Add docker-compose.yml for deploying upaas (closes #223)

The compose file builds the image from this repo, mounts the Docker
socket and HOST_DATA_DIR (passed to upaas as UPAAS_HOST_DATA_DIR),
reads settings from .env, and restarts unless stopped. The port is
published on 127.0.0.1 only, for a TLS-terminating proxy in front.
PORT and UPAAS_DATA_DIR are pinned so .env cannot move upaas off the
port mapping, the healthcheck (busybox wget) or the data mount.

upaas now refuses to start when UPAAS_HOST_DATA_DIR is set to a
relative path; when unset it still falls back to the data directory.

The README's plain-HTTP Compose example becomes a short deploy section
that points at the file. .env is added to .dockerignore.

Model: opus-5-5

README.md

@@ -191,24 +191,17 @@ This ensures the main branch always contains clean, tested, working code.
 
 Environment variables:
 
-| Variable                 | Description                                                                                                                                                                                              | Default                                           |
+| Variable               | Description                                                                                                                                                            | Default                                                  |
-| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
+| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
-| `PORT`                   | HTTP listen port. `UPAAS_PORT` is also read and wins when both are set.                                                                                                                                  | 8080                                              |
+| `PORT`                 | HTTP listen port                                                                                                                                                       | 8080                                                     |
-| `UPAAS_DATA_DIR`         | Directory for the SQLite database, session key, builds and deployment logs. Deploys need it to be an absolute path unless `UPAAS_HOST_DATA_DIR` is set.                                                  | `./data` (the Docker image sets `/var/lib/upaas`) |
+| `UPAAS_DATA_DIR`       | Data directory for SQLite and keys                                                                                                                                     | `./data` (local dev only — use absolute path for Docker) |
-| `UPAAS_HOST_DATA_DIR`    | Host path of `UPAAS_DATA_DIR`, needed when upaas runs in a container so the bind mounts it passes to Docker point at the right host directory. When set, it must be absolute, or upaas refuses to start. | the value of `UPAAS_DATA_DIR`                     |
+| `UPAAS_HOST_DATA_DIR`  | Host path for DATA_DIR (when running in container)                                                                                                                     | _(none — must be set to an absolute path)_               |
-| `UPAAS_DOCKER_HOST`      | Docker daemon address                                                                                                                                                                                    | unix:///var/run/docker.sock                       |
+| `UPAAS_DOCKER_HOST`    | Docker socket path                                                                                                                                                     | unix:///var/run/docker.sock                              |
-| `UPAAS_PLAINTEXT_HTTP`   | Set when µPaaS is reached over plain HTTP (no TLS-terminating proxy in front) so CSRF origin checks use `http://`. Leave unset behind a TLS-terminating reverse proxy.                                   | false                                             |
+| `UPAAS_PLAINTEXT_HTTP` | Set when µPaaS is reached over plain HTTP (no TLS-terminating proxy in front) so CSRF origin checks use `http://`. Leave unset behind a TLS-terminating reverse proxy. | false                                                    |
-| `UPAAS_DEBUG`            | Enable debug logging. Also sends the session cookie without the `Secure` flag.                                                                                                                           | false                                             |
+| `DEBUG`                | Enable debug logging                                                                                                                                                   | false                                                    |
-| `UPAAS_SENTRY_DSN`       | Read but not used: upaas sends nothing to Sentry                                                                                                                                                         | ""                                                |
+| `SENTRY_DSN`           | Sentry error reporting DSN                                                                                                                                             | ""                                                       |
-| `UPAAS_METRICS_USERNAME` | When set, `/metrics` is served behind basic auth with this username. When unset, there is no `/metrics`.                                                                                                 | ""                                                |
+| `METRICS_USERNAME`     | Basic auth for /metrics                                                                                                                                                | ""                                                       |
-| `UPAAS_METRICS_PASSWORD` | Basic auth password for `/metrics`                                                                                                                                                                       | ""                                                |
+| `METRICS_PASSWORD`     | Basic auth for /metrics                                                                                                                                                | ""                                                       |
-| `UPAAS_MAINTENANCE_MODE` | Only shown as `maintenanceMode` in the `/health` response; it blocks nothing                                                                                                                             | false                                             |
-| `UPAAS_SESSION_SECRET`   | Key that signs the session and CSRF cookies. When unset, a random key is generated once and kept in `$UPAAS_DATA_DIR/session.key`.                                                                       | ""                                                |
-| `UPAAS_CORS_ORIGINS`     | Comma-separated origins allowed to make cross-origin requests with cookies. When unset, no CORS headers are sent.                                                                                        | ""                                                |
-
-The Docker client also reads the standard `DOCKER_API_VERSION`,
-`DOCKER_CERT_PATH` and `DOCKER_TLS_VERIFY` variables; `UPAAS_DOCKER_HOST`, which
-has a default, always overrides `DOCKER_HOST`.
 
 ## Running with Docker
 
@@ -237,11 +230,10 @@ HOST_DATA_DIR=/srv/upaas/data
 ```
 
 Other settings from [Configuration](#configuration) go in the same file, except
-`PORT`, `UPAAS_PORT` and `UPAAS_DATA_DIR`: the compose file sets both port
+`PORT` and `UPAAS_DATA_DIR`: the compose file sets them to 8080 and
-settings to 8080 and `UPAAS_DATA_DIR` to `/var/lib/upaas`, overriding `.env`, to
+`/var/lib/upaas`, overriding `.env`, to match its port mapping, healthcheck and
-match its port mapping, healthcheck and data directory mount. Then run
+data directory mount. Then run `docker compose up -d` from the repo root;
-`docker compose up -d` from the repo root; `docker compose ps` shows the
+`docker compose ps` shows the container as healthy once `/health` answers.
-container as healthy once `/health` answers.
 
 **Important**: `HOST_DATA_DIR` **must** be an **absolute path** on the host. It
 is bind-mounted into the container and passed as `UPAAS_HOST_DATA_DIR` so that

TODO.md

@@ -20,28 +20,6 @@ regress.
 
 # Completed Steps
 
-- 2026-09-29: The app page shows the app's branch as a label in its title, next
-  to the status badge, instead of after the repository under it; the app list
-  shows the Branch column right after Name and scrolls sideways on narrow
-  screens instead of cutting columns off (#240).
-
-- 2026-09-29: `docker-compose.yml` now sets `UPAAS_PORT` to 8080 as well as
-  `PORT`, since upaas reads `UPAAS_PORT` first and a `UPAAS_PORT` in `.env` made
-  it listen away from the port mapping and healthcheck; the README's Compose
-  section names both (#230).
-
-- 2026-09-29: The README Configuration table now lists every setting upaas
-  reads, adding `UPAAS_MAINTENANCE_MODE`, `UPAAS_SESSION_SECRET` and
-  `UPAAS_CORS_ORIGINS`, and gives the real default and effect of each:
-  `UPAAS_PORT` wins over `PORT`, `UPAAS_HOST_DATA_DIR` falls back to
-  `UPAAS_DATA_DIR`, `UPAAS_DEBUG` drops the session cookie's `Secure` flag, and
-  `UPAAS_SENTRY_DSN` is not used (#229).
-
-- 2026-09-28: The README Configuration table now names `UPAAS_DEBUG`,
-  `UPAAS_SENTRY_DSN`, `UPAAS_METRICS_USERNAME` and `UPAAS_METRICS_PASSWORD`, the
-  names upaas actually reads (the unprefixed names it listed were ignored), and
-  the `UPAAS_HOST_DATA_DIR` row refers to `UPAAS_DATA_DIR` (#224).
-
 - 2026-09-28: Added `docker-compose.yml` for deploying upaas: settings from
   `.env`, the port published on `127.0.0.1` only for a TLS proxy in front, and a
   healthcheck against `/health`; the README's plain-HTTP Compose example is

docker-compose.yml

@@ -7,11 +7,9 @@ services:
     # Every line of .env is passed to upaas as an environment variable.
     env_file: .env
     environment:
-      # Override any PORT or UPAAS_PORT in .env, so upaas listens where the
+      # Overrides any PORT in .env, so upaas listens where the port mapping
-      # port mapping and healthcheck below expect it. Both are set because
+      # and healthcheck below expect it.
-      # upaas reads UPAAS_PORT first.
       PORT: "8080"
-      UPAAS_PORT: "8080"
       # Overrides any UPAAS_DATA_DIR in .env, so the database stays on the
       # HOST_DATA_DIR mount below instead of inside the container.
       UPAAS_DATA_DIR: /var/lib/upaas

internal/handlers/app_branch_test.go

@@ -1,76 +0,0 @@
-package handlers_test
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"sneak.berlin/go/upaas/internal/service/app"
-)
-
-// TestAppBranchIsShown checks that an app's branch can be read from the app
-// page title and from the app list without opening the edit page.
-func TestAppBranchIsShown(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	createdApp, err := testCtx.appSvc.CreateApp(t.Context(), app.CreateAppInput{
-		Name:    "branch-shown-app",
-		RepoURL: "git@example.com:user/branch-shown-app.git",
-		Branch:  "staging",
-	})
-	require.NoError(t, err)
-
-	t.Run("in the app page title next to the status badge", func(t *testing.T) {
-		t.Parallel()
-
-		request := httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, "/apps/"+createdApp.ID, nil,
-		)
-		request = addChiURLParams(request, map[string]string{"id": createdApp.ID})
-		recorder := httptest.NewRecorder()
-
-		testCtx.handlers.HandleAppDetail().ServeHTTP(recorder, request)
-
-		require.Equal(t, http.StatusOK, recorder.Code)
-
-		// The title row runs from the app name heading to the end of its div.
-		_, afterHeading, found := strings.Cut(recorder.Body.String(), "<h1")
-		require.True(t, found, "app page has no heading")
-
-		titleRow, _, _ := strings.Cut(afterHeading, "</div>")
-		assert.Contains(t, titleRow, `x-text="statusLabel"`)
-		assert.Contains(t, titleRow, ">staging</span>")
-	})
-
-	t.Run("in the app list before the repository", func(t *testing.T) {
-		t.Parallel()
-
-		request := httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, "/", nil,
-		)
-		recorder := httptest.NewRecorder()
-
-		testCtx.handlers.HandleDashboard().ServeHTTP(recorder, request)
-
-		require.Equal(t, http.StatusOK, recorder.Code)
-
-		_, afterRowStart, found := strings.Cut(
-			recorder.Body.String(), `<tr class="table-row-hover">`,
-		)
-		require.True(t, found, "app list has no row for the app")
-
-		row, _, _ := strings.Cut(afterRowStart, "</tr>")
-		branchAt := strings.Index(row, ">staging</td>")
-		repoAt := strings.Index(row, createdApp.RepoURL)
-
-		require.NotEqual(t, -1, branchAt, "branch missing from the app's row")
-		require.NotEqual(t, -1, repoAt, "repository missing from the app's row")
-		assert.Less(t, branchAt, repoAt, "branch should come before repository")
-	})
-}

templates/app_detail.html

@@ -26,12 +26,11 @@
     <!-- Header -->
     <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4 mb-8">
         <div>
-            <div class="flex flex-wrap items-center gap-3">
+            <div class="flex items-center gap-3">
                 <h1 class="text-2xl font-medium text-gray-900">{{.App.Name}}</h1>
                 <span x-bind:class="statusBadgeClass" x-text="statusLabel"></span>
-                <span class="badge-neutral font-mono break-all" title="Branch">{{.App.Branch}}</span>
             </div>
-            <p class="text-gray-500 font-mono text-sm mt-1">{{.App.RepoURL}}</p>
+            <p class="text-gray-500 font-mono text-sm mt-1">{{.App.RepoURL}}@{{.App.Branch}}</p>
         </div>
         <div class="flex gap-3">
             <a href="/apps/{{.App.ID}}/edit" class="btn-secondary">Edit</a>

templates/dashboard.html

@@ -21,13 +21,12 @@
 
     {{if .AppStats}}
     <div class="card overflow-hidden">
-        <div class="overflow-x-auto">
         <table class="table">
             <thead class="table-header">
                 <tr>
                     <th>Name</th>
-                    <th>Branch</th>
                     <th>Repository</th>
+                    <th>Branch</th>
                     <th>Status</th>
                     <th>Last Deploy</th>
                     <th>Deploys</th>
@@ -42,8 +41,8 @@
                             {{.App.Name}}
                         </a>
                     </td>
-                    <td class="text-gray-500">{{.App.Branch}}</td>
                     <td class="text-gray-500 font-mono text-xs">{{.App.RepoURL}}</td>
+                    <td class="text-gray-500">{{.App.Branch}}</td>
                     <td>
                         {{if eq .App.Status "running"}}
                         <span class="badge-success">Running</span>
@@ -79,7 +78,6 @@
                 {{end}}
             </tbody>
         </table>
-        </div>
     </div>
     {{else}}
     <div class="card">