Julien Gautier
7ab43125a1
CI / scan (pull_request) Successful in 3m46s
CI / commits (pull_request) Successful in 3m46s
CI / check (pull_request) Successful in 4m4s
CI / a11y (pull_request) Successful in 4m25s
Docs site / build (pull_request) Successful in 4m37s
CI / perf (pull_request) Successful in 8m43s
Add an 'apps' Compose profile that runs the three Nx dev servers (portal-bff, portal-shell, portal-admin) from a shared Dockerfile.dev, so the whole stack boots with 'dev.sh up apps' and no native Node/pnpm. - Dockerfile.dev: node:24-bookworm + corepack (pnpm from packageManager at runtime), NX_DAEMON=false. No build-time COPY/install. - dev-entrypoint.sh: BFF runs prisma generate + migrate deploy then serves; SPA services go straight to nx serve. - dev.compose.yml: one-shot apps-deps installs into a shared node_modules volume once (apps gate on its completion, no install race); repo bind-mounted, node_modules + .nx in named volumes; BFF reuses its own .env (required:false) with host URLs overridden to Compose service names. - dev.sh: apps added to ALL_PROFILES + usage. - Docs: which-mode-when table (setup doc), apps section (infra README), CLAUDE.md roll-up. ADR-0030 flipped to accepted. Dev-only; production images stay with the ADR-0028 Container Registry work. Additive + profile-gated — native and devcontainer flows unchanged. Full-boot validation pending on a Docker host (see PR body).
Setup guides
Step-by-step setup procedures for new contributors. Each file is self-contained and idempotent — they document the state a developer should reach, not the order in which it must be done.
| # | File | Audience |
|---|---|---|
| 01 | Debian 13 dev-VM setup | Default — a dev who has just received a fresh dev VM from the infra team. Covers the full path: zsh + Oh My Zsh + Powerlevel10k, modern CLI tooling, Node via nvm, Docker CE, system tuning, optional VM hardening, project clones, the two IDE flows (VSCode Remote-SSH and Devcontainer), the hybrid (local + VM) mode. |
| 02 | WSL terminal setup | Legacy — the original Windows-WSL flow. Kept for reference for devs still on that path until the org migrates to the VM-based flow. |
| 03 | Dev web stack | Notes on the web-side tooling. |
| 04 | Angular + Nx monorepo | Reference notes on the Angular + Nx workspace layout. |
scripts/
Modular setup scripts called from the doc above. Each is idempotent, each can be re-run safely. Run via the orchestrator (bootstrap.sh) or individually.
| Script | Purpose |
|---|---|
bootstrap.sh |
Run every numbered script in order with a confirmation prompt at each step. |
lib.sh |
Common helpers — colour logging, idempotent apt_install / ensure_line. |
10-base-packages.sh |
apt + base packages every other script assumes (curl wget git build-essential …). |
20-zsh.sh |
zsh + Oh My Zsh + Powerlevel10k + autosuggestions + syntax-highlighting. Patches ~/.zshrc (theme / plugins / fzf hook) and ~/.bashrc (exec zsh — chsh blocked on corp VM). |
30-cli-tools.sh |
bat eza fd-find ripgrep fzf zoxide ncdu keychain + dev extras (jq yq httpie make tree htop tmux direnv). |
40-node.sh |
nvm + Node from the repo's .nvmrc + corepack pinned to package.json#packageManager's pnpm version. |
50-docker.sh |
Docker CE + compose plugin from docker.com apt repo + user added to docker group + service enabled at boot. |
60-tuning.sh |
inotify watches → 524288, optional 4 GB swapfile, optional hostname rename (only prompts if generic). |
70-hardening.sh |
Best-effort UFW + unattended-upgrades + fail2ban (opt-in) + sshd hardening drop-in. Probes before applying — skips done items, prompts before each install. |
80-dotfiles.sh |
Symlinks docs/setup/dotfiles/aliases.zsh → ~/.oh-my-zsh/custom/aliases.zsh. Copies docs/setup/dotfiles/gitconfig.txt to ~/.gitconfig with prompted identity. |
dotfiles/
Project-wide dotfile templates installed by 80-dotfiles.sh. Versioned so a fresh clone has everything it needs — notes/ is gitignored and was the wrong home for these.
| File | Purpose |
|---|---|
aliases.zsh |
Project-wide zsh aliases, symlinked into ~/.oh-my-zsh/custom/aliases.zsh. Edit here, all devs pick it up on restart. |
gitconfig.txt |
Base ~/.gitconfig template (aliases, colour, default branch, editor). Identity (user.name / user.email) is prompted at install and overlaid via git config --global. |
systemd/
| File | Purpose |
|---|---|
apf-portal-infra@.service |
Template unit auto-starting ./infra/local/dev.sh up at boot for a given user. |