Follow-up to MITHOME-97: after every deploy, a brand-new database
(first-ever deploy, or a volume wipe) leaves the Payload admin behind
the "Create first user" screen — someone has to notice and fill it in
by hand, which means environments can silently end up with no known
admin credentials, or with whatever a random person happened to type
in at the time.
deploy.sh now calls Payload's built-in `POST /api/users/first-register`
REST endpoint right after the healthcheck passes, using ADMIN_EMAIL /
ADMIN_PASSWORD from the environment's .env file. That endpoint only
succeeds when the `users` collection is completely empty (throws 403
Forbidden otherwise) — which makes this naturally idempotent: the
first deploy against a fresh database creates the known admin, every
later deploy gets a harmless 403 and skips it. It never overwrites an
existing user's password. Missing ADMIN_EMAIL/ADMIN_PASSWORD in the
env file just skips the step with a warning, it doesn't fail the
deploy.
Documented the new variables in .env.staging.example and
.env.production.example (next to the existing PAYLOAD_SECRET
instructions), and the new deploy.sh step 4 in
.agent/workflows/deploy.md. Also dropped a stale "Content Editor is
staging feliratot kap" line from the same doc (that behavior belonged
to the CMS retired in MITHOME-93 and no longer exists).
Verified locally against real Payload instances (not just reading the
code): a fresh, empty MongoDB returns 200 and creates the user; a
second call against the same now-non-empty database returns 403 and
changes nothing; a database that already had a different user (the
existing dev DB) also correctly returns 403.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
'Is the fix live?' becomes a single check instead of an SSH session:
- CMS: git short SHA read at startup, shown in the bottom bar (v<sha>),
served by the public GET /version endpoint, recorded in a startup audit
entry
- Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it
via build ARG into the runtime env, /api/health reports it as
deployVersion, smoke test asserts a non-'unversioned' stamp
Closes MITHOME-63
- Add docker-compose.staging.yml (app on 127.0.0.1:8081, separate MongoDB
on 127.0.0.1:27019, dedicated volume/network)
- deploy.sh: select compose file and port per environment
(staging 8081, production 8080)
- Dockerfile: accept NEXT_PUBLIC_SITE_URL as build arg (inlined at build
time for NEXT_PUBLIC_ vars); pass it in both compose files
- Add .env.staging.example and .env.production.example
