wmj
e87e329731
OPEN-01 (scholarly-review-log.md): ruled NOT subject to the one-third cap for an inter-vivos waqf made in health. The existing FamilyWaqfDesignator logic already applied no health-state cap absent a marad al-mawt trigger, so no behavior change — only the open-question framing in the exported deed, InfoPanel copy, on-screen note, and source comments moved from "open" to "resolved." Horizon 2 Phase 0 (legal opinion + signed institutional partner agreement): both now signed. This clears the PRD's gate to begin real institutional-integration engineering, but that integration hasn't been built yet — the Claims module (DigitalClaims.svelte, claims.js) still ships as a local, non-custodial demonstration only, and the pilot banner is updated to say so precisely rather than implying the module itself is now production-ready. Updated README.md and deploy/DEPLOY.md to match.
71 lines
2.8 KiB
Markdown
71 lines
2.8 KiB
Markdown
# Nur Falah — Estate & Waqf Suite · Deployment Guide
|
|
|
|
**Target:** `moslem04.falahos.my`
|
|
**Stack:** Svelte 5 + Vite PWA (static SPA), same pattern as `moslem03.falahos.my`
|
|
**Server:** Docker Swarm (nginx:alpine) on the Contabo VPS, Traefik + Let's Encrypt
|
|
|
|
---
|
|
|
|
## 1. Build & push image
|
|
|
|
```bash
|
|
docker build -t git.falahos.my/wmj/nur-falah-prevention:latest .
|
|
docker push git.falahos.my/wmj/nur-falah-prevention:latest
|
|
```
|
|
|
|
## 2. Deploy to the swarm
|
|
|
|
```bash
|
|
docker stack deploy -c deploy/docker-stack.yml nur-falah-prevention
|
|
```
|
|
|
|
Traefik picks up the labels in `deploy/docker-stack.yml` and routes
|
|
`moslem04.falahos.my` to the service automatically, issuing a Let's Encrypt
|
|
certificate on first request.
|
|
|
|
## 3. DNS
|
|
|
|
Point `moslem04.falahos.my` at the same VPS IP already serving `moslem03.falahos.my`
|
|
(A/AAAA record, or CNAME if using a CDN in front).
|
|
|
|
## 4. Verify
|
|
|
|
```bash
|
|
curl -sI https://moslem04.falahos.my/ | grep -i "cache-control"
|
|
# index.html: cache-control: no-cache, must-revalidate
|
|
|
|
curl -sI https://moslem04.falahos.my/sw.js | grep -i "cache-control"
|
|
# sw.js: cache-control: no-cache, no-store, must-revalidate
|
|
```
|
|
|
|
- [ ] `https://moslem04.falahos.my/` returns 200
|
|
- [ ] Service worker activates (DevTools → Application → Service Workers)
|
|
- [ ] App installs as PWA
|
|
- [ ] All 6 modules load without console errors: Faraid, Assets, Wassiyah, Hibah, Family Waqf, Claims (H2)
|
|
|
|
## 5. Rollback
|
|
|
|
```bash
|
|
docker service update --rollback nur-falah-prevention_web
|
|
```
|
|
|
|
## Known gaps before this is production-grade (not blocking this deploy, tracked for follow-up)
|
|
|
|
- **Encryption at rest**: storage.js currently uses plain `localStorage`. Horizon 1
|
|
PRD §10 requires encrypted-at-rest for Asset Registry / wassiyah / hibah / waqf
|
|
drafts. WebCrypto AES-GCM wrapping is the next hardening step.
|
|
- **PDF export**: current export is plain-text download + browser print dialog, not
|
|
a dedicated PDF pipeline. PRD §11 calls for "a single, reusable document-generation
|
|
pipeline (PDF and plain text)" — plain text ships now, a real PDF renderer is a
|
|
follow-up.
|
|
- **Horizon 2 PRD's Phase 0 gate (legal opinion + signed institutional partner
|
|
agreement) is now resolved** — both are signed. This clears PRD §Phase-0 to begin
|
|
real institutional-integration engineering. **The claims module itself remains a
|
|
local, non-custodial demo** — see the in-app banner and `src/lib/horizon2/claims.js`
|
|
— since no institutional integration has actually been built yet. Do not represent
|
|
this screen to any real user as a live programme until that integration ships.
|
|
- **Family Waqf Designator — `scholarly-review-log.md` OPEN-01 is resolved**: ruled
|
|
NOT subject to the one-third cap. Matches the module's existing implementation
|
|
(no health-state cap absent a `marad al-mawt` trigger); only documentation/in-app
|
|
copy updated, no logic change required.
|