upright 0.3.0 → 0.4.0

data/app/views/upright/public/services/_active_events.html.erb

@@ -0,0 +1,28 @@
+<% events = incidents.to_a + maintenances.to_a %>
+<% if events.any? %>
+  <section class="events">
+    <% events.each do |event| %>
+      <%= link_to public_incident_path(event), class: "event event--#{event.maintenance? ? "maintenance" : event.impact}" do %>
+        <div class="event__head">
+          <span class="event__title"><%= event.title %></span>
+          <span class="event__status"><%= status_label(event.status) %></span>
+        </div>
+
+        <% if event.maintenance? %>
+          <p class="event__meta"><%= local_maintenance_window(event) %></p>
+        <% end %>
+
+        <% if event.public_services.any? %>
+          <p class="event__services"><%= event.public_services.map(&:name).to_sentence %></p>
+        <% end %>
+
+        <% if update = event.updates.first %>
+          <p class="event__update">
+            <%= update.body %>
+            <%= local_time update.created_at, format: :month_day_at_zone, class: "event__time" %>
+          </p>
+        <% end %>
+      <% end %>
+    <% end %>
+  </section>
+<% end %>

data/app/views/upright/public/services/_degraded_list.html.erb

@@ -0,0 +1,14 @@
+<% if degraded.any? %>
+  <ul class="status-degraded">
+    <% degraded.each do |outage| %>
+      <li class="status-degraded__item">
+        <span class="status-degraded__dot status-degraded__dot--<%= outage.status %>" aria-hidden="true"></span>
+        <span class="status-degraded__name"><%= outage.service.name %></span>
+        <span class="status-degraded__detail">
+          <%= status_label(outage.status).downcase %>
+          <% if outage.started_at %>· <%= local_time_ago outage.started_at %><% end %>
+        </span>
+      </li>
+    <% end %>
+  </ul>
+<% end %>

data/app/views/upright/public/services/_overall_banner.html.erb

@@ -0,0 +1,4 @@
+<div class="status-banner status-banner--<%= status %>">
+  <span class="status-banner__dot" aria-hidden="true"></span>
+  <%= overall_status_label(status) %>
+</div>

data/app/views/upright/public/services/_service.html.erb

@@ -0,0 +1,34 @@
+<% today_status = history.last.status %>
+
+<section class="service">
+  <div class="service__row">
+    <%= link_to service.name, public_service_incidents_path(service.code), class: "service__name" %>
+    <% if service.maintenance_active? %>
+      <span class="service__status service__status--maintenance">Under maintenance</span>
+    <% else %>
+      <span class="service__status service__status--<%= today_status %>">
+        <%= status_label(today_status) %>
+      </span>
+    <% end %>
+  </div>
+
+  <% if description = service.try(:description).presence %>
+    <p class="service__description"><%= description %></p>
+  <% end %>
+
+  <div class="uptime">
+    <div class="uptime__bars" role="img" aria-label="<%= history.size %>-day uptime for <%= service.name %>">
+      <%= render partial: "uptime_bar", collection: history, as: :day %>
+    </div>
+
+    <div class="uptime__meta">
+      <span><%= history.size %> days ago</span>
+      <% if uptime = uptime_percentage_label(history.map(&:uptime_fraction).compact) %>
+        <span class="uptime__meta-percent"><%= uptime %> uptime</span>
+      <% else %>
+        <span class="uptime__meta-percent">No data yet</span>
+      <% end %>
+      <span>Today</span>
+    </div>
+  </div>
+</section>

data/app/views/upright/public/services/_upcoming_maintenance.html.erb

@@ -0,0 +1,21 @@
+<% if maintenances.any? %>
+  <section class="upcoming">
+    <h2 class="upcoming__title">Scheduled maintenance</h2>
+    <% maintenances.each do |maintenance| %>
+      <%= link_to public_incident_path(maintenance), class: "upcoming__item" do %>
+        <div class="event__head">
+          <span class="event__title"><%= maintenance.title %></span>
+          <span class="upcoming__when"><%= local_maintenance_window(maintenance) %></span>
+        </div>
+
+        <% if maintenance.public_services.any? %>
+          <p class="event__services"><%= maintenance.public_services.map(&:name).to_sentence %></p>
+        <% end %>
+
+        <% if (update = maintenance.updates.first) && update.body.present? %>
+          <p class="event__update"><%= update.body %></p>
+        <% end %>
+      <% end %>
+    <% end %>
+  </section>
+<% end %>

data/app/views/upright/public/services/_uptime_bar.html.erb

@@ -0,0 +1,9 @@
+<span class="uptime__bar uptime__bar--<%= day.status %>" aria-label="<%= day.aria_label %>">
+  <span class="uptime__tooltip" aria-hidden="true">
+    <span class="uptime__tooltip-date"><%= day.date_label %></span>
+    <span class="uptime__tooltip-detail">
+      <span class="uptime__tooltip-dot uptime__tooltip-dot--<%= day.status || "none" %>"></span>
+      <%= day.detail %>
+    </span>
+  </span>
+</span>

data/app/views/upright/public/services/index.html.erb

@@ -0,0 +1,13 @@
+<div class="status-page">
+  <h1 class="status-page__title">Status</h1>
+
+  <%= render "overall_banner", status: @status_page.overall_status %>
+  <%= render "degraded_list", degraded: @status_page.outages %>
+
+  <%= render "active_events", incidents: @status_page.active_incidents, maintenances: @status_page.active_maintenances %>
+  <%= render "upcoming_maintenance", maintenances: @status_page.upcoming_maintenances %>
+
+  <% @status_page.service_histories.each do |service, history| %>
+    <%= render "service", service: service, history: history %>
+  <% end %>
+</div>

data/app/views/upright/public/services/index.rss.builder

@@ -0,0 +1,29 @@
+xml.instruct! :xml, version: "1.0", encoding: "UTF-8"
+xml.rss(version: "2.0") do
+  xml.channel do
+    xml.title "Upright Status"
+    xml.link request.base_url
+    xml.description "Currently degraded services"
+    xml.lastBuildDate Time.current.rfc822
+
+    @status_page.outages.each do |outage|
+      xml.item do
+        xml.title "#{outage.service.name} — #{status_label(outage.status)}"
+        xml.description "#{outage.service.name} is currently #{status_label(outage.status).downcase} #{outage_duration_description(started_at: outage.started_at)}."
+        xml.pubDate outage.started_at.rfc822 if outage.started_at
+        xml.guid feed_item_guid(outage), isPermaLink: "false"
+      end
+    end
+
+    @status_page.active_events.each do |event|
+      update = event.updates.first
+      xml.item do
+        xml.title "#{event.title} — #{status_label(event.status)}"
+        xml.description update&.body.to_s
+        xml.link public_incident_url(event)
+        xml.pubDate (update&.created_at || event.starts_at).rfc822
+        xml.guid "incident-#{event.id}-#{update&.id}", isPermaLink: "false"
+      end
+    end
+  end
+end

data/app/views/upright/sessions/new.html.erb

@@ -1,6 +1,19 @@
 <div class="sign-in-container">
   <div class="sign-in-box">
     <h1>Upright</h1>
-    <%= button_to "Sign in", "/auth/#{Upright.configuration.auth_provider}", method: :post, data: { turbo: false }, class: "btn" %>
+    <% if Upright.configuration.auth_provider.to_sym == :static_credentials %>
+      <%# Post credentials straight to the OmniAuth callback, but as a same-origin
+          form carrying a Rails authenticity token so a cross-site request can't
+          forge a sign-in (CVE-2026-67993). %>
+      <%= form_with url: "/auth/static_credentials/callback", method: :post, data: { turbo: false } do |form| %>
+        <%= form.label :username, "Username" %>
+        <%= form.text_field :username, autocomplete: "username" %>
+        <%= form.label :password, "Password" %>
+        <%= form.password_field :password, autocomplete: "current-password" %>
+        <%= form.submit "Sign in", class: "btn" %>
+      <% end %>
+    <% else %>
+      <%= button_to "Sign in", "/auth/#{Upright.configuration.auth_provider}", method: :post, data: { turbo: false }, class: "btn" %>
+    <% end %>
   </div>
 </div>

data/config/importmap.rb

@@ -1,18 +1,29 @@
-# Pin engine JavaScript
-pin "application", to: "upright/application.js"
-pin "upright/application", to: "upright/application.js"
-pin "upright/controllers/application", to: "upright/controllers/application.js"
-pin "upright/controllers", to: "upright/controllers/index.js"
+# Two entry points share this map. The admin app loads "application"; the public
+# status page loads "upright/public". Pins used only by the admin app are
+# preloaded for the "application" entry point alone, so the public page does not
+# fetch Turbo, Stimulus, Leaflet or the charts library.
+
+# Admin app
+pin "application", to: "upright/application.js", preload: "application"
+pin "upright/application", to: "upright/application.js", preload: "application"
+pin "upright/controllers/application", to: "upright/controllers/application.js", preload: "application"
+pin "upright/controllers", to: "upright/controllers/index.js", preload: "application"
 
 pin_all_from Upright::Engine.root.join("app/javascript/upright/controllers"),
              under: "upright/controllers",
-             to: "upright/controllers"
+             to: "upright/controllers",
+             preload: "application"
+
+pin "@hotwired/turbo-rails", to: "https://cdn.jsdelivr.net/npm/@hotwired/turbo-rails@8.0.20/+esm", preload: "application"
+pin "@hotwired/turbo", to: "https://cdn.jsdelivr.net/npm/@hotwired/turbo@8.0.20/+esm", preload: "application"
+pin "@hotwired/stimulus", to: "https://cdn.jsdelivr.net/npm/@hotwired/stimulus@3.2.2/dist/stimulus.js", preload: "application"
+pin "@hotwired/stimulus-loading", to: "stimulus-loading.js", preload: "application"
+pin "@rails/actioncable/src", to: "https://cdn.jsdelivr.net/npm/@rails/actioncable@8.1.100/src/index.js", preload: "application"
+pin "leaflet", to: "https://cdn.jsdelivr.net/npm/leaflet@1.9.4/dist/leaflet-src.esm.js", preload: "application"
+pin "frappe-charts", to: "https://cdn.jsdelivr.net/npm/frappe-charts@1.6.2/dist/frappe-charts.min.esm.js", preload: "application"
+
+# Public status page
+pin "upright/public", to: "upright/public.js", preload: "upright/public"
 
-# Dependencies
-pin "@hotwired/turbo-rails", to: "https://cdn.jsdelivr.net/npm/@hotwired/turbo-rails@8.0.20/+esm"
-pin "@hotwired/turbo", to: "https://cdn.jsdelivr.net/npm/@hotwired/turbo@8.0.20/+esm"
-pin "@hotwired/stimulus", to: "https://cdn.jsdelivr.net/npm/@hotwired/stimulus@3.2.2/dist/stimulus.js"
-pin "@hotwired/stimulus-loading", to: "stimulus-loading.js"
-pin "@rails/actioncable/src", to: "https://cdn.jsdelivr.net/npm/@rails/actioncable@8.1.100/src/index.js"
-pin "leaflet", to: "https://cdn.jsdelivr.net/npm/leaflet@1.9.4/dist/leaflet-src.esm.js"
-pin "frappe-charts", to: "https://cdn.jsdelivr.net/npm/frappe-charts@1.6.2/dist/frappe-charts.min.esm.js"
+# Shared
+pin "local-time", to: "local-time.es2017-esm.js", preload: true

data/config/initializers/date_formats.rb

@@ -0,0 +1,5 @@
+Date::DATE_FORMATS[:month_day] ||= "%b %-d"
+
+Time::DATE_FORMATS[:month_day_at]      ||= "%b %-d, %H:%M"
+Time::DATE_FORMATS[:month_day_at_zone] ||= "%b %-d, %H:%M %Z"
+Time::DATE_FORMATS[:clock_zone]        ||= "%H:%M %Z"

data/config/initializers/mime_types.rb

@@ -0,0 +1 @@
+Mime::Type.register "application/rss+xml", :rss unless Mime::Type.lookup_by_extension(:rss)

data/config/routes.rb

@@ -1,6 +1,11 @@
 Upright::Engine.routes.draw do
-  global_subdomain = ->(req) { Upright.configuration.global_subdomain == req.subdomain }
-  site_subdomain   = ->(req) { Upright.configuration.site_subdomains.include?(req.subdomain) }
+  global_subdomain  = ->(req) { Upright.configuration.global_subdomain == req.subdomain }
+  site_subdomain    = ->(req) { Upright.configuration.site_subdomains.include?(req.subdomain) }
+  metrics_subdomain = ->(req) { global_subdomain.call(req) || Upright.find_site(req.subdomain)&.stores_metrics? }
+  public_status     = ->(req) {
+    Upright.configuration.public_status_enabled &&
+      req.subdomain == Upright.configuration.public_status_subdomain
+  }
 
   constraints global_subdomain do
     root "sites#index", as: :admin_root
@@ -13,6 +18,12 @@ Upright::Engine.routes.draw do
       resource :probe_status, only: :show
     end
 
+    resources :incidents do
+      resources :updates, only: :create, controller: "incidents/updates"
+    end
+  end
+
+  constraints metrics_subdomain do
     scope :framed do
       resource :prometheus,   only: :show, controller: :prometheus_proxy
       resource :alertmanager, only: :show, controller: :alertmanager_proxy
@@ -29,6 +40,8 @@ Upright::Engine.routes.draw do
 
     resources :artifacts, only: :show, as: :site_artifacts
 
+    match "traces/:signed_id", to: "traces#show", as: :site_trace, via: [ :get, :options ]
+
     scope :framed do
       resource :jobs, only: :show
     end
@@ -36,6 +49,17 @@ Upright::Engine.routes.draw do
     mount MissionControl::Jobs::Engine, at: "/jobs"
   end
 
+  constraints public_status do
+    scope module: :public, as: :public do
+      root "services#index", as: :services_root
+      get "feed", to: "services#index", as: :services_feed, defaults: { format: :rss }
+      resources :services, only: [], param: :code do
+        resources :incidents, only: :index, controller: :service_incidents
+      end
+      resources :incidents, only: :show
+    end
+  end
+
   # Base routes (no subdomain constraint)
   resource :session, only: :destroy
   root "sites#index"

data/db/migrate/20260629000001_fix_probe_result_duration_precision.rb

@@ -0,0 +1,14 @@
+class FixProbeResultDurationPrecision < ActiveRecord::Migration[8.0]
+  # `t.decimal :duration` with no precision becomes DECIMAL(10,0) on MySQL,
+  # which rounds every duration to a whole second on write. Probe durations
+  # are sub-second floats from a monotonic clock, so they were all stored as
+  # 0. SQLite preserved the fractional value, which is why this only surfaced
+  # after the MySQL migration. Give the column microsecond precision.
+  def up
+    change_column :upright_probe_results, :duration, :decimal, precision: 10, scale: 6
+  end
+
+  def down
+    change_column :upright_probe_results, :duration, :decimal
+  end
+end

data/db/persistent_migrate/20260512000001_create_upright_rollups.rb

@@ -0,0 +1,16 @@
+class CreateUprightRollups < ActiveRecord::Migration[8.0]
+  def change
+    create_table :upright_rollups_probe_rollups do |t|
+      t.string :probe_name, null: false
+      t.string :probe_service
+      t.datetime :period_start, null: false
+      t.float :uptime_fraction, null: false
+      t.integer :status, default: 0, null: false
+
+      t.timestamps
+    end
+
+    add_index :upright_rollups_probe_rollups, [ :probe_name, :period_start ], unique: true
+    add_index :upright_rollups_probe_rollups, [ :probe_service, :period_start ]
+  end
+end

data/db/persistent_migrate/20260702000001_create_upright_incidents.rb

@@ -0,0 +1,34 @@
+class CreateUprightIncidents < ActiveRecord::Migration[8.0]
+  def change
+    create_table :upright_incidents do |t|
+      t.string :type
+      t.string :title, null: false
+      t.string :status, null: false
+      t.string :impact, null: false
+      t.datetime :starts_at, null: false
+      t.datetime :ends_at
+      t.datetime :resolved_at
+
+      t.timestamps
+    end
+
+    add_index :upright_incidents, [ :resolved_at, :starts_at ]
+    add_index :upright_incidents, [ :type, :starts_at ]
+
+    create_table :upright_incident_updates do |t|
+      t.references :incident, null: false, foreign_key: { to_table: :upright_incidents }
+      t.string :status, null: false
+      t.text :body
+
+      t.datetime :created_at, null: false
+    end
+
+    create_table :upright_incident_affected_services do |t|
+      t.references :incident, null: false, foreign_key: { to_table: :upright_incidents }
+      t.string :service_code, null: false
+    end
+
+    add_index :upright_incident_affected_services, [ :incident_id, :service_code ], unique: true
+    add_index :upright_incident_affected_services, :service_code
+  end
+end

data/db/persistent_migrate/20260707000001_add_probe_identity_to_upright_rollups.rb

@@ -0,0 +1,11 @@
+class AddProbeIdentityToUprightRollups < ActiveRecord::Migration[8.0]
+  def change
+    add_column :upright_rollups_probe_rollups, :probe_type, :string
+    add_column :upright_rollups_probe_rollups, :probe_target, :string
+
+    remove_index :upright_rollups_probe_rollups, column: [ :probe_name, :period_start ], unique: true
+    add_index :upright_rollups_probe_rollups,
+      [ :probe_name, :probe_type, :probe_target, :period_start ],
+      unique: true, name: "idx_probe_rollups_identity_period"
+  end
+end

data/db/persistent_migrate/20260709000001_add_created_by_to_incidents.rb

@@ -0,0 +1,7 @@
+class AddCreatedByToIncidents < ActiveRecord::Migration[8.0]
+  def change
+    add_column :upright_incidents, :created_by, :string
+    add_column :upright_incidents, :updated_by, :string
+    add_column :upright_incident_updates, :created_by, :string
+  end
+end

data/db/persistent_migrate/20260901000001_add_auto_reporting_to_upright_incidents.rb

@@ -0,0 +1,22 @@
+class AddAutoReportingToUprightIncidents < ActiveRecord::Migration[8.0]
+  def up
+    add_column :upright_incidents, :auto_created, :boolean, default: false, null: false
+    add_column :upright_incidents, :last_seen_down_at, :datetime
+    add_column :upright_incidents, :recovery_started_at, :datetime
+
+    create_table :upright_incident_automatic_reports do |t|
+      t.references :incident, null: false, foreign_key: { to_table: :upright_incidents }, index: { unique: true }
+      t.string :service_code, null: false, index: { unique: true }
+      t.timestamps
+    end
+  end
+
+  def down
+    drop_table :upright_incident_automatic_reports, if_exists: true
+    remove_index :upright_incidents, :auto_service_code, if_exists: true
+    remove_column :upright_incidents, :auto_service_code, if_exists: true
+    remove_column :upright_incidents, :recovery_started_at, if_exists: true
+    remove_column :upright_incidents, :last_seen_down_at
+    remove_column :upright_incidents, :auto_created
+  end
+end

data/lib/generators/upright/install/database_config.rb

@@ -0,0 +1,46 @@
+module Upright
+  module Generators
+    # Rewrites the single-database development and test entries that `rails new`
+    # writes into the three databases Upright uses:
+    #
+    #   primary     probe results and Active Storage artifacts
+    #   persistent  rollups, incidents and maintenance windows, which outlive a
+    #               site's probe data; its migrations ship with the gem
+    #   queue       Solid Queue
+    #
+    # Pure string transformation so the install generator's edit can be tested
+    # without a generated application.
+    module DatabaseConfig
+      ENVIRONMENTS = %w[development test].freeze
+
+      PERSISTENT_MIGRATIONS = %(<%= Gem.loaded_specs["upright"].gem_dir %>/db/persistent_migrate)
+
+      def self.rewrite(yaml)
+        ENVIRONMENTS.reduce(yaml) do |rewritten, env|
+          rewritten.sub(single_database(env), split_databases(env))
+        end
+      end
+
+      def self.single_database(env)
+        "#{env}:\n  <<: *default\n  database: storage/#{env}.sqlite3"
+      end
+
+      def self.split_databases(env)
+        <<~YAML.chomp
+          #{env}:
+            primary:
+              <<: *default
+              database: storage/#{env}.sqlite3
+            persistent:
+              <<: *default
+              database: storage/#{env}_persistent.sqlite3
+              migrations_paths: #{PERSISTENT_MIGRATIONS}
+            queue:
+              <<: *default
+              database: storage/#{env}_queue.sqlite3
+              migrations_paths: db/queue_migrate
+        YAML
+      end
+    end
+  end
+end

data/lib/generators/upright/install/install_generator.rb

@@ -1,3 +1,5 @@
+require_relative "database_config"
+
 module Upright
   module Generators
     class InstallGenerator < Rails::Generators::Base
@@ -17,6 +19,11 @@ module Upright
       def copy_initializers
         template "upright.rb", "config/initializers/upright.rb"
         template "omniauth.rb", "config/initializers/omniauth.rb"
+        # Never force: an app may already run an enforced CSP, and silently
+        # replacing it with this commented template would disable it. On a
+        # collision Thor prompts instead of overwriting; the recommended policy is
+        # documented for the operator to merge.
+        template "content_security_policy.rb", "config/initializers/content_security_policy.rb"
       end
 
       def copy_sites_config
@@ -46,6 +53,7 @@ module Upright
 
       def copy_deploy_config
         template "deploy.yml", "config/deploy.yml"
+        template "Dockerfile", "Dockerfile"
       end
 
       def copy_puma_config
@@ -56,14 +64,14 @@ module Upright
         rails_command "solid_queue:install"
       end
 
-      def add_queue_database
-        gsub_file "config/database.yml",
-          "development:\n  <<: *default\n  database: storage/development.sqlite3",
-          "development:\n  primary:\n    <<: *default\n    database: storage/development.sqlite3\n  queue:\n    <<: *default\n    database: storage/development_queue.sqlite3\n    migrations_paths: db/queue_migrate"
-
-        gsub_file "config/database.yml",
-          "test:\n  <<: *default\n  database: storage/test.sqlite3",
-          "test:\n  primary:\n    <<: *default\n    database: storage/test.sqlite3\n  queue:\n    <<: *default\n    database: storage/test_queue.sqlite3\n    migrations_paths: db/queue_migrate"
+      # Splits the development and test databases into primary, persistent and
+      # queue. The persistent database holds rollups, incidents and maintenance
+      # windows, and its migrations come from the gem, so database.yml points
+      # migrations_paths at the installed gem's db/persistent_migrate.
+      def add_persistent_and_queue_databases
+        gsub_file "config/database.yml", /\A.*\z/m do |yaml|
+          DatabaseConfig.rewrite(yaml)
+        end
       end
 
       def copy_recurring_config
@@ -101,11 +109,11 @@ module Upright
         say "Upright has been installed!", :green
         say ""
         say "Next steps:"
-        say "  1. Prepare the database: bin/rails db:prepare"
+        say "  1. Prepare the databases (primary, persistent and queue): bin/rails db:prepare"
         say "  2. Configure your servers in config/deploy.yml"
         say "  3. Configure sites in config/sites.yml"
         say "  4. Add probes in probes/*.yml"
-        say "  5. Set ADMIN_PASSWORD env var (default: upright)"
+        say "  5. Set the ADMIN_PASSWORD env var — required, there is no default password"
         say ""
         say "For production, review config/initializers/upright.rb and update:"
         say "  config.hostname = \"example.com\""

data/lib/generators/upright/install/templates/Dockerfile

@@ -0,0 +1,80 @@
+# syntax = docker/dockerfile:1
+
+# This Dockerfile is designed for production, not development. Use with Kamal or build'n'run by hand:
+# docker build -t my-app .
+# docker run -d -p 80:80 -p 443:443 --name my-app -e RAILS_MASTER_KEY=<value from config/master.key> my-app
+
+# Make sure RUBY_VERSION matches the Ruby version in .ruby-version
+ARG RUBY_VERSION=<%= RUBY_VERSION %>
+FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
+
+# Rails app lives here
+WORKDIR /rails
+
+# Install base packages and Node.js (for Playwright)
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y curl libjemalloc2 libvips sqlite3 iputils-ping mtr-tiny \
+    nodejs npm && \
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+# Set production environment
+ENV RAILS_ENV="production" \
+    BUNDLE_DEPLOYMENT="1" \
+    BUNDLE_PATH="/usr/local/bundle" \
+    BUNDLE_WITHOUT="development"
+
+# Throw-away build stage to reduce size of final image
+FROM base AS build
+
+# Install packages needed to build gems
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y build-essential git pkg-config libssl-dev libyaml-dev rustc cargo libclang-dev && \
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+# Install application gems
+COPY Gemfile Gemfile.lock ./
+RUN --mount=type=secret,id=GITHUB_TOKEN \
+    BUNDLE_GITHUB__COM="$(cat /run/secrets/GITHUB_TOKEN):x-oauth-basic" bundle install && \
+    rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \
+    bundle exec bootsnap precompile --gemfile && \
+    bundle exec ruby -e "require 'upright/version'; puts Upright::PLAYWRIGHT_VERSION" > /tmp/playwright_version
+
+# Copy application code
+COPY . .
+
+# Precompile bootsnap code for faster boot times
+RUN bundle exec bootsnap precompile app.rb probes/
+
+# Precompiling assets for production without requiring secret RAILS_MASTER_KEY
+RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile
+
+# Final stage for app image
+FROM base
+
+# Install Playwright before copying app code so the layer is cached on code-only deploys.
+# The version is extracted to a file in the build stage; BuildKit's content-based caching
+# keeps this layer cached even across Gemfile changes when the version is unchanged.
+COPY --from=build /tmp/playwright_version /tmp/playwright_version
+ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
+RUN PLAYWRIGHT_VERSION=$(cat /tmp/playwright_version) && \
+    npm install -g playwright@~${PLAYWRIGHT_VERSION}.0 && \
+    playwright install --with-deps chromium && \
+    chmod -R o+rx /ms-playwright
+
+# Copy built artifacts: gems, application
+COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
+COPY --from=build /rails /rails
+
+# Run and own only the runtime files as a non-root user for security
+RUN groupadd --system --gid 1000 rails && \
+    useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
+    mkdir -p storage tmp && \
+    chown -R rails:rails storage tmp
+USER 1000:1000
+
+# Entrypoint prepares the database.
+ENTRYPOINT ["/rails/bin/docker-entrypoint"]
+
+# Start the server by default, this can be overwritten at runtime
+EXPOSE 3000 9394
+CMD ["./bin/rails", "server"]

data/lib/generators/upright/install/templates/content_security_policy.rb

@@ -0,0 +1,42 @@
+# Be sure to restart your server when you modify this file.
+
+# Content Security Policy tuned for Upright. Uncomment the block below to
+# enforce it. Every source the engine actually uses is listed explicitly:
+#
+#   * JavaScript dependencies (Turbo, Stimulus, Leaflet, Frappe Charts) are
+#     pinned to https://cdn.jsdelivr.net in the engine's config/importmap.rb.
+#   * The Leaflet stylesheet is loaded from https://unpkg.com in the engine
+#     layout; Turbo injects an inline <style> for its progress bar, which is
+#     why style-src keeps :unsafe_inline (styles only — scripts stay strict).
+#   * Map tiles come from OpenStreetMap (light) and Carto (dark); Leaflet's
+#     default marker icons load from unpkg alongside its stylesheet.
+#   * The inline <script type="importmap"> tag is authorized by a per-session
+#     nonce via csp_meta_tag, which the engine layouts already render.
+#
+# To verify without breaking anything, start with
+# config.content_security_policy_report_only = true and watch the browser
+# console before enforcing.
+
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src     :self
+#     policy.font_src        :self, :data
+#     policy.img_src         :self, :data, "https://unpkg.com",
+#                            "https://*.tile.openstreetmap.org"
+#     policy.object_src      :none
+#     policy.script_src      :self, "https://cdn.jsdelivr.net"
+#     policy.style_src       :self, :unsafe_inline, "https://unpkg.com"
+#     policy.connect_src     :self
+#     policy.frame_ancestors :self
+#     policy.base_uri        :self
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
+#
+#   # Generate session nonces for the inline importmap script tag.
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src)
+#
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
+# end