rmancinas
87d8743251
INSURANCE_FEATURES_SPEC §1. The office printed and mailed renewal letters from the legacy CONTROL <ramo> RENEW[2/3] paper log; 91% of policyholders have an email on file, so send the notice instead and keep the paper log as the fallback. A daily cron (06:00 America/Tijuana) sweeps three generations off policyTo — 30 and 15 days before expiry, 7 days after — sends each through SES, and upserts RenewalNotice by [policyId, generation] so a policy is never notified twice for the same milestone. RenewalNotice now records providerMessageId, so a later bounce or complaint webhook can be traced back to the row that sent it. - customers.emailOptOut excludes a customer from every sweep; editable from the customer form - scheduled_job_states holds the sweep's lock and last successful run; the window is widened to cover days the job did not run, so a weekend outage does not silently drop a generation - SES unconfigured is not an error outside production — messages are logged and skipped, so dev and CI never send - /renovaciones (renewal:send, MANAGER+) lists what is pending per generation, runs the sweep by hand, and marks a notice sent by mail for the customers with no email - POST /policies/:id/renewal-notices records that manual mark - the aviso-renovacion report and the emails now share one projection (reports/renewal-letter.ts) instead of two copies of the mapping
117 lines
4.5 KiB
YAML
117 lines
4.5 KiB
YAML
# Application stack for the Jorge Cuadros platform: the NestJS API + the Next.js
|
|
# web front-end. The two images are built + pushed by .gitea/workflows/build.yml:
|
|
# git.mancinas.io/rmancinas/jorgecuadros-api
|
|
# git.mancinas.io/rmancinas/jorgecuadros-web
|
|
#
|
|
# This stack does NOT ship MySQL or MinIO — those are their own stacks
|
|
# (deploy/jorgecuadros-db.stack.yml, deploy/jorgecuadros-minio.stack.yml). The
|
|
# API reaches them over the network via DATABASE_URL / S3_ENDPOINT, which point
|
|
# at the db + minio stacks' published ingress ports on the swarm host.
|
|
#
|
|
# Target: Portainer local endpoint on cubex (3-node Swarm). PROD only.
|
|
# Deploy with a stack env that supplies every ${VAR:?...} below — see
|
|
# deploy/jorgecuadros-app.env.example for the full list.
|
|
#
|
|
# Statefulness: the API keeps uploaded Access files (ingest) and DB backups on
|
|
# named volumes, which are node-local. So the API is pinned to the same node as
|
|
# the db/minio stacks (node label jorgecuadros_db == true) — a reschedule would
|
|
# otherwise start against empty ingest/backup volumes. The web tier is
|
|
# stateless and floats freely.
|
|
#
|
|
# The web image is NOT URL-baked: the browser's API origin is injected at
|
|
# runtime from API_ORIGIN (see apps/web/src/app/layout.tsx), so this same image
|
|
# works for any deployment — set the URL here, not at build time.
|
|
|
|
version: "3.8"
|
|
|
|
services:
|
|
api:
|
|
image: git.mancinas.io/rmancinas/jorgecuadros-api:${APP_TAG:-latest}
|
|
# Container label (not `deploy.labels`, which labels the swarm SERVICE).
|
|
# deploy/scripts/pre-migrate-backup.mjs finds the container by this label to
|
|
# run its pre-migrate mysqldump into the backup volume.
|
|
labels:
|
|
io.jorgecuadros.role: "api"
|
|
environment:
|
|
DATABASE_URL: ${DATABASE_URL:?DATABASE_URL must be set}
|
|
SESSION_SECRET: ${SESSION_SECRET:?SESSION_SECRET must be set}
|
|
# CORS: the public origin the browser loads the web app from.
|
|
WEB_ORIGIN: ${WEB_ORIGIN:?WEB_ORIGIN must be set}
|
|
PORT: "3001"
|
|
INGEST_DIR: /data/ingest
|
|
BACKUP_DIR: /data/backups
|
|
MIGRATION_ENV: prod
|
|
# Credentials the "Operaciones" screen runs mysqldump/mysql as. NOT the
|
|
# application user: --single-transaction needs the global RELOAD privilege
|
|
# and the app user has only ALL ON jorgecuadros.*, so every backup, sync
|
|
# and re-import fails without this. Host/port/database still come from
|
|
# DATABASE_URL — this only changes who logs in. See opsConn() in
|
|
# apps/api/src/ops/ops.service.ts.
|
|
OPS_DB_ADMIN_USER: ${OPS_DB_ADMIN_USER:-root}
|
|
OPS_DB_ADMIN_PASSWORD: ${OPS_DB_ADMIN_PASSWORD:?OPS_DB_ADMIN_PASSWORD must be set}
|
|
# Object storage — internal endpoint the API (server-side) uses to reach
|
|
# the minio stack. Not browser-facing (downloads proxy through the API).
|
|
S3_ENDPOINT: ${S3_ENDPOINT:?S3_ENDPOINT must be set}
|
|
S3_BUCKET: ${S3_BUCKET:-jorgecuadros-documents}
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER must be set}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
|
|
SES_REGION: ${SES_REGION:-}
|
|
SES_FROM: ${SES_FROM:-}
|
|
SES_ACCESS_KEY: ${SES_ACCESS_KEY:-}
|
|
SES_SECRET_KEY: ${SES_SECRET_KEY:-}
|
|
SES_CONFIGURATION_SET: ${SES_CONFIGURATION_SET:-}
|
|
ports:
|
|
- target: 3001
|
|
published: ${API_PORT:-3001}
|
|
protocol: tcp
|
|
mode: ingress
|
|
volumes:
|
|
- ingest_data:/data/ingest
|
|
- backup_data:/data/backups
|
|
deploy:
|
|
replicas: 1
|
|
placement:
|
|
constraints:
|
|
- node.labels.jorgecuadros_db == true
|
|
restart_policy:
|
|
condition: any
|
|
update_config:
|
|
order: stop-first
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://localhost:3001/health || exit 1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 30s
|
|
|
|
web:
|
|
image: git.mancinas.io/rmancinas/jorgecuadros-web:${APP_TAG:-latest}
|
|
labels:
|
|
io.jorgecuadros.role: "web"
|
|
environment:
|
|
# Public API URL the browser calls (injected at runtime, see layout.tsx).
|
|
API_ORIGIN: ${API_ORIGIN:?API_ORIGIN must be set}
|
|
ports:
|
|
- target: 3000
|
|
published: ${WEB_PORT:-3000}
|
|
protocol: tcp
|
|
mode: ingress
|
|
depends_on:
|
|
- api
|
|
deploy:
|
|
replicas: 1
|
|
restart_policy:
|
|
condition: any
|
|
update_config:
|
|
order: start-first
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://localhost:3000/ >/dev/null 2>&1 || exit 1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 30s
|
|
|
|
volumes:
|
|
ingest_data:
|
|
backup_data:
|