From aefd79ad753b31aedcd91418ce5e16f23df5ec7a Mon Sep 17 00:00:00 2001
From: Schalli <kschaller@ctl.de>
Date: Mon, 29 Jun 2026 14:38:18 +0200
Subject: [PATCH] =?UTF-8?q?chore:=20add=20prod=20deploy=20files=20?=
 =?UTF-8?q?=E2=80=94=20migration=20service=20+=20env=20example?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .env.prod.example       | 26 ++++++++++++++++++++++++++
 docker-compose.prod.yml | 14 ++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 .env.prod.example

diff --git a/.env.prod.example b/.env.prod.example
new file mode 100644
index 0000000..f80b8e7
--- /dev/null
+++ b/.env.prod.example
@@ -0,0 +1,26 @@
+# Tessera Production Environment
+# Copy to .env and fill in all values before running docker compose up
+
+# Database
+DB_PASSWORD=change-me-strong-password
+DATABASE_URL=postgresql://tessera:change-me-strong-password@db:5432/tessera
+
+# App
+APP_URL=https://tessera.deine-domain.de
+JWT_SECRET=change-me-64-char-random-string
+
+# Admin account (created on first start)
+TESSERA_ADMIN_USER=admin
+TESSERA_ADMIN_EMAIL=admin@deine-domain.de
+TESSERA_ADMIN_PASSWORD=change-me-strong-password
+
+# Calendar encryption key — generate with: openssl rand -hex 32
+CALENDAR_ENCRYPTION_KEY=
+
+# SMTP (optional)
+TESSERA_SMTP_HOST=
+TESSERA_SMTP_PORT=587
+TESSERA_SMTP_SECURE=false
+TESSERA_SMTP_USER=
+TESSERA_SMTP_PASSWORD=
+TESSERA_SMTP_FROM=Tessera <noreply@deine-domain.de>
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index c18709d..707082d 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -1,4 +1,16 @@
 services:
+  migrate:
+    image: git.vicolab.de/schalli/tessera-ctl/api:latest
+    command: sh -c "cd /app && node_modules/.bin/prisma migrate deploy --schema apps/api/prisma/schema.prisma"
+    environment:
+      DATABASE_URL: ${DATABASE_URL}
+    networks:
+      - data-net
+    depends_on:
+      db:
+        condition: service_healthy
+    restart: "no"
+
   web:
     image: git.vicolab.de/schalli/tessera-ctl/web:latest
     restart: unless-stopped
@@ -27,6 +39,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
     environment:
       DATABASE_URL: ${DATABASE_URL}
       JWT_SECRET: ${JWT_SECRET}