Merge remote-tracking branch 'origin/develop' into feature/ip-enrichment-geo-vpn

# Conflicts:
#	Common/OpenShockControllerBase.cs
#	Common/OpenShockServiceHelper.cs
#	Common/Services/Session/ISessionService.cs
#	Common/Services/Session/SessionService.cs

Author: hhvrc

.env

@@ -1,27 +1,59 @@
-# Required variables (uncomment and set values!)
-#PG_PASS=someSecurePassword
-
-# Compose variables
-OPENSHOCK_DOMAIN=openshock.local # your public base domain
-OPENSHOCK_GATEWAY_SUBDOMAIN=gateway # subdomain for the included gateway
-OPENSHOCK_API_SUBDOMAIN=api # subdomain for the api
-
-#global email config
-OPENSHOCK__MAIL__SENDER__NAME=OpenShock System
-OPENSHOCK__MAIL__SENDER__EMAIL=system@openshock.app
-
-#mail configs. uncomment one of the 2 sections below and make your config changes
-
-#MailJet
-#OPENSHOCK__MAIL__TYPE: MAILJET # MAILJET or SMTP, check Documentation
-#OPENSHOCK__MAIL__MAILJET__KEY: mailjetkey
-#OPENSHOCK__MAIL__MAILJET__SECRET: mailjetsecret
-#OPENSHOCK__MAIL__MAILJET__TEMPLATE__PASSWORDRESET: 9999999
-
-#SMTP
-OPENSHOCK__MAIL__TYPE=SMTP # MAILJET or SMTP, check Documentation
-OPENSHOCK__MAIL__SMTP__HOST=mail.domain.zap
-OPENSHOCK__MAIL__SMTP__USERNAME=open@shock.zap
-OPENSHOCK__MAIL__SMTP__PASSWORD=SMTPPASSWORD
-OPENSHOCK__MAIL__SMTP__ENABLESSL=true
-OPENSHOCK__MAIL__SMTP__VERIFYCERTIFICATE=true
+# OpenShock configuration. These are simple knobs; docker-compose.yml maps them
+# onto the OPENSHOCK__* variables the containers read and shares them across every
+# service. Anything left unset falls back to the defaults defined in the compose file.
+
+# --- Required ---
+# Database password (no default, must be set).
+PG_PASS=someSecurePassword
+
+# --- Images ---
+# Tag for the backend images (api, gateway, cron) — they share the backend repo's
+# versioning. The frontend is a separate repo with its own versions, so it has its
+# own tag. Pin to a release for reproducible deploys; both default to `latest`.
+#OPENSHOCK_TAG=latest
+#OPENSHOCK_FRONTEND_TAG=latest
+
+# --- Host / port / paths ---
+# The whole stack runs on one host and one port; services are told apart by path.
+# The host clients use to reach the stack.
+OPENSHOCK_HOST=openshock.local
+# External port for the stack. Leave blank for 443 (standard https). Set e.g. 8080
+# to serve on https://host:8080. Traefik publishes this onto its https entrypoint.
+#OPENSHOCK_PORT=8080
+# Path prefix per service. Frontend sits at the root; api and gateway on sub-paths.
+# Leave OPENSHOCK_FRONTEND_PATH blank to keep the web UI at the root (recommended).
+#OPENSHOCK_FRONTEND_PATH=
+OPENSHOCK_API_PATH=/api
+OPENSHOCK_GATEWAY_PATH=/gateway
+
+# --- Database (optional, defaults shown) ---
+#PG_USER=openshock
+#PG_DB=openshock
+
+# --- Feature flags (optional, defaults shown) ---
+#OPENSHOCK_TURNSTILE_ENABLE=false
+#OPENSHOCK_REGISTRATION_ENABLED=true
+
+# --- TLS (optional, defaults shown) ---
+# Set this to true to disable TLS certificate verification for the frontend. This is useful
+# for testing with self-signed certs, but should not be used in production.
+#OPENSHOCK_FRONTEND_TLS_INSECURE=false
+
+# --- E-mail ---
+# MAIL_TYPE is required by the app. Leave it as None to run without outbound mail,
+# or set it to Smtp / Mailjet and fill in the matching block below.
+MAIL_TYPE=None
+MAIL_SENDER_NAME=OpenShock System
+MAIL_SENDER_EMAIL=system@openshock.app
+
+# SMTP (used when MAIL_TYPE=Smtp)
+#SMTP_HOST=mail.domain.zap
+#SMTP_PORT=587
+#SMTP_USERNAME=open@shock.zap
+#SMTP_PASSWORD=SMTPPASSWORD
+#SMTP_ENABLESSL=true
+#SMTP_VERIFYCERTIFICATE=true
+
+# Mailjet (used when MAIL_TYPE=Mailjet)
+#MAILJET_KEY=mailjetkey
+#MAILJET_SECRET=mailjetsecret

.github/actions/build-app/action.yml

@@ -23,7 +23,7 @@ runs:
   steps:
     - name: Extract metadata (tags, labels) for Docker
       id: meta
-      uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
       with:
         images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ inputs.image }}
         flavor: |
@@ -32,7 +32,7 @@ runs:
           type=raw,value=${{ inputs.tag-prefix }}-${{ github.run_number }}-a${{ github.run_attempt }}
 
     - name: Build and push
-      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
       with:
         context: .
         file: ${{ inputs.dockerfile }}

.github/actions/promote-image/action.yml

@@ -17,7 +17,7 @@ runs:
 
     - name: Extract metadata (tags, labels) for Promotion
       id: remeta
-      uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
       with:
         images: ${{ inputs.image }}
         flavor: |

.github/dependabot.yml

@@ -12,9 +12,9 @@ updates:
     schedule:
       interval: weekly
       day: monday
-      time: '06:00'
+      time: '08:00'
     groups:
-      nuget-dependencies:
+      nuget:
         patterns:
           - '*' # Group all updates together
 
@@ -24,8 +24,20 @@ updates:
     schedule:
       interval: weekly
       day: monday
-      time: '06:00'
+      time: '08:00'
     groups:
       github-actions:
         patterns:
           - '*' # Group all updates together
+
+  # Check for Docker base image updates
+  - package-ecosystem: docker
+    directory: /docker
+    schedule:
+      interval: weekly
+      day: monday
+      time: '08:00'
+    groups:
+      docker:
+        patterns:
+          - '*' # Group all updates together

.github/workflows/ci-build.yml

@@ -33,7 +33,6 @@ name: ci-build
 env:
   REGISTRY: ghcr.io
   DOTNET_VERSION: 10.0.x
-  COVERAGE_MIN_PERCENT: '85'
 
 jobs:
 
@@ -43,9 +42,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '${{ env.DOTNET_VERSION }}'
 
@@ -55,9 +54,6 @@ jobs:
           dotnet test -c Release --solution OpenShockBackend.slnx \
             --results-directory "artifacts/test-results" \
             -- \
-            --coverage \
-            --coverage-output coverage.cobertura.xml \
-            --coverage-output-format cobertura \
             --report-trx \
             --report-trx-filename test-results.trx
 
@@ -69,111 +65,6 @@ jobs:
           path: artifacts/test-results
           if-no-files-found: warn
 
-  coverage:
-    name: Coverage
-    runs-on: ubuntu-latest
-    needs: [tests]
-    outputs:
-      linecoverage: ${{ steps.enforce.outputs.linecoverage }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
-        with:
-          dotnet-version: '${{ env.DOTNET_VERSION }}'
-
-      - name: Download test artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: test-results
-          path: artifacts/test-results
-
-      - name: Install ReportGenerator
-        run: dotnet tool install --tool-path ./.tools dotnet-reportgenerator-globaltool
-
-      - name: Generate merged coverage report
-        run: |
-          set -euo pipefail
-          reports="$(find artifacts/test-results -name coverage.cobertura.xml -print | paste -sd ';' -)"
-          if [ -z "$reports" ]; then
-            echo "No coverage reports found" >&2
-            exit 1
-          fi
-
-          ./.tools/reportgenerator \
-            "-reports:${reports}" \
-            "-targetdir:artifacts/coverage" \
-            "-reporttypes:Html;MarkdownSummaryGithub;JsonSummary;Badges"
-
-      - name: Add coverage summary
-        run: cat artifacts/coverage/SummaryGithub.md >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Enforce minimum coverage
-        id: enforce
-        env:
-          COVERAGE_MIN_PERCENT: ${{ env.COVERAGE_MIN_PERCENT }}
-        run: |
-          python - <<'PY'
-          import json
-          import os
-
-          threshold = float(os.environ["COVERAGE_MIN_PERCENT"])
-          with open("artifacts/coverage/Summary.json", "r", encoding="utf-8") as handle:
-              summary = json.load(handle)["summary"]
-
-          line_coverage = float(summary["linecoverage"])
-          print(f"Line coverage: {line_coverage:.1f}%")
-
-          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
-              output.write(f"linecoverage={line_coverage:.1f}\n")
-
-          if line_coverage < threshold:
-              raise SystemExit(
-                  f"Coverage threshold not met: {line_coverage:.1f}% < {threshold:.1f}%"
-              )
-          PY
-
-      - name: Upload merged coverage report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: coverage-report
-          path: artifacts/coverage
-          if-no-files-found: error
-
-  publish-coverage:
-    name: Publish coverage
-    runs-on: ubuntu-latest
-    needs: coverage
-    if: ${{ github.ref_type == 'branch' && github.event_name != 'pull_request' && github.ref_name == 'master' }}
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-
-    steps:
-      - name: Configure Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
-
-      - name: Download merged coverage report
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: coverage-report
-          path: _site/coverage
-
-      - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
-        with:
-          path: _site
-
-      - name: Deploy Pages site
-        id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
-
   build:
     name: Build (${{ matrix.image }})
     runs-on: ubuntu-latest
@@ -190,13 +81,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -213,7 +104,7 @@ jobs:
 
   promote-image:
     name: Promote Image (${{ matrix.image }})
-    needs: [build, coverage]
+    needs: [build]
     runs-on: ubuntu-latest
     if: ${{ inputs.push || (github.ref_protected && github.event_name != 'pull_request') }}
     strategy:
@@ -226,10 +117,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Log in to Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -249,15 +140,13 @@ jobs:
     environment: production
     steps:
       - name: Send repository dispatch
-        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        uses: OpenShock/actions/repository-dispatch@21ca2d511bca92cf24fb502fa302f82700822584 # v1.1.1
         with:
-          token: ${{ secrets.GITOPS_PAT }}
-          repository: openshock/kubernetes-cluster-gitops
+          repo: openshock/kubernetes-cluster-gitops
           event-type: update-backend-prod
           client-payload: |
-            {
-              "tag": "${{ inputs.tag-prefix  || 'rn' }}-${{ github.run_number }}-a${{ github.run_attempt }}"
-            }
+            {"tag": "${{ inputs.tag-prefix  || 'rn' }}-${{ github.run_number }}-a${{ github.run_attempt }}"}
+          token: ${{ secrets.GITOPS_PAT }}
 
   deploy-staging:
     runs-on: ubuntu-latest
@@ -267,15 +156,13 @@ jobs:
 
     steps:
       - name: Send repository dispatch
-        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        uses: OpenShock/actions/repository-dispatch@21ca2d511bca92cf24fb502fa302f82700822584 # v1.1.1
         with:
-          token: ${{ secrets.GITOPS_PAT }}
-          repository: openshock/kubernetes-cluster-gitops
+          repo: openshock/kubernetes-cluster-gitops
           event-type: update-backend-staging
           client-payload: |
-            {
-              "tag": "${{ inputs.tag-prefix  || 'rn' }}-${{ github.run_number }}-a${{ github.run_attempt }}"
-            }
+            {"tag": "${{ inputs.tag-prefix  || 'rn' }}-${{ github.run_number }}-a${{ github.run_attempt }}"}
+          token: ${{ secrets.GITOPS_PAT }}
 
   deploy-dev:
     runs-on: ubuntu-latest
@@ -284,7 +171,7 @@ jobs:
     environment: development
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: |
             .github

.github/workflows/ci-tag.yml

@@ -21,11 +21,9 @@ jobs:
     steps:
       - name: Find latest tag
         id: latest-tag
-        uses: oprypin/find-latest-tag@6957ac556fa6d349727ecabfcaaf9f8e5ee37124 # v1.1.3
+        uses: OpenShock/actions/find-latest-tag@21ca2d511bca92cf24fb502fa302f82700822584 # v1.1.1
         with:
-          repository: ${{ github.repository }}
-          regex: '^\d+\.\d+\.\d+$'
-          releases-only: false
+          regex: '^[0-9]+\.[0-9]+\.[0-9]+$'
 
   # Delegate building and containerizing to a single workflow.
   build-and-containerize: