cc: CC deployment source-of-truth pinned at v6.2.0 (issue #11)

- docker-compose.cc.yml: pin calcom v6.2.0 + postgres 16-alpine + redis 7-alpine;
  studio + calcom-api off (reserved profiles)
- cc.env.example: CC production env spec (webapp URL, telemetry off, branding)
- cc/README.md: mirror manifest + upstream-merge process

cc.env.example

@@ -0,0 +1,39 @@
+# cal.diy — Commons Computer deployment env (issue #11, cc branch)
+# Template spec for the production `.env`; ansible renders `.env` from the
+# cc-ansible vault (group_vars/cc_apps/vault.yml) — keep the two in sync.
+# Never commit the real `.env`. Generate secrets with:
+#   NEXTAUTH_SECRET=$(openssl rand -base64 32)
+#   CALENDSO_ENCRYPTION_KEY=$(openssl rand -base64 24)
+#   CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -base64 32)
+#   JWT_SECRET=$(openssl rand -base64 32)
+#   POSTGRES_PASSWORD=$(openssl rand -base64 24)
+
+NODE_ENV=production
+NEXT_PUBLIC_WEBAPP_URL=https://cal.commonscomputer.com
+NEXT_PUBLIC_API_V2_URL=
+CALCOM_TELEMETRY_DISABLED=1
+ORGANIZATIONS_ENABLED=false
+ALLOWED_HOSTNAMES='"cal.commonscomputer.com"'
+
+# --- postgres (compose service `database`) ---
+DATABASE_HOST=database
+POSTGRES_USER=caldiy
+POSTGRES_PASSWORD=REPLACE_ME
+POSTGRES_DB=calendso
+DATABASE_URL=postgresql://caldiy:REPLACE_ME@database/calendso
+DATABASE_DIRECT_URL=postgresql://caldiy:REPLACE_ME@database/calendso
+
+# --- auth / encryption ---
+NEXTAUTH_URL=https://cal.commonscomputer.com
+NEXTAUTH_SECRET=REPLACE_ME
+CALENDSO_ENCRYPTION_KEY=REPLACE_ME
+CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=REPLACE_ME
+
+# --- redis (compose service `redis`) ---
+REDIS_URL=redis://redis:6379
+REDIS_PORT=6379
+
+# --- v2 API (calcom-api service; off for v1) ---
+JWT_SECRET=REPLACE_ME
+API_KEY_PREFIX=cal_
+WEB_APP_URL=https://cal.commonscomputer.com

cc/README.md

@@ -0,0 +1,61 @@
+# cc branch — Commons Computer deployment source-of-truth
+
+This repo is the Commons Computer mirror of **`bmann/cal.diy`** (fork of
+`calcom/cal.diy`, MIT community edition of Cal.com). Two branches matter:
+
+| branch | what it is |
+|---|---|
+| `main` | upstream mirror (tracks `bmann/cal.diy` `main`) |
+| `cc` | **deployment source of truth** — pinned at a cal.diy release + CC-specific deploy config |
+
+Pinned release: **v6.2.0** (`1c193cca`, latest cal.diy release at pin time).
+Deployment target: **pve CT 102 "caldiy"** on the Commons Computer Proxmox
+host, Docker Compose (Postgres + Redis + cal.com web), served publicly at
+`cal.commonscomputer.com` behind the Caddy edge. See issue
+[#11](https://git.commonscomputer.com/commonscomputer/cc-ansible/issues/11)
+and the cc-ansible repo (`inventories/production/group_vars/cc_apps/`,
+`playbooks/caldiy-*.yml`) for the runbook.
+
+## What the cc branch carries (vs upstream)
+
+- `docker-compose.cc.yml` — CC compose override: pins the prebuilt image at
+  the current release tag and keeps `studio` (prisma) + `calcom-api` (v2 API)
+  out of the v1 stack. `calcom` still reads runtime config from `.env`.
+- `cc.env.example` — the CC production env template (webapp URL, telemetry
+  off, branding). Ansible renders the real `.env` from vault secrets.
+- `cc/README.md` — this manifest + the upstream-merge process below.
+- No secret is ever committed here; generated secrets live in the cc-ansible
+  ansible-vault (`group_vars/cc_apps/vault.yml`).
+
+## Cutting a new release (upstream-merge process)
+
+cal.diy releases land as tags on `bmann/cal.diy` (and the parent
+`calcom/cal.diy`). To move the CC deployment to a newer stable release:
+
+```sh
+# 1. pull the new release into the mirror (full history not required: depth=1
+#    from the tag is enough to diff trees, but keep history for clean merges)
+git fetch upstream --tags
+
+# 2. ff-merge main up then rebase the cc config on top of the new tag
+git checkout main && git merge --ff-only upstream/main && git push cc main
+git checkout cc
+git rebase --onto v6.2.1 v6.2.0          # or: git merge v6.2.1
+
+# 3. bump the pinned image + update this manifest
+#    - docker-compose.cc.yml: calcom.image tag   -> v6.2.1
+#    - cc/README.md: Pinned release line          -> v6.2.1 (commit ref)
+git add -A && git commit -m "cc: bump to v6.2.1 (issue #11)"
+git push cc cc
+```
+
+Then re-run `playbooks/caldiy-deploy.yml` to pull the new image and migrate.
+
+## Manual deploy (if not using ansible)
+
+```sh
+git clone --branch cc https://git.commonscomputer.com/commonscomputer/cal.diy.git /opt/caldiy
+cd /opt/caldiy
+cp cc.env.example .env   # then fill RELEASE secrets (see generation notes in cc.env.example)
+docker compose -f docker-compose.yml -f docker-compose.cc.yml up -d database redis calcom
+```

docker-compose.cc.yml

@@ -0,0 +1,27 @@
+# cal.diy — Commons Computer deployment override (cc branch, issue #11)
+#
+# Usage (from the cc branch checkout):
+#   docker compose -f docker-compose.yml -f docker-compose.cc.yml up -d database redis calcom
+#   docker compose -f docker-compose.yml -f docker-compose.cc.yml pull calcom
+#
+# Changes vs upstream docker-compose.yml:
+#   1. Pin every image at a CC-known-good tag (cal.com, postgres, redis) —
+#      reproducibility is the point of this branch.
+#   2. Keep `calcom-api` (v2 API) and `studio` (Prisma) OUT of the v1 stack via
+#      a reserved profile — not part of the first cutover (issue #11).
+
+services:
+  database:
+    image: postgres:16-alpine
+
+  redis:
+    image: redis:7-alpine
+
+  calcom:
+    image: calcom.docker.scarf.sh/calcom/cal.diy:v6.2.0
+
+  calcom-api:
+    profiles: ["off"]        # v2 API — add with `--profile api` when needed
+
+  studio:
+    profiles: ["off"]        # prisma studio — never in prod; `docker compose run` to use