cc: gate on DB readiness + real healthchecks (start.sh has no set -e and wait-for-it passes mid-initdb)

- database: pg_isready healthcheck; calcom depends_on service_healthy
- calcom: healthcheck probes /auth/login with redirects (upstream wget --spider / fails on 307)

cc.env.example

@@ -0,0 +1,41 @@
+# cal.diy — Commons Computer deployment env (issue #11, cc branch)
+# Template spec for the production `.env`; ansible renders `.env` from the
+# cc-ansible vault (group_vars/cc_apps/vault.yml) — keep the two in sync.
+# Never commit the real `.env`. Generate secrets with:
+#   NEXTAUTH_SECRET=$(openssl rand -hex 32)
+#   CALENDSO_ENCRYPTION_KEY=$(openssl rand -hex 24)
+#   CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -hex 32)
+#   JWT_SECRET=$(openssl rand -hex 32)
+#   POSTGRES_PASSWORD=$(openssl rand -hex 24)
+# IMPORTANT: use HEX for all secrets — compose builds DATABASE_URL from
+# POSTGRES_PASSWORD, so it must be URL-safe (base64 `+`/`/` chars break Prisma).
+
+NODE_ENV=production
+NEXT_PUBLIC_WEBAPP_URL=https://cal.commonscomputer.com
+NEXT_PUBLIC_API_V2_URL=
+CALCOM_TELEMETRY_DISABLED=1
+ORGANIZATIONS_ENABLED=false
+ALLOWED_HOSTNAMES='"cal.commonscomputer.com"'
+
+# --- postgres (compose service `database`; creds also drive DATABASE_URL) ---
+DATABASE_HOST=database
+POSTGRES_USER=caldiy
+POSTGRES_PASSWORD=REPLACE_ME_HEX
+POSTGRES_DB=calendso
+DATABASE_URL=postgresql://caldiy:REPLACE_ME_HEX@database/calendso
+DATABASE_DIRECT_URL=postgresql://caldiy:REPLACE_ME_HEX@database/calendso
+
+# --- auth / encryption ---
+NEXTAUTH_URL=https://cal.commonscomputer.com
+NEXTAUTH_SECRET=REPLACE_ME_HEX
+CALENDSO_ENCRYPTION_KEY=REPLACE_ME_HEX
+CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=REPLACE_ME_HEX
+
+# --- redis (compose service `redis`) ---
+REDIS_URL=redis://redis:6379
+REDIS_PORT=6379
+
+# --- v2 API (calcom-api service; off for v1) ---
+JWT_SECRET=REPLACE_ME_HEX
+API_KEY_PREFIX=cal_
+WEB_APP_URL=https://cal.commonscomputer.com

cc/README.md

@@ -0,0 +1,67 @@
+# cc branch — Commons Computer deployment source-of-truth
+
+This repo is the Commons Computer mirror of **`bmann/cal.diy`** (fork of
+`calcom/cal.diy`, MIT community edition of Cal.com). Two branches matter:
+
+| branch | what it is |
+|---|---|
+| `main` | upstream mirror (tracks `bmann/cal.diy` `main`) |
+| `cc` | **deployment source of truth** — pinned at a cal.diy release + CC-specific deploy config |
+
+Pinned release: **v6.2.0** (`1c193cca`, latest cal.diy release at pin time).
+Deployment target: **pve CT 102 "caldiy"** on the Commons Computer Proxmox
+host, Docker Compose (Postgres + Redis + cal.com web), served publicly at
+`cal.commonscomputer.com` behind the Caddy edge. See issue
+[#11](https://git.commonscomputer.com/commonscomputer/cc-ansible/issues/11)
+and the cc-ansible repo (`inventories/production/group_vars/cc_apps/`,
+`playbooks/caldiy-*.yml`) for the runbook.
+
+## What the cc branch carries (vs upstream)
+
+- `docker-compose.cc.yml` — CC compose override: pins the prebuilt image at
+  the current release tag and keeps `studio` (prisma) + `calcom-api` (v2 API)
+  out of the v1 stack. `calcom` still reads runtime config from `.env`.
+- `cc.env.example` — the CC production env template (webapp URL, telemetry
+  off, branding). Ansible renders the real `.env` from vault secrets.
+- `cc/README.md` — this manifest + the upstream-merge process below.
+- No secret is ever committed here; generated secrets live in the cc-ansible
+  ansible-vault (`group_vars/cc_apps/vault.yml`).
+
+## Cutting a new release (upstream-merge process)
+
+cal.diy releases land as tags on `bmann/cal.diy` (and the parent
+`calcom/cal.diy`). To move the CC deployment to a newer stable release:
+
+```sh
+# 1. pull the new release into the mirror (full history not required: depth=1
+#    from the tag is enough to diff trees, but keep history for clean merges)
+git fetch upstream --tags
+
+# 2. ff-merge main up then rebase the cc config on top of the new tag
+git checkout main && git merge --ff-only upstream/main && git push cc main
+git checkout cc
+git rebase --onto v6.2.1 v6.2.0          # or: git merge v6.2.1
+
+# 3. bump the pinned image + update this manifest
+#    - docker-compose.cc.yml: calcom.image tag   -> v6.2.1
+#    - cc/README.md: Pinned release line          -> v6.2.1 (commit ref)
+git add -A && git commit -m "cc: bump to v6.2.1 (issue #11)"
+git push cc cc
+```
+
+Then re-run `playbooks/caldiy-deploy.yml` to rebuild the image and migrate.
+
+## Manual deploy (if not using ansible)
+
+```sh
+git clone --branch cc https://git.commonscomputer.com/commonscomputer/cal.diy.git /opt/caldiy
+cd /opt/caldiy
+cp cc.env.example .env   # then fill RELEASE secrets (see generation notes in cc.env.example)
+# cal.diy publishes no prebuilt images for releases — build from source:
+docker compose -f docker-compose.yml -f docker-compose.cc.yml build calcom
+docker compose -f docker-compose.yml -f docker-compose.cc.yml up -d database redis calcom
+```
+
+The cal.com build is heavy (~20-40 min on first run: yarn install + Next.js
+production build); give the host 6+ cores / 8 GB RAM (the caldiy CT is sized for
+this). Subsequent builds are fast thanks to the layer cache.

docker-compose.cc.yml

@@ -0,0 +1,59 @@
+# cal.diy — Commons Computer deployment override (cc branch, issue #11)
+#
+# Usage (from the cc branch checkout):
+#   docker compose -f docker-compose.yml -f docker-compose.cc.yml build calcom
+#   docker compose -f docker-compose.yml -f docker-compose.cc.yml up -d database redis calcom
+#
+# Changes vs upstream docker-compose.yml:
+#   1. Pin every image at a CC-known-good tag (cal.com, postgres, redis) —
+#      reproducibility is the point of this branch. NOTE: cal.diy does NOT
+#      publish prebuilt release images (Docker Hub: 0 tags; scarf/ghcr: none),
+#      so `calcom` is BUILT from source; the image: line is the local tag the
+#      build produces (build args come from .env via the base compose file).
+#   2. Keep `calcom-api` (v2 API) and `studio` (Prisma) OUT of the v1 stack via
+#      a reserved profile — not part of the first cutover (issue #11).
+
+services:
+  # The upstream base file hardcodes database creds
+  # (unicorn_user/magical_password) and lets compose build DATABASE_URL from the
+  # raw POSTGRES_PASSWORD — both break with generated secrets. CC override:
+  # database creds come from .env, and DATABASE_URL is built consistently here.
+  # NOTE: passwords in .env MUST be URL-safe (hex) — see cc.env.example.
+  database:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+    healthcheck:
+      # start.sh's wait-for-it passes as soon as the port OPENS (mid-initdb) and
+      # prisma migrate then P1001s; the CC stack gates on a real readiness check.
+      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  redis:
+    image: redis:7-alpine
+
+  calcom:
+    image: calcom.docker.scarf.sh/calcom/cal.diy:v6.2.0
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@database/${POSTGRES_DB}
+      DATABASE_DIRECT_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@database/${POSTGRES_DB}
+    depends_on:
+      database:
+        condition: service_healthy   # start.sh has no `set -e`; gate so its migrate step actually sees a ready DB
+    healthcheck:
+      # upstream image healthcheck uses `wget --spider /` which fails on the
+      # / -> /auth/login 307; probe the login page with redirects instead.
+      test: ["CMD-SHELL", "wget -qO- --max-redirect=5 http://127.0.0.1:3000/auth/login >/dev/null || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+
+  calcom-api:
+    profiles: ["off"]        # v2 API — add with `--profile api` when needed
+
+  studio:
+    profiles: ["off"]        # prisma studio — never in prod; `docker compose run` to use