mivanchenko
098b6dfd39
Reconcile the stashed rewrite with the newer 2026-07-15 state (credentials store, deploy pipeline). Backlog is now tracked as Gitea issues #1–#12; TODO.md is the high-level map. Notes: #8 (booking-sync) closed as already done via the shared Easy!Appointments instance; #4 narrowed (smb-db pg_dump exists, n8n/Gitea/ offsite/restore remain). Added a "manual operator follow-ups" section for the human-only items (n8n re-import, credential username, deploy-pipeline test, etc). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DgbgipE41xwPcQJnhnq1J1
69 lines
4.9 KiB
Markdown
69 lines
4.9 KiB
Markdown
# TODO / Backlog
|
||
|
||
> **Active engineering work is tracked as Gitea issues:** https://git.mivanchenko.de/BPPP/smb-online/issues
|
||
> This file is the high-level map; the issues hold the detail, labels, and status.
|
||
|
||
## Open (→ Gitea issue)
|
||
|
||
**Bugs**
|
||
- **#1** Booking POST is a plain `INSERT` — reschedule re-fires `EA-<id>` → PK conflict / 500
|
||
(`backoffice/app/app.py:205`; needs `ON CONFLICT DO UPDATE`). `bug` `crm` `booking`
|
||
|
||
**CRM / back office**
|
||
- **#2** Decouple tier from business type → hosting/plan model; realign onboarding form + workflow. `enhancement` `crm`
|
||
- **#3** Extend back-office CRUD beyond Leads & Clients (projects, bookings, invoices, activity). `enhancement` `crm`
|
||
- **#5** Make the DB→Sheets mirror atomic (no brief empty-sheet window). `tech-debt` `crm`
|
||
|
||
**Booking**
|
||
- **#7** Proper Orders flow + Orders table/tab (pizzeria demo posts into Leads as a stop-gap). `enhancement` `booking`
|
||
- **#9** Per-client Easy!Appointments isolation (booking is currently one shared EA instance). `enhancement` `booking`
|
||
- **#10** Custom branded slot-grid booking widget (replace raw EA embed). `enhancement` `booking`
|
||
|
||
**Security / ops / infra**
|
||
- **#4** Backups: smb-db `pg_dump` script exists (`deploy/backup/smb-db-backup.sh`); still need
|
||
n8n + Gitea coverage, an **offsite** copy, and a **tested restore**. `ops` `infra`
|
||
- **#6** Harden n8n auth — remove dead `N8N_BASIC_AUTH_*` (password=`password`); confirm strong owner login. `security` `infra`
|
||
- **#11** Rotate the leaked Gitea PAT + establish secrets management. `security` `ops`
|
||
- **#12** CI (Gitea Actions): validate `n8n/*.json` + compose before deploy. Runner infra already
|
||
exists (see deploy pipeline in Done) — this just adds a validate-on-push workflow. `ops` `infra`
|
||
|
||
## Manual / operator follow-ups (not code issues — need you, not more code)
|
||
- **n8n re-import:** load the updated `n8n/onboarding.json` (new "Save credential" node) into the
|
||
live n8n and re-attach the real `__CRM_TOKEN__` / `__EA_AUTH__` bindings — can't be scripted from outside n8n.
|
||
- **happynails credential:** its `username` is still blank — confirm in the EA admin UI and fill it
|
||
in via the dashboard's ✎ edit on the Credentials tab (`C-0002`, cred `CR-1784116056728`).
|
||
- **Deploy pipeline:** press "Run workflow" once in the Gitea UI (Actions → Deploy backoffice) as
|
||
the real end-to-end test; then extend the same pattern to the other `deploy/*` groups
|
||
(`booking/`, `smb-demos/`, `clients/<slug>/`).
|
||
- **Collaborator access:** anyone with **write** on this repo can trigger a deploy — be deliberate
|
||
about who gets write vs. read/PR-only before adding people.
|
||
- **Optional:** encrypt `credentials.secret` at rest (e.g. pgcrypto) if the dashboard is ever
|
||
exposed more broadly than Caddy basic-auth + host security.
|
||
|
||
## Done
|
||
- [x] 2026-07-15 — **Credentials in the CRM**: `credentials` entity (never mirrored to Sheets,
|
||
`X-CRM-Token`-gated even to read), dashboard Credentials tab with masked value + reveal/copy;
|
||
`n8n/onboarding.json` now persists the auto-generated EA provider password. Shipped live.
|
||
- [x] 2026-07-15 — **Gitea Actions deploy pipeline** (backoffice): self-hosted `homelab-runner`
|
||
(`act-runner` systemd service), `workflow_dispatch` `deploy-backoffice.yml` that syncs
|
||
`backoffice/`, re-applies the schema, rebuilds/restarts `smb-crm`, health-checks it.
|
||
- [x] 2026-07-14 — **Shared self-hosted booking**: Easy!Appointments stack (`deploy/booking/`),
|
||
auto-provisioning wired into onboarding, `booking-sync` workflow syncing bookings to the CRM
|
||
(**#8** — done differently than first scoped: one shared EA instance replaced the planned
|
||
Tier-B-Cal.com-webhook / Tier-A-GCal-poll split).
|
||
- [x] 2026-07-14 — **Per-client deploy tooling**: `deploy/clients/` isolated-stack model +
|
||
`new-client.sh` scaffolder.
|
||
- [x] 2026-06-30 — Daily **smb-db Postgres backup** script (`deploy/backup/smb-db-backup.sh`:
|
||
`pg_dump` + gzip, 14-day retention, cron on the homelab). (Broader coverage → #4.)
|
||
- [x] 2026-06-25 — Rethink the tier model: **demos are stack-agnostic starters** — dropped
|
||
tier/stack labels + jargon from all three demo pages & the chooser; booking widgets relabelled;
|
||
demo dates render on the current week so nothing looks stale. (Remaining model/schema work → #2.)
|
||
- [x] 2026-06-25 — **DB-first back office**: Postgres source of truth + Sheets mirror + CRUD
|
||
(Read/Add/Edit/Delete for Leads & Clients) + n8n ingest swap (lead-intake/onboarding → DB API).
|
||
Behind Caddy basic-auth, mutations gated by `CRM_API_TOKEN`, audit-logged. (Extensions → #3.)
|
||
- [x] 2026-06-25 — Latency fix (n8n executions 1–4 min → ~6 s; DNS + PostHog telemetry).
|
||
- [x] 2026-06-25 — Chooser reworded to client-friendly, jargon-free copy.
|
||
- [x] 2026-06-25 — Pizzeria demo with online ordering added. (Proper Orders product → #7.)
|
||
- [x] 2026-06-25 — Barbershop "Google Kalender" dot-overlap styling fixed.
|
||
- [x] 2026-06-25 — All three demo pages neutralised (stack-agnostic, non-stale dates).
|