manual-setup-checklist.md

This issue tracks every step that cannot be automated by code and must be performed manually by the developer.
Work through them in order — later steps depend on earlier ones.

1. GitHub Secrets (required for CI/CD)

Settings → Secrets and variables → Actions → New repository secret

| Secret name | Where to get the value | |---|---| | GHCR_TOKEN | GitHub → Settings → Developer Settings → Personal Access Tokens (classic) — scopes: write:packages, read:packages, delete:packages | | VPS_HOST | TransIP control panel → 136.144.174.219 | | VPS_USER | sarkoutmahmoud | | VPS_SSH_KEY | cat ~/.ssh/id_ed25519 (the private key) | | JWT_SECRET | openssl rand -hex 64 (64-char hex string, ≥ 32 chars) | | BSN_ENCRYPTION_KEY | openssl rand -base64 32 (exactly 32 decoded bytes) — the value must be Base64-encoded | | DATABASE_PASSWORD | Choose a strong password for PostgreSQL | | REDIS_PASSWORD | Choose a strong password for Redis | | PSD2_SECRET_ID | GoCardless Bank Account Data API → Create application → Secret ID | | PSD2_SECRET_KEY | GoCardless Bank Account Data API → Secret Key | | KVK_API_KEY | KvK Developers portal → register for the KvK Search API |

Steps:

Go to https://github.com/mahmoudholding/europeLogin/settings/secrets/actions
Click New repository secret for each row above
Paste the value and save

2. GitHub Environments

Settings → Environments

Create two environments:

staging — no protection rules
production — add Required reviewers (yourself) and enable Wait timer (10 min)

The CD workflows reference these environments for deploy gating.

3. VPS — k3s cluster setup

SSH into the VPS:

ssh -i ~/.ssh/id_ed25519 sarkoutmahmoud@136.144.174.219

Install k3s (if not already running):

curl -sfL https://get.k3s.io | sh -
# verify
kubectl get nodes

Create namespaces:

kubectl create namespace europe-login          # production
kubectl create namespace europe-login-staging  # staging

4. GHCR pull secret on VPS

Run on the VPS (replace <GHCR_TOKEN> with your PAT):

for NS in europe-login europe-login-staging; do
  kubectl create secret docker-registry ghcr-pull-secret \
    --docker-server=ghcr.io \
    --docker-username=<your-github-username> \
    --docker-password=<GHCR_TOKEN> \
    --namespace=$NS \
    --dry-run=client -o yaml | kubectl apply -f -
done

5. PostgreSQL + Redis on VPS

Using Helm (install if needed: curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash):

helm repo add bitnami https://charts.bitnami.com/bitnami && helm repo update

# Staging
helm upgrade --install postgres-staging bitnami/postgresql \
  --namespace europe-login-staging \
  --set auth.database=europelogindb \
  --set auth.username=europelogin \
  --set auth.password=<DATABASE_PASSWORD_STAGING>

helm upgrade --install redis-staging bitnami/redis \
  --namespace europe-login-staging \
  --set auth.password=<REDIS_PASSWORD_STAGING> \
  --set architecture=standalone

# Production (repeat with stronger passwords and europe-login namespace)

6. Kubernetes Secrets (production values)

For each namespace, create the app secret:

kubectl create secret generic europe-login-secret \
  --namespace=europe-login \
  --from-literal=jwt-secret=<JWT_SECRET> \
  --from-literal=bsn-encryption-key=<BSN_ENCRYPTION_KEY_BASE64> \
  --from-literal=database-password=<DATABASE_PASSWORD> \
  --from-literal=redis-password=<REDIS_PASSWORD> \
  --from-literal=psd2-secret-id=<PSD2_SECRET_ID> \
  --from-literal=psd2-secret-key=<PSD2_SECRET_KEY> \
  --from-literal=kvk-api-key=<KVK_API_KEY> \
  --dry-run=client -o yaml | kubectl apply -f -

Repeat for europe-login-staging with staging-specific values.

7. Merge fix PRs into `develop`

Merge in this order (resolve conflicts if any):

#46 fix/data-contracts → CI must be green first
#47 fix/psd2-skip-path
#48 fix/security
#49 fix/edge-cases
#50 fix/p2-remaining-issues

Then merge #25 feature/hoog-assurance-id-scan → develop for the full feature.

After each merge: verify CI passes on develop before merging the next PR.

8. Wire up a real face comparison engine (HOOG path)

Tracked by: issue #45

Currently FaceComparisonServiceImpl is a stub that returns 0.0 — HOOG assurance is disabled until you replace it.

Options:

AWS Rekognition (CompareFaces API) — add aws-java-sdk-rekognition dependency, implement using AmazonRekognitionClient
Azure Face API — add azure-cognitiveservices-vision-face, implement using FaceClient
Open-source — add DeepFace via Python sidecar or OpenCV Java bindings

Minimum implementation:

Replace FaceComparisonServiceImpl.compare() with a real API call
Add the API key/endpoint as a new Kubernetes Secret
Add the secret to application.yml under europe-login.face-comparison.*

9. Domain / TLS

Point europe-login.glorylabs.nl DNS A-record → 136.144.174.219 (legacy domain — 2026-05-19 decision was to migrate europeLogin off glorylabs.nl; final product domain TBD)

Install cert-manager on k3s:

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml

Create a ClusterIssuer for Let's Encrypt (add ACME email)
Add ingress.tls section to helm/europe-login/values.yaml

10. Fix Flutter mobile CI (currently failing)

The mobile CI job (CI — Mobile) fails because flutter test runs but tests likely fail due to missing platform setup.

Steps:

cd mobile/europe-login-mobile
flutter pub get
flutter test --coverage
Fix any failing tests locally
Commit fixes

11. First production deploy

After all the above:

Merge develop → main via PR
CI builds and pushes ghcr.io/mahmoudholding/europe-login/backend:main
CD workflow auto-deploys to europe-login namespace
Verify: kubectl rollout status deployment/europe-login-backend -n europe-login

Current CI status summary

| Branch / PR | Backend CI | Frontend CI | Notes | |---|---|---|---| | fix/data-contracts (#46) | ✅ passing | ⏳ re-running | — | | fix/psd2-skip-path (#47) | ✅ passing | ⏳ re-running | — | | fix/security (#48) | ✅ passing | ⏳ re-running | — | | fix/edge-cases (#49) | ✅ passing | ⏳ re-running | — | | fix/p2-remaining-issues (#50) | ✅ passing | ⏳ re-running | — | | Mobile CI | ❌ failing | — | Flutter tests need fix (step 10) |

Reacties

Nog geen reacties

Athena — europeLogin/manual-setup-checklist.md