- Frontend on nginx-unprivileged (non-root, container port 8080)
- Replace unmaintained passlib with bcrypt 5.0.0 (hash-compatible)
- Pass DOCS_ENABLED through to the backend container
- Raise db mem_limit to 768m for MySQL 8.4
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Backend retries DB connection at startup (up to 180s) so host reboots
no longer crash-loop it; add backend and frontend healthchecks
- Docker log rotation (json-file 10m x 3) on all services
- ntfy alerts use X-Real-IP (set by nginx after real_ip resolution)
instead of the client-controlled first X-Forwarded-For entry
- Frontend build on Node 24 LTS with package-lock.json + npm ci;
axios 1.20.0, vite 5.4.21
- README: backup/restore/rollback runbook, real-IP proxy trust notes
- Release-Notes/v1.1.md; version 1.1.0
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Sends alerts to a configurable Ntfy topic on: new user registration,
account lockout after 5 failed login attempts, and login attempts on an
already-locked account. Fire-and-forget — never raises if Ntfy is down.
Configure via NTFY_URL and NTFY_TOKEN in .env.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
- Pin all Docker image tags (mysql 8.0.40, python 3.12.13-slim, node 20.20.1-alpine, nginx 1.29.6-alpine)
- Pin all frontend npm dependencies to exact versions (remove ^ ranges)
- Add mem_limit and cpus resource limits to all three containers
- Add non-root appuser to backend Dockerfile
- Migrate JWT from python-jose to PyJWT
- Remove default admin_password in config.py — must be explicitly set in .env
- Add DOCS_ENABLED flag to config and .env.example (default false)
- Add indexes on session_date, is_active, event_type in session models
- Add limit/offset pagination to all log endpoints
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
- New /super-admin/login and /super-admin routes with separate auth
- Super admin can view all registered accounts and impersonate any user
- Impersonation banner shows at top of screen with exit button
- ADMIN_USERNAME and ADMIN_PASSWORD config added to .env and docker-compose.yml
- Fixed auth store: export setToken, clearToken, and setUser so they are
accessible from superAdmin store
- Updated README with super admin feature, new env vars, and setup notes
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
- Move schedule template management into AdminView under a new Schedules section
- Remove ScheduleView.vue and its route, drop Schedules link from NavBar
- Delete docker-compose.override.yml (dev override no longer needed)
- Fix CORS_ORIGINS default to port 8057 in docker-compose.yml
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Full-stack homeschool web app with FastAPI backend, Vue 3 frontend,
MySQL database, and Docker Compose orchestration. Includes JWT auth,
WebSocket real-time TV dashboard, schedule builder, activity logging,
and multi-child support.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
derekcandClaude Opus 5.5