openestate Files

Added

• Native install path (deploy/native/): install-native.sh sets up OpenEstate as a systemd service behind nginx, talking to a PostgreSQL and Redis you already run — no Docker involved in production. Also ships setup-database.sh (standalone DB/role setup for a DBA-managed Postgres), upgrade-native.sh (backup → build → migrate → cutover, with automatic rollback on a failed healthcheck), backup-native.sh / restore-native.sh, and uninstall.sh. Docker Compose is unaffected and still fully supported — it's now positioned as a contributor tool for the test suite rather than the primary production path; see docs/docs/installation.md and CONTRIBUTING.md.
• A CI job (native-install in .github/workflows/ci.yml) runs the full native install on a real ubuntu-latest runner — installs PostgreSQL, Redis, Node 20, nginx, and a build toolchain, runs install-native.sh, and asserts the health endpoint responds and a login succeeds over real HTTP — so the native path is verified on every push, not just once by hand.
• Consistent, user-visible toasts on failed mutations across both apps/web and apps/portal (lib/toast.tsx + a MutationCache-based global handler in each app's main.tsx), replacing a mix of silent failures, inline-only banners, and unhandled promise rejections found during an audit of ~15+ call sites.

Fixed

• Login failed on every fresh Docker Compose install with "Cannot POST /api/api/v1/auth/login". VITE_API_URL defaulted to /api (deploy/.env.example, deploy/docker-compose.yml, deploy/docker/{web,portal}.Dockerfile), but apps/web/apps/portal's own API client already hardcodes /api/v1/... on top of it, and nginx's /api/ location already forwards that prefix through unchanged — doubling it. Since Vite bakes this value into the built JS bundle at image-build time, existing installs need git pull + docker compose up -d --build (not just a restart) to pick up the fix.
• Every validation error (400) showed the generic toast "Validation failed" instead of saying what was actually wrong, across both apps — nestjs-zod's default exception hardcodes that message regardless of which field failed. The API now returns the real per-field reason (e.g. "url: Invalid url; secret: String must contain at least 16 character(s)").
• A handful of mutations (webhook endpoint creation in apps/web, three non-mutation-hook webhook actions, PDF downloads in both apps) failed silently or inline-only, with no toast — fixed as part of the same audit.
• Eight real bugs in the native-install scripts, found only by running install-native.sh end-to-end on a genuinely clean VM — none caught by shellcheck, nginx -t, or a careful read of the scripts: a missing build-toolchain prerequisite check (argon2 needs make/g++/ python3); a build failure silently swallowed by a set -e propagation gap; NODE_ENV=production leaking into the build and dropping devDependencies; the build's own stdout corrupting a command substitution; node <script> failing on pnpm's shell-script .bin shims; a fragile cross-store Prisma client copy replaced with regenerating the client in place; backup-native.sh failing under RLS by dumping via the wrong role; and restore-native.sh failing to drop a database still held open by the running service. Full detail in CLAUDE.md's decisions log.

Verified

• Ubuntu 24.04 LTS with PostgreSQL 16, and Ubuntu 25.10 with PostgreSQL 17 — both confirmed end-to-end: fresh install, safe re-install, real HTTP login and role creation, upgrade with rollback, backup/restore, and both uninstall modes. The scripts check for psql presence, not an exact major version, so this isn't expected to be an exhaustive platform list — just what's actually been run.