53 lines
4.4 KiB
Markdown
53 lines
4.4 KiB
Markdown
# Upstream sources — lasuite-docs
|
|
|
|
| service | image | source repo | releases / changelog |
|
|
|---------|-------|-------------|----------------------|
|
|
| app | lasuite/impress-frontend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
|
|
| backend | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
|
|
| celery | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
|
|
| y-provider | lasuite/impress-y-provider | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
|
|
| docspec | ghcr.io/docspec/api | https://github.com/docspec/docspec | https://github.com/docspec/docspec/releases |
|
|
| db | pgautoupgrade/pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade/releases |
|
|
| redis | redis | https://github.com/redis/redis | https://hub.docker.com/_/redis/tags |
|
|
| minio | quay.io/minio/minio | https://github.com/minio/minio | https://github.com/minio/minio/releases |
|
|
| web | nginx | https://github.com/nginx/nginx | https://nginx.org/en/CHANGES |
|
|
|
|
## Standing notes
|
|
- impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider all
|
|
share the same version tag from the suitenumerique/docs monorepo. Upgrade all four in lockstep.
|
|
- AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
|
|
- Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades;
|
|
check manually on https://github.com/minio/minio/releases.
|
|
- **2026-08-14: Minio stopped publishing Docker images after RELEASE.2025-09-07T16-13-09Z.**
|
|
GitHub has a newer release (`RELEASE.2025-10-15T17-29-55Z`, published 2025-10-16, with CVE fix
|
|
GHSA-jjjj-jwhf-8rgr), but the Docker image was never pushed to Docker Hub (returns 404; release
|
|
notes say "clone the source and build the latest container"). quay.io checked — only 2022-era
|
|
tags. As of this date, `RELEASE.2025-09-07T16-13-09Z` IS the newest available Docker image.
|
|
- v5.2.0 adds two optional new env vars: DOCUMENT_ALL_ENDPOINT_ENABLED and OIDC_OP_USER_ENDPOINT_FORMAT.
|
|
Both are backward-compatible (no action required for existing deployments).
|
|
- Recipe version label convention: 0.X.Y+vA.B.C where A.B.C is the impress version.
|
|
- **v5.4.0 removed Bearer/JWT auth on the API** (upstream PR suitenumerique/docs#2480 dropped
|
|
`mozilla_django_oidc.contrib.drf.OIDCAuthentication` from DRF DEFAULT_AUTHENTICATION_CLASSES).
|
|
The API now accepts only the app's session cookie from the real OIDC authorization-code flow.
|
|
Any test/assertion that sends `Authorization: Bearer <jwt>` to `/api/v1.0/*` will get 401 — this is
|
|
the NEW CORRECT behavior, not a regression. The cc-ci lasuite-docs tests were updated for this in
|
|
cc-ci PR #12 (merged 2026-08-03): test_oidc_login.py + test_create_doc.py now use session cookies
|
|
and assert Bearer is rejected. Don't revert to Bearer assertions.
|
|
- redis sidecar (cache/broker for celery+backend): prefer the patch line (8.8.1 over 8.10.0) unless a
|
|
feature is needed — 8.8.1 is a security patch (RedisBloom/TDigest RESTORE RCE); 8.10.0 is a minor
|
|
with many new features.
|
|
- **2026-09-18: docspec image switched with impress v5.7.0** (upstream PR suitenumerique/docs#2553):
|
|
`ghcr.io/docspecio/api:3.0.x` (Elixir, repo ARCHIVED) → `ghcr.io/docspec/api:1.21.4` (Rust rewrite,
|
|
github.com/docspec/docspec). New image listens on **3000** (was 4000): recipe sets
|
|
`DOCSPEC_API_URL=http://docspec:3000/conversion` and healthcheck `http://127.0.0.1:3000/health`
|
|
(path `/conversion` and the raw-body request contract unchanged).
|
|
- ⚠️ When checking GHCR tags by script: the `/tags/list` endpoint CAPS AT 100 tags — a missing tag
|
|
there means nothing. Verify the **manifest** endpoint instead (e.g. `ghcr.io/docspec/api:1.21.4`
|
|
is absent from tags/list but pulls fine).
|
|
- **2026-09-13ish: upstream #25 moved the minio pin to `quay.io/minio/minio`** (same
|
|
RELEASE.2025-09-07T16-13-09Z tag — manifest-verified pullable on quay; quay's own tags/list is
|
|
paginated and misleading, use manifest checks there too).
|
|
- **v5.7.0 moved the favorites API endpoint to `/documents/favorites/`** — breaking only for
|
|
external API consumers, not the recipe/cc-ci tests (which use /authenticate/, /users/me/,
|
|
/documents/).
|