Patrick Plate
ad7f4e2b1c
CI — Build, Lint & Security Scan / backend (push) Failing after 1m54s
CI — Build, Lint & Security Scan / image-scan (push) Has been cancelled
CI — Build, Lint & Security Scan / frontend (push) Has been cancelled
CI — Build, Lint & Security Scan / secrets-scan (push) Has been cancelled
Deploy to TrueNAS / deploy (push) Has been cancelled
New CI workflow (.gitea/workflows/ci.yml) runs on every push to main: - Backend: Maven compile + test + OWASP Dependency-Check (fails on CVSS>=7) - Frontend: pnpm lint + type-check + pnpm audit (fails on High/Critical) - Docker image scan: Trivy for both backend/frontend images (High/Critical) - Secrets detection: Gitleaks full-repo scan Deploy workflow remains independent (self-hosted runner limitation). Both workflows run in parallel on push to main.
CannaManage
Full-stack management platform for German cannabis cultivation associations (Anbauvereinigungen) under the CanG/KCanG regulatory framework.
Tech Stack
| Layer | Technology |
|---|---|
| Frontend | Next.js 15, React 19, TypeScript, Tailwind CSS 4, shadcn/ui |
| Backend | Spring Boot 3.5, Java 17, Spring Security (JWT + session) |
| Database | PostgreSQL 16, Flyway migrations |
| Infrastructure | Docker Compose, Gitea Actions CI/CD, TrueNAS deployment |
Project Structure
cannamanage/
├── cannamanage-api/ # Spring Boot REST API (entry point)
├── cannamanage-service/ # Business logic layer
├── cannamanage-domain/ # JPA entities, enums, value objects
├── cannamanage-frontend/ # Next.js frontend (pnpm)
├── deploy/ # Deployment scripts & nginx config
├── docker-compose.yml # Local development stack
└── .gitea/workflows/ # CI/CD pipeline
Local Development
Prerequisites
- Java 17+
- Maven 3.9+
- Node.js 22+ with pnpm 10+
- Docker & Docker Compose
Backend
# Start PostgreSQL
docker compose up -d db
# Run Spring Boot
mvn spring-boot:run -f cannamanage-api/pom.xml -Dspring-boot.run.profiles=local
Frontend
cd cannamanage-frontend
pnpm install
pnpm dev
The frontend runs on http://localhost:3000, backend on http://localhost:8080.
Full Stack (Docker)
docker compose up --build
Deployment
Push to main triggers the Gitea Actions CI pipeline which:
- Runs backend tests (
mvn test) - Runs frontend lint (
pnpm lint) - Builds Docker images
- Deploys to TrueNAS via Docker Compose
- Verifies backend health + frontend availability
Manual deploy:
cd deploy && ./deploy.sh
Environment Variables
| Variable | Purpose | Default |
|---|---|---|
CANNAMANAGE_SECURITY_JWT_SECRET |
JWT signing key (base64, 256-bit) | — (required) |
CORS_ORIGINS |
Allowed CORS origins (comma-separated) | http://localhost:3000 |
SMTP_HOST / SMTP_PORT |
Mail server for invites | localhost:1025 |
SCHEDULERS_ENABLED |
Enable background jobs | true |
License
Proprietary — Patrick Plate