `in_jawab`, +transfer it privately to a path outside the checkout/document root, for example +`/srv/recruitment-private/initial.sql`, and change `DB_INIT_SQL_PATH` to that +absolute path. It must exist on the Docker host, not merely in a container or on +your computer. + +The file is mounted read-only into `db-init` and must exist on every deployment. +A missing path fails startup instead of silently creating a directory. Dumps must not reference the reserved `rec_bootstrap_state` safety table; exclude it from exports/backups using the command in section 5. This prevents a restored marker from masking a failed import.