change desc

.env.example

@@ -6,7 +6,8 @@ MYSQL_PASSWORD=CHANGE_ME_APP_PASSWORD
 MYSQL_ROOT_PASSWORD=CHANGE_ME_ROOT_PASSWORD
 
 # Read-only SQL mount for automatic first-time setup; never included in the image.
-# On a server, use an absolute private path OUTSIDE the checkout/document root.
+# Default: tracked export in the repository checkout; keep repository access private.
+# For a separate export, use an absolute private path outside the document root.
 # The file must exist on the Docker host, even when the database is initialized.
 DB_INIT_SQL_PATH=./DB/recruitment_local_2026-10-14.sql
 

README.md

@@ -17,7 +17,7 @@ Untuk deployment PHP tanpa Docker, salin `includes/conn.example.php` ke `include
 - `assets/`: tampilan dan perilaku tes peserta.
 - `includes/`: koneksi, autentikasi peserta, dan layanan sesi tes.
 - `dashboard/`: halaman admin, aset merek, migrasi, dan CLI pembuat admin.
-- `DB/`: export database lokal; berisi data pribadi dan diabaikan Git.
+- `DB/`: export database lokal; dump awal dilacak Git untuk inisialisasi. Berisi data pribadi, jadi akses repository harus dibatasi.
 - `dev/`: alat preview dan pengujian lokal.
 - `.local/`: konfigurasi pribadi, backup, log, dan phpMyAdmin lokal; diabaikan Git.
 

docs/deployment.md

@@ -41,8 +41,8 @@ For a private package, configure Komodo's Registry provider/account for
 `gitea.cptckp.com` with a token allowed to read the image. Keep these credentials
 separate from the CI write token.
 
-Before deploying, transfer your trusted initial SQL dump to the Docker host and
+Before deploying, set `DB_INIT_SQL_PATH` to the tracked repository dump or a
-set `DB_INIT_SQL_PATH` as described below. Deploy the Stack: startup waits for
+separately transferred private file, as described below. Deploy the Stack: startup waits for
 MySQL, runs `db-init`, runs `migrate`, then starts the app. The one-shot services
 should finish with exit code 0; they do not remain running.
 
@@ -54,22 +54,28 @@ Official reference: [Komodo Compose Stacks](https://komo.do/docs/deploy/compose)
 
 ## 2. Automatic database initialization
 
-Obtain a trusted recruitment SQL export containing `in_daper`, `in_soal`, and
+The initial dump `DB/recruitment_local_2026-10-14.sql` is tracked in this repository.
-`in_jawab`. Transfer it privately to the **Docker host**, outside the
+The `recruitment-hc` Komodo Stack and `.env.example` use a read-only mount from the
-checkout/document root, for example `/srv/recruitment-private/initial.sql`.
+repository checkout, so no separate upload is required:
-Restrict access to the file and set this in the Stack Environment (or `.env`):
 
 ```dotenv
-DB_INIT_SQL_PATH=/srv/recruitment-private/initial.sql
+DB_INIT_SQL_PATH=./DB/recruitment_local_2026-10-14.sql
 ```
 
-For local Docker use, the default is
+The relative path resolves on the **Docker host** within the checked-out Compose
-`./DB/recruitment_local_2026-10-14.sql`. That dump contains personal data and
+project, not on your local computer. Ensure the deployed commit includes the dump.
-existing accounts, not just schema. Review/sanitize production exports and remove
+It contains personal data and existing accounts, not just schema: keep repository
-unwanted demo/test access before opening the site. Dumps are not shipped in the
+access restricted, review/sanitize production exports, and remove unwanted
-app image or fetched from Git. The file is mounted read-only into `db-init`;
+demo/test access before opening the site. The SQL is excluded from the app image.
-it must exist on the Docker host even on later deployments. A missing path fails
+
-startup instead of silently creating a directory. Dumps must not reference the
+To use a different trusted export containing `in_daper`, `in_soal`, and `in_jawab`,
+transfer it privately to a path outside the checkout/document root, for example
+`/srv/recruitment-private/initial.sql`, and change `DB_INIT_SQL_PATH` to that
+absolute path. It must exist on the Docker host, not merely in a container or on
+your computer.
+
+The file is mounted read-only into `db-init` and must exist on every deployment.
+A missing path fails startup instead of silently creating a directory. Dumps must not reference the
 reserved `rec_bootstrap_state` safety table; exclude it from exports/backups using
 the command in section 5. This prevents a restored marker from masking a failed
 import.