./mvnw)op CLI (1Password, for secret management)kubeseal (for rotating sealed secrets)cd audit-pic-backend
docker-compose up -d db minio
This starts:
54329000 (API) and 9001 (console → http://localhost:9001, user: minioadmin)cd audit-pic-backend
./mvnw spring-boot:run
Backend starts on http://localhost:8080. Swagger UI: http://localhost:8080/swagger-ui.html
flutter pub get
flutter run --dart-define=BASE_URL=http://localhost:8080
On Android emulator use BASE_URL=http://10.0.2.2:8080.
# Flutter (unit tests + analyzer)
make test
make analyze
# Backend (unit tests only — no DB needed)
make test-backend
# All Maestro UI tests (requires running app + emulator)
make maestro-test
| Variable | Default | Description |
|---|---|---|
| DATABASE_URL | jdbc:postgresql://localhost:5432/auditpicdb | PostgreSQL JDBC URL |
| DATABASE_USERNAME | auditpic | DB username |
| DATABASE_PASSWORD | auditpic | DB password |
| MINIO_ENDPOINT | http://localhost:9000 | MinIO endpoint |
| MINIO_ACCESS_KEY | minioadmin | MinIO access key |
| MINIO_SECRET_KEY | minioadmin | MinIO secret key |
| MINIO_BUCKET | auditpic | MinIO bucket name |
| JWT_SECRET | (required, ≥32 chars) | JWT signing secret |
| HMAC_SECRET | (required, ≥32 chars) | HMAC-SHA256 signing secret |
| AI_DETECTION_ENABLED | false | Enable AI detection API |
| AI_DETECTION_API_KEY | — | Hive/Sightengine API key |
| SERVER_PORT | 8080 | HTTP port |
All production secrets live in 1Password → account mahmoudholdingbv.1password.com → vault AuditPic → item audit-pic-secrets.
Fields:
database-passwordjwt-secrethmac-secretminio-access-keyminio-secret-keyai-detection-api-keyTo rotate and re-seal (per env — the script takes a staging|production arg since 2026-05-19):
OP_SERVICE_ACCOUNT_TOKEN=<token> ./scripts/seal-secrets.sh staging
OP_SERVICE_ACCOUNT_TOKEN=<token> ./scripts/seal-secrets.sh production
git add k8s/sealed-secrets/backend-secrets-staging.yaml k8s/sealed-secrets/backend-secrets-production.yaml
git commit -m "chore: rotate sealed secrets (both envs)"
git push
1Password layout:
AuditPicaudit-pic-secrets-production, audit-pic-secrets-stagingThe SealedSecrets controller on k3s will automatically reconcile the new secret on the next deploy (the CD workflow's Apply SealedSecret for this env step applies the env-specific file before helm upgrade).
All endpoints were verified locally:
| Method | Path | Auth | Result |
|---|---|---|---|
| GET | /actuator/health | None | {"status":"UP"} |
| POST | /api/v1/auth/register | None | {token, email} |
| POST | /api/v1/auth/login | None | {token, email} |
| POST | /api/v1/photos | Bearer | {verificationId, sha256, signedAt, ...} |
| GET | /api/v1/photos | Bearer | Paginated list |
| GET | /api/v1/photos/{id} | None | Photo metadata |
| GET | /api/v1/photos/{id}/download | Bearer | {url} presigned MinIO URL |
| DELETE | /api/v1/photos/{id} | Bearer | 204 No Content |
Reacties