NetIgnite V2

.claude/settings.json

@@ -0,0 +1,50 @@
+{
+	"mcpServers": {
+		"nuxt": {
+			"type": "url",
+			"url": "https://nuxt.com/mcp"
+		},
+		"nuxt-ui": {
+			"type": "url",
+			"url": "https://ui.nuxt.com/mcp"
+		}
+	},
+	"commands": {
+		"api-client": {
+			"description": "Regenerate the typed API client",
+			"prompt": "Regenerate and verify the generated API client for this full-stack Nuxt project.\n\n1. Run `bun run api-client:generate` (scripts/api-client-generate.ts boots the API in-process, reads its OpenAPI spec, and patches the generated files — no dev server needed).\n2. Do not hand-edit generated `*.gen.ts` files under `app/api-client/`.\n3. If generation fails, diagnose whether the Hono backend or the OpenAPI route is the issue.\n4. Summarize the outcome and any follow-up needed."
+		},
+		"db": {
+			"description": "Run Drizzle migrations",
+			"prompt": "Run the Drizzle migration flow for this project.\n\n1. Run `bun run db:generate` to generate migrations from `server/lib/db/schema.ts` into `drizzle/migrations/`.\n2. Run `bun run db:migrate` to apply them (the app also auto-migrates on startup when `NETIGNITE_DB_AUTO_MIGRATE` is true — the default).\n3. Summarize what was generated or applied."
+		},
+		"verify": {
+			"description": "Run the repo verification flow",
+			"prompt": "Run the standard verification flow for this Nuxt 4 + Bun project.\n\n1. Run `bun run typecheck` (runs `nuxt typecheck` then `tsc -p ./tsconfig/tsconfig.typecheck.json`).\n2. Run `bun test`.\n3. Summarize any failures or warnings.\n4. If this command was triggered after a code change, fix issues that are clearly caused by that change before summarizing."
+		},
+		"test": {
+			"description": "Run the test suite",
+			"prompt": "Run the test suite for this Nuxt 4 + Bun project.\n\n1. Run `bun test`.\n2. If tests fail, diagnose and fix the root cause.\n3. Summarize pass/fail status and any fixes applied."
+		},
+		"typecheck": {
+			"description": "Run the TypeScript type checker",
+			"prompt": "Run the full typecheck flow for this Nuxt 4 + Bun project.\n\n1. Run `bun run typecheck` which runs `nuxt typecheck` then `tsc -p ./tsconfig/tsconfig.typecheck.json`.\n2. If there are type errors, diagnose and fix them before summarizing.\n3. Report the pass/fail status and what was fixed, if anything."
+		},
+		"dev": {
+			"description": "Start or inspect the dev setup",
+			"prompt": "Work on the local development setup for this project.\n\n1. If needed, install dependencies with `bun install`.\n2. Use `bun run dev` for the dev server on port 18232.\n3. If there is a dev-server issue, inspect the Nuxt config, runtime env, and Bun-specific wiring before making changes.\n4. Summarize what you started, changed, or found."
+		}
+	},
+	"fileScan": {
+		"exclude": [
+			".git/**",
+			"node_modules/**",
+			".nuxt/**",
+			".output/**",
+			".nitro/**",
+			".data/**",
+			".cache/**",
+			"dist/**"
+		]
+	}
+}

.gitattributes

@@ -0,0 +1,7 @@
+# LF everywhere (Biome formats with LF; keeps Windows checkouts clean with core.autocrlf).
+* text=auto eol=lf
+
+*.png binary
+*.ico binary
+*.woff2 binary
+*.bin binary

.github/renovate.json

@@ -0,0 +1,3 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  push:
+    branches: [main, v2]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - run: bun run check:ci
+      - run: bun run typecheck
+      - run: bun test
+
+  # Builds the Docker image like the release does and checks that it starts.
+  image:
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - run: bun run build
+      - run: docker build -f docker/Dockerfile -t netignite-server:ci .
+      - name: Smoke test
+        run: |
+          docker run -d --name netignite -p 18232:18232 -e NETIGNITE_APP_URL=http://localhost:18232 netignite-server:ci
+          for i in $(seq 1 45); do
+            if curl -fsS http://localhost:18232/api/health; then break; fi
+            sleep 2
+          done
+          echo
+          curl -fsS http://localhost:18232/api/health
+          # Migrations ran and the initial admin was created
+          docker exec netignite test -f /opt/netignite/config/initial_admin_password_reset_token.txt
+          # The dashboard is served
+          curl -fsS -o /dev/null http://localhost:18232/auth/login
+          # The v1 import tool is in the image
+          docker exec netignite bun /opt/netignite/app/.output/import-v1.mjs --help
+      - name: Container log
+        if: always()
+        run: docker logs netignite || true

.github/workflows/docker-publish.yml

@@ -38,6 +38,22 @@ jobs:
       id-token: write
 
     steps:
+      # A stable image moves `latest`, which self-hosted servers pull: only main may publish one.
+      - name: Check version
+        env:
+          VERSION: ${{ inputs.version }}
+          PRE_RELEASE: ${{ inputs.pre_release }}
+          REF: ${{ github.ref }}
+        run: |
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-(alpha|beta|rc|pre)\.[0-9]+)?$ ]]; then
+            echo "::error::Invalid version '$VERSION'. Use x.y.z or x.y.z-beta.n."
+            exit 1
+          fi
+          if [[ "$PRE_RELEASE" != "true" && "$REF" != "refs/heads/main" ]]; then
+            echo "::error::Only main can publish a stable image (tag 'latest'). Publish from $REF as a pre-release."
+            exit 1
+          fi
+
       - name: Checkout repository
         uses: actions/checkout@v4
 
@@ -48,10 +64,10 @@ jobs:
 
       - name: Install dependencies
         shell: bash
-        run: bun install
+        run: bun install --frozen-lockfile
 
-      #- name: Build Nuxt application
-      #  run: bun run build
+      - name: Build Nuxt application
+        run: bun run build
 
       - name: Setup Docker
         id: docker-setup

.github/workflows/release.yml

@@ -1,76 +1,99 @@
 name: Create Release
 
+# Creates a GitHub release of the branch the workflow runs on and publishes its Docker image.
+# Pre-releases (a version like 2.0.0-beta.1, or the "pre-release" box) can run from any branch and
+# only push the versioned image tag. Stable releases must run from main; they also move `latest`.
+
 on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Release version Format: x.y.z-[alpha|beta|pre].n'
+        description: "Version: x.y.z, or x.y.z-alpha.n / -beta.n / -rc.n / -pre.n for a pre-release"
         required: true
       release_name:
-        description: 'Release title'
+        description: "Release title"
         required: true
       release_notes:
-        description: 'Release notes or changelog'
+        description: "Release notes or changelog"
         required: true
       prerelease:
-        description: 'Is this a pre-release?'
+        description: "Is this a pre-release? (Versions with a suffix always are.)"
         required: false
         default: false
         type: boolean
 
 jobs:
-  build:
+  check:
     runs-on: ubuntu-latest
-
+    outputs:
+      prerelease: ${{ steps.check.outputs.prerelease }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Set up Bun
-      uses: oven-sh/setup-bun@v2
-      with:
-        bun-version: latest
-
-    - name: Install dependencies
-      run: bun install
-
-    - name: Test code
-      run: bun test
-
-    - name: Build Nuxt application
-      run: bun run build
-
-    - name: Create Archive of .output
-      run: |
-        tar -czf app.tar.gz .output
+      - id: check
+        env:
+          VERSION: ${{ inputs.version }}
+          PRERELEASE: ${{ inputs.prerelease }}
+          REF: ${{ github.ref }}
+        run: |
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-(alpha|beta|rc|pre)\.[0-9]+)?$ ]]; then
+            echo "::error::Invalid version '$VERSION'. Use x.y.z or x.y.z-beta.n."
+            exit 1
+          fi
+          prerelease=false
+          if [[ "$PRERELEASE" == "true" || "$VERSION" == *-* ]]; then prerelease=true; fi
+          if [[ "$prerelease" == "false" && "$REF" != "refs/heads/main" ]]; then
+            echo "::error::Stable releases move the image's 'latest' tag and can only be created from main. Use a pre-release version (e.g. $VERSION-beta.1) on $REF."
+            exit 1
+          fi
+          echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT"
+          echo "Releasing v$VERSION from $REF (pre-release: $prerelease)"
 
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: app
-        path: ./app.tar.gz
-        retention-days: 1  # Set to 1 day for temporary storage
+  build:
+    needs: check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install --frozen-lockfile
+      - run: bun test
+      - run: bun run build
+      # The server applies the database migrations on startup, so they belong with the build.
+      - run: tar -czf app.tar.gz .output drizzle/migrations
+      - uses: actions/upload-artifact@v4
+        with:
+          name: app
+          path: ./app.tar.gz
+          retention-days: 1
 
   release:
-    needs: build
+    needs: [check, build]
     runs-on: ubuntu-latest
-
     permissions:
       contents: write
-
     steps:
-    - name: Download build artifacts
-      uses: actions/download-artifact@v4
-      with:
-        name: app
+      - uses: actions/download-artifact@v4
+        with:
+          name: app
+      - uses: ncipollo/release-action@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          tag: v${{ inputs.version }}
+          # Tag the commit this workflow runs on, not the default branch.
+          commit: ${{ github.sha }}
+          name: ${{ inputs.release_name }}
+          body: ${{ inputs.release_notes }}
+          prerelease: ${{ needs.check.outputs.prerelease }}
+          artifacts: ./app.tar.gz
 
-    - name: Create GitHub Release
-      id: create_release
-      uses: ncipollo/release-action@v1
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        tag: v${{ github.event.inputs.version }}
-        name: ${{ github.event.inputs.release_name }}
-        body: ${{ github.event.inputs.release_notes }}
-        prerelease: ${{ github.event.inputs.prerelease }}
-        artifacts: ./app.tar.gz
+  docker:
+    needs: [check, release]
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/docker-publish.yml
+    with:
+      version: ${{ inputs.version }}
+      pre_release: ${{ needs.check.outputs.prerelease }}
+    secrets: inherit

.gitignore

@@ -1,29 +1,52 @@
-# Nuxt dev/build outputs
+# Node
+node_modules
+
+# Dev / Build / compile output
 .output
 .data
 .nuxt
 .nitro
 .cache
-dist
+build/
+out/
+dist/
+*.tgz
 
-# Node dependencies
-node_modules
+# Drizzle artifacts
+.drizzle
+
+# TypeScript
+*.tsbuildinfo
+
+# Coverage and test reports
+coverage
+*.lcov
+junit.xml
 
 # Logs
 logs
 *.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
 
-# Misc
+# Editor / OS
 .DS_Store
 .fleet
 .idea
 
-# Local env files
+# Environment
 .env
 .env.*
 !.env.example
 
+#Tests
+tmp-data-*
+
+# Backend data & config (keep examples)
+data/
+!app/data/
 config/*
-!config/*sample*
+!config/*.example.json
 
-data/
+.claude/settings.local.json

.vscode/mcp.json

@@ -0,0 +1,12 @@
+{
+	"servers": {
+		"nuxt": {
+			"type": "http",
+			"url": "https://nuxt.com/mcp"
+		},
+		"nuxt-ui": {
+			"type": "http",
+			"url": "https://ui.nuxt.com/mcp"
+		}
+	}
+}