openhands 597287fce5 fix(compose): keep the CMS opt-in so it cannot claim the CI port ...

On a CI-managed host scripts/ci-deploy.sh owns port 3002 through the
blue/green slots, so a compose replica of the cms service could only ever
crash-loop on EADDRINUSE — it never serves traffic, because nginx points at a
slot container. Gate the service behind the `cms` profile so a bare
`docker compose up -d` starts only byparr. Naming the service explicitly
(`docker compose up -d cms`, which is what the installer and updater already
do) still enables the profile automatically, so the compose-only install path
keeps working.

Keep the one port that is actually served (3002) and make the 2 GB ceiling
hard by capping swap at 2g as well. Drop the green compose service (3003):
the green slot only ever exists as a docker run container created by CI, so
compose no longer defines it and the two paths cannot drift apart.

The loopback override contract stays covered: proxy-config.test.mjs now
renders the configuration with --profile cms, and a new build-contract test
pins the profile and the memory limits so neither can be dropped by accident.

2026-10-19 19:00:07 +02:00

..

personal-tokens

fix(security): authorize site uploads and harden tokens, media and request identity

2026-09-13 19:24:43 +02:00

backup-and-restore-drill.md

feat(ops): add integrity-checked backups and isolated restore drills

2026-09-13 20:29:18 +02:00

ci-preflight.md

ci: verify isolated Docker news journeys before merging to main

2026-09-13 21:05:02 +02:00

cms-error-center.md

feat(renovate): add self-hosted Renovate config and Gitea Actions workflow

2026-10-16 16:57:02 +02:00

docker-installation.md

fix(compose): keep the CMS opt-in so it cannot claim the CI port

2026-10-19 19:00:07 +02:00

security-review-2026-09-13.md

fix(news): enforce shared comment publication and moderation rules

2026-09-13 20:14:32 +02:00