initial commit

plan/12-build-order.md

@@ -0,0 +1,59 @@
+# Build order — one commit per task
+
+Dependency-ordered. Each numbered item = one git commit. `main` currently has
+**zero commits**; item 0 is the baseline. Operational steps (pre-bake, capture,
+acceptance test) need internet/hardware and are NOT commits — marked `[ops]`.
+
+> Commit message convention: Conventional Commits, scope = service. Footer:
+> `Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>`.
+
+## Phase 0 — baseline
+0. `chore: baseline scaffolding` — existing untracked tree (CLAUDE.md, plan/,
+   current docker-compose.yml, extras/, .gitignore, .env.example).
+
+## Phase 1 — config foundation
+1. `feat(env): add BASE_DOMAIN + HOST_LAN_IP to .env.example`
+2. `feat(tooling): add render-config.sh (envsubst, halt on unset var)`
+
+## Phase 2 — DNS + ingress (no app yet, but the backbone)
+3. `feat(dnsmasq): add dnsmasq.conf.tmpl (wildcard *.BASE_DOMAIN)`
+4. `feat(caddy): add Caddyfile (apex + auth + packwiz vhosts)`
+5. `feat(compose): add dnsmasq + caddy services + network aliases`
+
+## Phase 3 — auth
+6. `feat(drasl): add config.toml.tmpl (password login, SignPublicKeys=false)`
+7. `refactor(compose): drasl internal-only behind caddy; authlib URL → auth.`
+
+## Phase 4 — modpack
+8. `feat(pack): packwiz init + initial mod curation`
+9. `feat(tooling): add mirror-mods.sh (vendor jars + rewrite .pw.toml URLs)`
+10. `refactor(compose): minecraft via PACKWIZ_URL; extras→runtime`
+
+## Phase 5 — landing
+11. `feat(landing): Astro+TS onboarding site → www/` (files already drafted)
+12. `chore(landing): wire logo + .gitignore for www/ + build output`
+
+## Phase 6 — launcher distribution
+13. `feat(tooling): add fetch-launcher.sh (all platforms + stable symlinks)`
+
+## Phase 7 — full client air-gap (chosen path, plan/11)
+14. `feat(tooling): add mirror-airgap.sh (capture + fetch + sha1 verify)`
+15. `feat(dnsmasq): add air-gap spoof records for upstream hosts`
+16. `feat(caddy): add tls internal vhosts for upstream mirror hosts`
+
+## Phase 8 — backups + orchestration
+17. `feat(compose): add mc-backup service (RCON, 6h)`
+18. `feat(tooling): add build-stack.sh orchestrator`
+
+## Phase 9 — operational (no commits)
+- [ops] Run `build-stack.sh --prep` online: render configs, build landing,
+  mirror mods, mirror air-gap, fetch launcher, **pre-bake** server volume.
+- [ops] Offline acceptance test: clean machine, internet cut, LAN DNS = dnsmasq,
+  Caddy CA trusted → install Fjord, import pack, join.
+- [ops] If green: tag `v1-lan-ready`.
+
+## Notes
+- Items 3–5 can be smoke-tested (`docker compose up dnsmasq caddy`) before later
+  phases exist — Caddy serves a 404/landing, dnsmasq resolves.
+- Items 14–16 depend on a working online launch to capture the URL set first.
+- Each commit should leave the tree in a non-broken state (compose still parses).