fix: change PullImage option to false in deploy workflow

.gitea/workflows/build.yml

@@ -10,7 +10,7 @@ jobs:
     name: Build And Publish Production Image
     runs-on: ubuntu-latest
     env:
-      REGISTRY: gitea.lab:80
+      REGISTRY: gitea.lab
       IMAGE_NAME: sancho41/condado-newsletter
       REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
       REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
@@ -19,6 +19,30 @@ jobs:
         with:
           github-server-url: http://gitea.lab
 
+      - name: Build debug context
+        run: |
+          set -eu
+          echo "Build debug"
+          echo "Repository: ${GITEA_REPOSITORY:-unknown}"
+          echo "Ref: ${GITEA_REF:-unknown}"
+          echo "Sha: ${GITEA_SHA:-unknown}"
+          echo "Runner OS: ${RUNNER_OS:-unknown}"
+          echo "Registry: ${REGISTRY}"
+          echo "Image: ${IMAGE_NAME}"
+          echo "Image latest tag: ${REGISTRY}/${IMAGE_NAME}:latest"
+          echo "Image sha tag: ${REGISTRY}/${IMAGE_NAME}:${GITEA_SHA:-unknown}"
+          echo "HTTP_PROXY=${HTTP_PROXY:-<empty>}"
+          echo "HTTPS_PROXY=${HTTPS_PROXY:-<empty>}"
+          echo "NO_PROXY=${NO_PROXY:-<empty>}"
+
+          if command -v ip >/dev/null 2>&1; then
+            echo "Runner network info:"
+            ip -4 addr show || true
+            ip route || true
+          else
+            hostname -I || true
+          fi
+
       - name: Verify Docker CLI
         run: docker version
 
@@ -27,159 +51,12 @@ jobs:
         run: echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login docker.io -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
      
       - name: Build all-in-one image
-        run: docker build -t condado-newsletter:latest -f Dockerfile.allinone .
-
-      - name: Tag
         run: |
-          docker tag condado-newsletter:latest ${REGISTRY}/${IMAGE_NAME}:latest
+          docker build -t "${IMAGE_NAME}:latest" -f Dockerfile.allinone .
-          docker tag condado-newsletter:latest ${REGISTRY}/${IMAGE_NAME}:${{ github.sha }}
+          # docker tag "${IMAGE_NAME}:latest" "${IMAGE_NAME}:${{ gitea.sha }}"
 
-      - name: Deploy stack via Portainer API
+      - name: Build result debug
-        env:
-          STACK_NAME: codado-newsletter-stack
-          PORTAINER_URL: http://portainer.lab/  
-          PORTAINER_API_KEY: ${{ secrets.PORTAINER_API_KEY }}
-          PORTAINER_ENDPOINT_ID: ${{ secrets.PORTAINER_ENDPOINT_ID }}
         run: |
-          set -u
+          set -eu
-          set +e
+          echo "Listing produced image tags"
-
+          docker image ls "${IMAGE_NAME}" --format 'table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.CreatedSince}}' || true
-          PORTAINER_BASE_URL=$(printf '%s' "${PORTAINER_URL}" | sed -E 's/[[:space:]]+$//; s#/*$##')
-
-          echo "Portainer deploy debug"
-          echo "PORTAINER_URL=${PORTAINER_URL}"
-          echo "PORTAINER_BASE_URL=${PORTAINER_BASE_URL}"
-          echo "STACK_NAME=${STACK_NAME}"
-          echo "PORTAINER_ENDPOINT_ID=${PORTAINER_ENDPOINT_ID}"
-          echo "HTTP_PROXY=${HTTP_PROXY:-<empty>}"
-          echo "HTTPS_PROXY=${HTTPS_PROXY:-<empty>}"
-          echo "NO_PROXY=${NO_PROXY:-<empty>}"
-
-          echo "Current runner network info:"
-          if command -v ip >/dev/null 2>&1; then
-            ip -4 addr show || true
-            ip route || true
-          else
-            hostname -I || true
-          fi
-
-          PORTAINER_HOST=$(printf '%s' "${PORTAINER_BASE_URL}" | sed -E 's#^[a-zA-Z]+://##; s#/.*$##; s/:.*$//')
-          echo "Resolved host target: ${PORTAINER_HOST}"
-
-          PORTAINER_IP=""
-          ACTIVE_PORTAINER_BASE_URL="${PORTAINER_BASE_URL}"
-
-          if command -v getent >/dev/null 2>&1; then
-            echo "Host lookup (getent):"
-            getent hosts "${PORTAINER_HOST}" || true
-            PORTAINER_IP=$(getent hosts "${PORTAINER_HOST}" | awk 'NR==1{print $1}')
-            if [ -n "${PORTAINER_IP}" ]; then
-              PORTAINER_IP_BASE_URL="${PORTAINER_BASE_URL/${PORTAINER_HOST}/${PORTAINER_IP}}"
-              echo "Portainer IP fallback URL: ${PORTAINER_IP_BASE_URL}"
-            fi
-          fi
-
-          STACKS_BODY=$(mktemp)
-          STACKS_ERR=$(mktemp)
-
-          STACKS_HTTP_CODE=$(curl -sS \
-            --noproxy "*" \
-            -o "${STACKS_BODY}" \
-            -w "%{http_code}" \
-            "${ACTIVE_PORTAINER_BASE_URL}/api/stacks" \
-            -H "X-API-Key: ${PORTAINER_API_KEY}" \
-            2>"${STACKS_ERR}")
-          STACKS_CURL_EXIT=$?
-
-          if [ "${STACKS_CURL_EXIT}" -eq 6 ] && [ -n "${PORTAINER_IP:-}" ]; then
-            echo "Retrying GET /api/stacks with IP fallback due to DNS failure"
-            STACKS_HTTP_CODE=$(curl -sS \
-              --noproxy "*" \
-              -o "${STACKS_BODY}" \
-              -w "%{http_code}" \
-              "${PORTAINER_IP_BASE_URL}/api/stacks" \
-              -H "X-API-Key: ${PORTAINER_API_KEY}" \
-              2>"${STACKS_ERR}")
-            STACKS_CURL_EXIT=$?
-            if [ "${STACKS_CURL_EXIT}" -eq 0 ]; then
-              ACTIVE_PORTAINER_BASE_URL="${PORTAINER_IP_BASE_URL}"
-            fi
-          fi
-
-          echo "GET /api/stacks curl exit: ${STACKS_CURL_EXIT}"
-          echo "GET /api/stacks http code: ${STACKS_HTTP_CODE}"
-          echo "GET /api/stacks stderr:"
-          cat "${STACKS_ERR}" || true
-          echo "GET /api/stacks response (sanitized):"
-          jq -r '.[] | "Id=\(.Id) Name=\(.Name) EndpointId=\(.EndpointId)"' "${STACKS_BODY}" || true
-
-          if [ "${STACKS_CURL_EXIT}" -ne 0 ]; then
-            echo "Failed to reach Portainer API while listing stacks."
-            exit "${STACKS_CURL_EXIT}"
-          fi
-
-          if [ "${STACKS_HTTP_CODE}" -lt 200 ] || [ "${STACKS_HTTP_CODE}" -ge 300 ]; then
-            echo "Portainer returned a non-success status for stack listing."
-            exit 1
-          fi
-
-          STACK_ID=$(jq -r --arg stack_name "${STACK_NAME}" '.[] | select(.Name == $stack_name) | .Id' "${STACKS_BODY}" | head -n 1)
-
-          APPLY_BODY=$(mktemp)
-          APPLY_ERR=$(mktemp)
-
-          if [ -n "${STACK_ID}" ]; then
-            echo "Existing stack found with id=${STACK_ID}; sending update request"
-
-            PAYLOAD=$(jq -n \
-              --rawfile stack_file docker-compose.prod.yml \
-              '{StackFileContent: $stack_file, Env: [], Prune: false, PullImage: false}')
-
-            APPLY_HTTP_CODE=$(curl -sS -X PUT \
-              --noproxy "*" \
-              -o "${APPLY_BODY}" \
-              -w "%{http_code}" \
-              "${ACTIVE_PORTAINER_BASE_URL}/api/stacks/${STACK_ID}?endpointId=${PORTAINER_ENDPOINT_ID}" \
-              -H "X-API-Key: ${PORTAINER_API_KEY}" \
-              -H "Content-Type: application/json" \
-              -d "${PAYLOAD}" \
-              2>"${APPLY_ERR}")
-            APPLY_CURL_EXIT=$?
-          else
-            echo "Stack not found; sending create request"
-
-            PAYLOAD=$(jq -n \
-              --arg name "${STACK_NAME}" \
-              --rawfile stack_file docker-compose.prod.yml \
-              '{Name: $name, StackFileContent: $stack_file, Env: [], FromAppTemplate: false}')
-
-            APPLY_HTTP_CODE=$(curl -sS -X POST \
-              --noproxy "*" \
-              -o "${APPLY_BODY}" \
-              -w "%{http_code}" \
-              "${ACTIVE_PORTAINER_BASE_URL}/api/stacks/create/standalone/string?endpointId=${PORTAINER_ENDPOINT_ID}" \
-              -H "X-API-Key: ${PORTAINER_API_KEY}" \
-              -H "Content-Type: application/json" \
-              -d "${PAYLOAD}" \
-              2>"${APPLY_ERR}")
-            APPLY_CURL_EXIT=$?
-          fi
-
-          echo "Apply curl exit: ${APPLY_CURL_EXIT}"
-          echo "Apply http code: ${APPLY_HTTP_CODE}"
-          echo "Apply stderr:"
-          cat "${APPLY_ERR}" || true
-          echo "Apply response body:"
-          cat "${APPLY_BODY}" || true
-
-          if [ "${APPLY_CURL_EXIT}" -ne 0 ]; then
-            echo "Failed to reach Portainer API while applying stack changes."
-            exit "${APPLY_CURL_EXIT}"
-          fi
-
-          if [ "${APPLY_HTTP_CODE}" -lt 200 ] || [ "${APPLY_HTTP_CODE}" -ge 300 ]; then
-            echo "Portainer returned a non-success status while applying stack changes."
-            exit 1
-          fi
-
-          echo "Portainer deploy step completed successfully"

.gitea/workflows/deploy.yml

@@ -0,0 +1,330 @@
+name: Deploy Production Stack
+
+on:
+  workflow_run:
+    workflows: ["Build And Publish Production Image"]
+    types: [completed]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    name: Deploy Stack Via Portainer
+    if: ${{ gitea.event_name == 'workflow_dispatch' || gitea.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    env:
+      STACK_NAME: condado-newsletter-stack
+      PORTAINER_URL: ${{ secrets.PORTAINER_URL }}
+      PORTAINER_API_KEY: ${{ secrets.PORTAINER_API_KEY }}
+      PORTAINER_ENDPOINT_ID: ${{ secrets.PORTAINER_ENDPOINT_ID }}
+      ENV_VARS: ${{ secrets.ENV_VARS }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          github-server-url: http://gitea.lab
+
+      - name: Validate ENV_VARS secret
+        run: |
+          set -eu
+          if [ -z "${ENV_VARS}" ]; then
+            echo "ENV_VARS secret is empty."
+            exit 1
+          fi
+
+      - name: Deploy stack via Portainer API
+        run: |
+          set -u
+          set +e
+
+          if ! command -v curl >/dev/null 2>&1; then
+            echo "curl is not available in this runner image"
+            exit 1
+          fi
+
+          if ! command -v jq >/dev/null 2>&1; then
+            echo "jq is not available in this runner image"
+            exit 1
+          fi
+
+          PORTAINER_BASE_URL=$(printf '%s' "${PORTAINER_URL:-http://portainer.lab/}" | sed -E 's/[[:space:]]+$//; s#/*$##')
+
+          echo "Portainer deploy debug"
+          echo "PORTAINER_URL=${PORTAINER_URL:-http://portainer.lab/}"
+          echo "PORTAINER_BASE_URL=${PORTAINER_BASE_URL}"
+          echo "STACK_NAME=${STACK_NAME}"
+          echo "PORTAINER_ENDPOINT_ID=${PORTAINER_ENDPOINT_ID}"
+          echo "HTTP_PROXY=${HTTP_PROXY:-<empty>}"
+          echo "HTTPS_PROXY=${HTTPS_PROXY:-<empty>}"
+          echo "NO_PROXY=${NO_PROXY:-<empty>}"
+
+          echo "Current runner network info:"
+          if command -v ip >/dev/null 2>&1; then
+            ip -4 addr show || true
+            ip route || true
+          else
+            hostname -I || true
+          fi
+
+          ENV_JSON=$(printf '%s\n' "${ENV_VARS}" | jq -R -s '
+            split("\n")
+            | map(gsub("\r$"; ""))
+            | map(select(length > 0))
+            | map(select(startswith("#") | not))
+            | map(select(test("^[A-Za-z_][A-Za-z0-9_]*=.*$")))
+            | map(capture("^(?<name>[A-Za-z_][A-Za-z0-9_]*)=(?<value>.*)$"))
+            | map({name: .name, value: .value})
+          ')
+
+          echo "Loaded $(printf '%s' "${ENV_JSON}" | jq 'length') env entries from ENV_VARS"
+          echo "ENV names preview:"
+          printf '%s' "${ENV_JSON}" | jq -r '.[0:10][]?.name' || true
+
+          REQUIRED_ENV_KEYS=(
+            APP_PASSWORD
+            JWT_SECRET
+            SPRING_DATASOURCE_USERNAME
+            SPRING_DATASOURCE_PASSWORD
+            APP_RECIPIENTS
+          )
+
+          MISSING_KEYS=()
+          for REQUIRED_KEY in "${REQUIRED_ENV_KEYS[@]}"; do
+            if ! printf '%s' "${ENV_JSON}" | jq -e --arg required_key "${REQUIRED_KEY}" 'map(.name) | index($required_key) != null' >/dev/null; then
+              MISSING_KEYS+=("${REQUIRED_KEY}")
+            fi
+          done
+
+          if [ "${#MISSING_KEYS[@]}" -gt 0 ]; then
+            echo "ENV_VARS is missing required keys: ${MISSING_KEYS[*]}"
+            exit 1
+          fi
+
+          echo "Portainer base URL: ${PORTAINER_BASE_URL}"
+          echo "Target stack: ${STACK_NAME}"
+          echo "Endpoint id set: $([ -n "${PORTAINER_ENDPOINT_ID}" ] && echo yes || echo no)"
+
+          PORTAINER_HOST=$(printf '%s' "${PORTAINER_BASE_URL}" | sed -E 's#^[a-zA-Z]+://##; s#/.*$##; s/:.*$//')
+          PORTAINER_IP=""
+          ACTIVE_PORTAINER_BASE_URL="${PORTAINER_BASE_URL}"
+
+          if command -v getent >/dev/null 2>&1; then
+            PORTAINER_IP=$(getent hosts "${PORTAINER_HOST}" | awk 'NR==1{print $1}')
+            if [ -n "${PORTAINER_IP}" ]; then
+              PORTAINER_IP_BASE_URL="${PORTAINER_BASE_URL/${PORTAINER_HOST}/${PORTAINER_IP}}"
+              echo "Portainer DNS resolved ${PORTAINER_HOST} -> ${PORTAINER_IP}"
+              echo "IP fallback URL: ${PORTAINER_IP_BASE_URL}"
+            else
+              echo "DNS lookup returned no IP for ${PORTAINER_HOST}"
+            fi
+          else
+            echo "getent not available; skipping DNS pre-check"
+          fi
+
+          STACKS_BODY=$(mktemp)
+          STACKS_HEADERS=$(mktemp)
+          STACKS_ERR=$(mktemp)
+
+          STACKS_HTTP_CODE=$(curl -sS \
+            --noproxy "*" \
+            -D "${STACKS_HEADERS}" \
+            -o "${STACKS_BODY}" \
+            -w "%{http_code}" \
+            "${ACTIVE_PORTAINER_BASE_URL}/api/stacks" \
+            -H "X-API-Key: ${PORTAINER_API_KEY}" \
+            2>"${STACKS_ERR}")
+          STACKS_CURL_EXIT=$?
+
+          echo "GET /api/stacks curl exit: ${STACKS_CURL_EXIT}"
+          echo "GET /api/stacks http code: ${STACKS_HTTP_CODE}"
+          echo "GET /api/stacks headers:"
+          cat "${STACKS_HEADERS}" || true
+
+          if [ "${STACKS_CURL_EXIT}" -eq 6 ] && [ -n "${PORTAINER_IP:-}" ]; then
+            echo "Retrying stack list with IP fallback due to DNS failure"
+            STACKS_HTTP_CODE=$(curl -sS \
+              --noproxy "*" \
+              -D "${STACKS_HEADERS}" \
+              -o "${STACKS_BODY}" \
+              -w "%{http_code}" \
+              "${PORTAINER_IP_BASE_URL}/api/stacks" \
+              -H "X-API-Key: ${PORTAINER_API_KEY}" \
+              2>"${STACKS_ERR}")
+            STACKS_CURL_EXIT=$?
+            if [ "${STACKS_CURL_EXIT}" -eq 0 ]; then
+              ACTIVE_PORTAINER_BASE_URL="${PORTAINER_IP_BASE_URL}"
+            fi
+            echo "Retry GET /api/stacks curl exit: ${STACKS_CURL_EXIT}"
+            echo "Retry GET /api/stacks http code: ${STACKS_HTTP_CODE}"
+          fi
+
+          if [ "${STACKS_CURL_EXIT}" -ne 0 ]; then
+            echo "GET /api/stacks stderr:"
+            cat "${STACKS_ERR}" || true
+            exit "${STACKS_CURL_EXIT}"
+          fi
+
+          if [ "${STACKS_HTTP_CODE}" -lt 200 ] || [ "${STACKS_HTTP_CODE}" -ge 300 ]; then
+            echo "GET /api/stacks body:"
+            cat "${STACKS_BODY}" || true
+            exit 1
+          fi
+
+          STACK_ID=$(jq -r --arg stack_name "${STACK_NAME}" '.[] | select(.Name == $stack_name) | .Id' "${STACKS_BODY}" | head -n 1)
+
+          APPLY_BODY=$(mktemp)
+          APPLY_HEADERS=$(mktemp)
+          APPLY_ERR=$(mktemp)
+
+          # If the stack does not exist yet, remove orphan containers with names defined in compose.
+          # This enables an idempotent create-or-recreate flow when old standalone containers exist.
+          if [ -z "${STACK_ID}" ]; then
+            echo "Stack not found in Portainer; checking for orphan containers with conflicting names"
+
+            mapfile -t CONTAINER_NAMES < <(awk '/container_name:/{print $2}' docker-compose.prod.yml | tr -d '"' | sed '/^$/d')
+
+            for CONTAINER_NAME in "${CONTAINER_NAMES[@]}"; do
+              FILTERS=$(jq -cn --arg n "^/${CONTAINER_NAME}$" '{name: [$n]}')
+              FILTERS_URLENC=$(printf '%s' "${FILTERS}" | jq -sRr @uri)
+              LIST_URL="${ACTIVE_PORTAINER_BASE_URL}/api/endpoints/${PORTAINER_ENDPOINT_ID}/docker/containers/json?all=1&filters=${FILTERS_URLENC}"
+
+              LIST_BODY=$(mktemp)
+              LIST_ERR=$(mktemp)
+              LIST_HTTP_CODE=$(curl -sS \
+                --noproxy "*" \
+                -o "${LIST_BODY}" \
+                -w "%{http_code}" \
+                "${LIST_URL}" \
+                -H "X-API-Key: ${PORTAINER_API_KEY}" \
+                2>"${LIST_ERR}")
+              LIST_CURL_EXIT=$?
+
+              echo "Container pre-check [${CONTAINER_NAME}] curl=${LIST_CURL_EXIT} http=${LIST_HTTP_CODE}"
+
+              if [ "${LIST_CURL_EXIT}" -ne 0 ]; then
+                echo "Container pre-check stderr for ${CONTAINER_NAME}:"
+                cat "${LIST_ERR}" || true
+                continue
+              fi
+
+              if [ "${LIST_HTTP_CODE}" -lt 200 ] || [ "${LIST_HTTP_CODE}" -ge 300 ]; then
+                echo "Container pre-check non-success response for ${CONTAINER_NAME}:"
+                cat "${LIST_BODY}" || true
+                continue
+              fi
+
+              mapfile -t MATCHING_IDS < <(jq -r '.[].Id' "${LIST_BODY}")
+              if [ "${#MATCHING_IDS[@]}" -eq 0 ]; then
+                echo "No conflicting container found for ${CONTAINER_NAME}"
+                continue
+              fi
+
+              for CONTAINER_ID in "${MATCHING_IDS[@]}"; do
+                DELETE_URL="${ACTIVE_PORTAINER_BASE_URL}/api/endpoints/${PORTAINER_ENDPOINT_ID}/docker/containers/${CONTAINER_ID}?force=1"
+                DELETE_BODY=$(mktemp)
+                DELETE_ERR=$(mktemp)
+                DELETE_HTTP_CODE=$(curl -sS -X DELETE \
+                  --noproxy "*" \
+                  -o "${DELETE_BODY}" \
+                  -w "%{http_code}" \
+                  "${DELETE_URL}" \
+                  -H "X-API-Key: ${PORTAINER_API_KEY}" \
+                  2>"${DELETE_ERR}")
+                DELETE_CURL_EXIT=$?
+
+                echo "Removed conflicting container ${CONTAINER_NAME} (${CONTAINER_ID}) curl=${DELETE_CURL_EXIT} http=${DELETE_HTTP_CODE}"
+                if [ "${DELETE_CURL_EXIT}" -ne 0 ]; then
+                  echo "Delete stderr:"
+                  cat "${DELETE_ERR}" || true
+                fi
+                if [ "${DELETE_HTTP_CODE}" -lt 200 ] || [ "${DELETE_HTTP_CODE}" -ge 300 ]; then
+                  echo "Delete response body:"
+                  cat "${DELETE_BODY}" || true
+                fi
+              done
+            done
+          fi
+
+          if [ -n "${STACK_ID}" ]; then
+            echo "Updating existing stack id=${STACK_ID}"
+            REQUEST_URL="${ACTIVE_PORTAINER_BASE_URL}/api/stacks/${STACK_ID}?endpointId=${PORTAINER_ENDPOINT_ID}"
+            PAYLOAD=$(jq -n \
+              --rawfile stack_file docker-compose.prod.yml \
+              --argjson env_vars "${ENV_JSON}" \
+              '{StackFileContent: $stack_file, Env: $env_vars, Prune: false, PullImage: false}')
+
+            echo "Apply request URL: ${REQUEST_URL}"
+            echo "Apply payload summary:"
+            printf '%s' "${PAYLOAD}" | jq -r '{stackFileLength: (.StackFileContent | length), envCount: (.Env | length), prune: .Prune, pullImage: .PullImage}' || true
+
+            APPLY_HTTP_CODE=$(curl -sS -X PUT \
+              --noproxy "*" \
+              -D "${APPLY_HEADERS}" \
+              -o "${APPLY_BODY}" \
+              -w "%{http_code}" \
+              "${REQUEST_URL}" \
+              -H "X-API-Key: ${PORTAINER_API_KEY}" \
+              -H "Content-Type: application/json" \
+              -d "${PAYLOAD}" \
+              2>"${APPLY_ERR}")
+            APPLY_CURL_EXIT=$?
+          else
+            echo "Creating new stack ${STACK_NAME}"
+            REQUEST_URL="${ACTIVE_PORTAINER_BASE_URL}/api/stacks/create/standalone/string?endpointId=${PORTAINER_ENDPOINT_ID}"
+            PAYLOAD=$(jq -n \
+              --arg name "${STACK_NAME}" \
+              --rawfile stack_file docker-compose.prod.yml \
+              --argjson env_vars "${ENV_JSON}" \
+              '{Name: $name, StackFileContent: $stack_file, Env: $env_vars, FromAppTemplate: false}')
+
+            echo "Apply request URL: ${REQUEST_URL}"
+            echo "Apply payload summary:"
+            printf '%s' "${PAYLOAD}" | jq -r '{name: .Name, stackFileLength: (.StackFileContent | length), envCount: (.Env | length), fromAppTemplate: .FromAppTemplate}' || true
+
+            APPLY_HTTP_CODE=$(curl -sS -X POST \
+              --noproxy "*" \
+              -D "${APPLY_HEADERS}" \
+              -o "${APPLY_BODY}" \
+              -w "%{http_code}" \
+              "${REQUEST_URL}" \
+              -H "X-API-Key: ${PORTAINER_API_KEY}" \
+              -H "Content-Type: application/json" \
+              -d "${PAYLOAD}" \
+              2>"${APPLY_ERR}")
+            APPLY_CURL_EXIT=$?
+          fi
+
+          echo "Apply curl exit: ${APPLY_CURL_EXIT}"
+          echo "Apply http code: ${APPLY_HTTP_CODE}"
+          echo "Apply response headers:"
+          cat "${APPLY_HEADERS}" || true
+
+          if [ "${APPLY_CURL_EXIT}" -ne 0 ]; then
+            echo "Apply stderr:"
+            cat "${APPLY_ERR}" || true
+            exit "${APPLY_CURL_EXIT}"
+          fi
+
+          if [ "${APPLY_HTTP_CODE}" -lt 200 ] || [ "${APPLY_HTTP_CODE}" -ge 300 ]; then
+            echo "Apply response body:"
+            cat "${APPLY_BODY}" || true
+            echo "Apply response parsed as JSON (if possible):"
+            jq -r '.' "${APPLY_BODY}" 2>/dev/null || echo "<non-json or empty body>"
+
+            if [ ! -s "${APPLY_BODY}" ]; then
+              echo "Apply body is empty; retrying once with verbose curl for diagnostics"
+              curl -v -X "$( [ -n "${STACK_ID}" ] && echo PUT || echo POST )" \
+                --noproxy "*" \
+                -o /tmp/portainer-debug-body.txt \
+                "${REQUEST_URL}" \
+                -H "X-API-Key: ${PORTAINER_API_KEY}" \
+                -H "Content-Type: application/json" \
+                -d "${PAYLOAD}" \
+                2>/tmp/portainer-debug-stderr.txt || true
+              echo "Verbose retry stderr:"
+              cat /tmp/portainer-debug-stderr.txt || true
+              echo "Verbose retry body:"
+              cat /tmp/portainer-debug-body.txt || true
+            fi
+            exit 1
+          fi
+
+          echo "Portainer deploy completed successfully"

Dockerfile.allinone

@@ -29,14 +29,10 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get install -y \
     nginx \
-    postgresql \
     supervisor \
     openjdk-21-jre-headless \
     && rm -rf /var/lib/apt/lists/*
 
-# PostgreSQL data directory
-RUN mkdir -p /var/lib/postgresql/data && chown -R postgres:postgres /var/lib/postgresql
-
 # Copy frontend static files
 COPY --from=frontend-build /app/frontend/dist /usr/share/nginx/html
 

backend/src/main/kotlin/com/condado/newsletter/dto/EntityTaskDtos.kt

@@ -1,6 +1,7 @@
 package com.condado.newsletter.dto
 
 import com.condado.newsletter.model.EntityTask
+import com.condado.newsletter.model.TaskGenerationSource
 import jakarta.validation.constraints.NotBlank
 import jakarta.validation.constraints.NotNull
 import java.time.LocalDateTime
@@ -11,7 +12,8 @@ data class EntityTaskCreateDto(
     @field:NotBlank val name: String,
     val prompt: String,
     @field:NotBlank val scheduleCron: String,
-    @field:NotBlank val emailLookback: String
+    @field:NotBlank val emailLookback: String,
+    val generationSource: TaskGenerationSource = TaskGenerationSource.LLAMA
 )
 
 data class EntityTaskUpdateDto(
@@ -19,7 +21,8 @@ data class EntityTaskUpdateDto(
     @field:NotBlank val name: String,
     @field:NotBlank val prompt: String,
     @field:NotBlank val scheduleCron: String,
-    @field:NotBlank val emailLookback: String
+    @field:NotBlank val emailLookback: String,
+    val generationSource: TaskGenerationSource? = null
 )
 
 data class EntityTaskResponseDto(
@@ -29,6 +32,7 @@ data class EntityTaskResponseDto(
     val prompt: String,
     val scheduleCron: String,
     val emailLookback: String,
+    val generationSource: TaskGenerationSource,
     val active: Boolean,
     val createdAt: LocalDateTime?
 ) {
@@ -41,6 +45,7 @@ data class EntityTaskResponseDto(
                 prompt = task.prompt,
                 scheduleCron = task.scheduleCron,
                 emailLookback = task.emailLookback,
+                generationSource = task.generationSource,
                 active = task.active,
                 createdAt = task.createdAt
             )

backend/src/main/kotlin/com/condado/newsletter/model/EntityTask.kt

@@ -3,6 +3,8 @@ package com.condado.newsletter.model
 import jakarta.persistence.CascadeType
 import jakarta.persistence.Column
 import jakarta.persistence.Entity
+import jakarta.persistence.EnumType
+import jakarta.persistence.Enumerated
 import jakarta.persistence.FetchType
 import jakarta.persistence.GeneratedValue
 import jakarta.persistence.GenerationType
@@ -37,6 +39,10 @@ class EntityTask(
     @Column(name = "email_lookback", nullable = false)
     val emailLookback: String,
 
+    @Enumerated(EnumType.STRING)
+    @Column(name = "generation_source", nullable = false)
+    val generationSource: TaskGenerationSource = TaskGenerationSource.LLAMA,
+
     @Column(nullable = false)
     val active: Boolean = true,
 

backend/src/main/kotlin/com/condado/newsletter/model/TaskGenerationSource.kt

@@ -0,0 +1,19 @@
+package com.condado.newsletter.model
+
+import com.fasterxml.jackson.annotation.JsonCreator
+import com.fasterxml.jackson.annotation.JsonValue
+
+enum class TaskGenerationSource(
+    @get:JsonValue val value: String
+) {
+    OPENAI("openai"),
+    LLAMA("llama");
+
+    companion object {
+        @JvmStatic
+        @JsonCreator
+        fun from(value: String): TaskGenerationSource =
+            entries.firstOrNull { it.value.equals(value, ignoreCase = true) }
+                ?: throw IllegalArgumentException("Invalid generationSource: $value")
+    }
+}

backend/src/main/kotlin/com/condado/newsletter/service/EntityTaskService.kt

@@ -47,6 +47,7 @@ class EntityTaskService(
             prompt = dto.prompt,
             scheduleCron = dto.scheduleCron,
             emailLookback = dto.emailLookback,
+            generationSource = dto.generationSource,
             active = true
         )
 
@@ -66,6 +67,7 @@ class EntityTaskService(
             prompt = dto.prompt,
             scheduleCron = dto.scheduleCron,
             emailLookback = dto.emailLookback,
+            generationSource = dto.generationSource ?: existing.generationSource,
             active = existing.active,
             createdAt = existing.createdAt
         ).apply { id = existing.id }
@@ -83,6 +85,7 @@ class EntityTaskService(
             prompt = existing.prompt,
             scheduleCron = existing.scheduleCron,
             emailLookback = existing.emailLookback,
+            generationSource = existing.generationSource,
             active = false,
             createdAt = existing.createdAt
         ).apply { id = existing.id }
@@ -100,6 +103,7 @@ class EntityTaskService(
             prompt = existing.prompt,
             scheduleCron = existing.scheduleCron,
             emailLookback = existing.emailLookback,
+            generationSource = existing.generationSource,
             active = true,
             createdAt = existing.createdAt
         ).apply { id = existing.id }

backend/src/main/kotlin/com/condado/newsletter/service/JwtService.kt

@@ -14,8 +14,10 @@ import java.util.Date
 @Service
 class JwtService(
     @Value("\${app.jwt.secret}") val secret: String,
-    @Value("\${app.jwt.expiration-ms}") val expirationMs: Long
+    @Value("\${app.jwt.expiration-ms:86400000}") expirationMsRaw: String
 ) {
+    private val expirationMs: Long = expirationMsRaw.toLongOrNull() ?: 86400000L
+
     private val signingKey by lazy {
         Keys.hmacShaKeyFor(secret.toByteArray(Charsets.UTF_8))
     }

backend/src/main/kotlin/com/condado/newsletter/service/TaskGeneratedMessageService.kt

@@ -3,6 +3,7 @@ package com.condado.newsletter.service
 import com.condado.newsletter.dto.GeneratedMessageHistoryResponseDto
 import com.condado.newsletter.dto.TaskPreviewGenerateRequestDto
 import com.condado.newsletter.model.GeneratedMessageHistory
+import com.condado.newsletter.model.TaskGenerationSource
 import com.condado.newsletter.repository.EntityTaskRepository
 import com.condado.newsletter.repository.GeneratedMessageHistoryRepository
 import org.springframework.stereotype.Service
@@ -16,7 +17,8 @@ import java.util.UUID
 class TaskGeneratedMessageService(
     private val generatedMessageHistoryRepository: GeneratedMessageHistoryRepository,
     private val entityTaskRepository: EntityTaskRepository,
-    private val llamaPreviewService: LlamaPreviewService
+    private val llamaPreviewService: LlamaPreviewService,
+    private val aiService: AiService
 ) {
 
     /** Lists persisted generated messages for a task. */
@@ -25,15 +27,19 @@ class TaskGeneratedMessageService(
             .findAllByTask_IdOrderByCreatedAtDesc(taskId)
             .map { GeneratedMessageHistoryResponseDto.from(it) }
 
-    /**
+    /** Generates a new message with the task-selected provider, persists it, and returns it. */
-     * Generates a new message using local Llama, persists it, and returns it.
-     */
     @Transactional
     fun generateAndSave(taskId: UUID, request: TaskPreviewGenerateRequestDto): GeneratedMessageHistoryResponseDto {
         val task = entityTaskRepository.findById(taskId)
             .orElseThrow { IllegalArgumentException("Task not found: $taskId") }
         val prompt = buildPrompt(request)
-        val generatedContent = llamaPreviewService.generate(prompt)
+        val generatedContent = when (task.generationSource) {
+            TaskGenerationSource.LLAMA -> llamaPreviewService.generate(prompt)
+            TaskGenerationSource.OPENAI -> {
+                val parsed = aiService.generate(prompt)
+                "SUBJECT: ${parsed.subject}\nBODY:\n${parsed.body}"
+            }
+        }
         val nextLabel = "Message #${generatedMessageHistoryRepository.countByTask_Id(taskId) + 1}"
 
         val saved = generatedMessageHistoryRepository.save(

backend/src/main/resources/application.yml

@@ -10,7 +10,7 @@ spring:
 
   jpa:
     hibernate:
-      ddl-auto: validate
+      ddl-auto: ${SPRING_JPA_HIBERNATE_DDL_AUTO:validate}
     show-sql: false
     properties:
       hibernate:

backend/src/test/kotlin/com/condado/newsletter/controller/EntityTaskControllerTest.kt

@@ -8,6 +8,7 @@ import com.condado.newsletter.scheduler.EntityScheduler
 import com.condado.newsletter.service.JwtService
 import com.ninjasquad.springmockk.MockkBean
 import jakarta.servlet.http.Cookie
+import org.assertj.core.api.Assertions.assertThat
 import org.junit.jupiter.api.AfterEach
 import org.junit.jupiter.api.Test
 import org.springframework.beans.factory.annotation.Autowired
@@ -15,6 +16,7 @@ import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMock
 import org.springframework.boot.test.context.SpringBootTest
 import org.springframework.http.MediaType
 import org.springframework.test.web.servlet.MockMvc
+import org.springframework.test.web.servlet.request.MockMvcRequestBuilders.put
 import org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post
 import org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath
 import org.springframework.test.web.servlet.result.MockMvcResultMatchers.status
@@ -56,7 +58,8 @@ class EntityTaskControllerTest {
               "name": "Morning Blast",
               "prompt": "",
               "scheduleCron": "0 8 * * 1-5",
-              "emailLookback": "last_week"
+                            "emailLookback": "last_week",
+                            "generationSource": "openai"
             }
         """.trimIndent()
 
@@ -70,5 +73,96 @@ class EntityTaskControllerTest {
             .andExpect(jsonPath("$.entityId").value(entity.id.toString()))
             .andExpect(jsonPath("$.name").value("Morning Blast"))
             .andExpect(jsonPath("$.prompt").value(""))
+            .andExpect(jsonPath("$.generationSource").value("openai"))
+
+        val persisted = entityTaskRepository.findAll().first()
+        assertThat(persisted.generationSource.value).isEqualTo("openai")
+    }
+
+    @Test
+    fun should_updateTaskAndPersistGenerationSource_when_validRequestProvided() {
+        val entity = virtualEntityRepository.save(
+            VirtualEntity(
+                name = "Entity B",
+                email = "entity-b@condado.com",
+                jobTitle = "Ops"
+            )
+        )
+
+        val createdPayload = """
+            {
+              "entityId": "${entity.id}",
+              "name": "Task One",
+              "prompt": "Initial prompt",
+              "scheduleCron": "0 8 * * 1-5",
+              "emailLookback": "last_week",
+              "generationSource": "openai"
+            }
+        """.trimIndent()
+
+        val createdResult = mockMvc.perform(
+            post("/api/v1/tasks")
+                .cookie(authCookie())
+                .contentType(MediaType.APPLICATION_JSON)
+                .content(createdPayload)
+        )
+            .andExpect(status().isCreated)
+            .andReturn()
+
+        val taskId = com.jayway.jsonpath.JsonPath.read<String>(createdResult.response.contentAsString, "$.id")
+
+        val updatePayload = """
+            {
+              "entityId": "${entity.id}",
+              "name": "Task One Updated",
+              "prompt": "Updated prompt",
+              "scheduleCron": "0 10 * * 1-5",
+              "emailLookback": "last_day",
+              "generationSource": "llama"
+            }
+        """.trimIndent()
+
+        mockMvc.perform(
+            put("/api/v1/tasks/$taskId")
+                .cookie(authCookie())
+                .contentType(MediaType.APPLICATION_JSON)
+                .content(updatePayload)
+        )
+            .andExpect(status().isOk)
+            .andExpect(jsonPath("$.name").value("Task One Updated"))
+            .andExpect(jsonPath("$.generationSource").value("llama"))
+
+        val persisted = entityTaskRepository.findById(java.util.UUID.fromString(taskId)).orElseThrow()
+        assertThat(persisted.generationSource.value).isEqualTo("llama")
+    }
+
+    @Test
+    fun should_returnBadRequest_when_generationSourceIsInvalid() {
+        val entity = virtualEntityRepository.save(
+            VirtualEntity(
+                name = "Entity C",
+                email = "entity-c@condado.com",
+                jobTitle = "Ops"
+            )
+        )
+
+        val payload = """
+            {
+              "entityId": "${entity.id}",
+              "name": "Morning Blast",
+              "prompt": "Prompt",
+              "scheduleCron": "0 8 * * 1-5",
+              "emailLookback": "last_week",
+              "generationSource": "invalid-provider"
+            }
+        """.trimIndent()
+
+        mockMvc.perform(
+            post("/api/v1/tasks")
+                .cookie(authCookie())
+                .contentType(MediaType.APPLICATION_JSON)
+                .content(payload)
+        )
+            .andExpect(status().isBadRequest)
     }
 }

backend/src/test/kotlin/com/condado/newsletter/service/AuthServiceTest.kt

@@ -40,7 +40,7 @@ class AuthServiceTest {
     fun should_returnValidClaims_when_jwtTokenParsed() {
         val realJwtService = JwtService(
             secret = "test-secret-key-for-testing-only-must-be-at-least-32-characters",
-            expirationMs = 86400000L
+            expirationMsRaw = "86400000"
         )
         val token = realJwtService.generateToken()
 
@@ -51,7 +51,7 @@ class AuthServiceTest {
     fun should_returnFalse_when_expiredTokenValidated() {
         val realJwtService = JwtService(
             secret = "test-secret-key-for-testing-only-must-be-at-least-32-characters",
-            expirationMs = 1L
+            expirationMsRaw = "1"
         )
         val token = realJwtService.generateToken()
 

backend/src/test/kotlin/com/condado/newsletter/service/JwtServiceTest.kt

@@ -0,0 +1,26 @@
+package com.condado.newsletter.service
+
+import io.jsonwebtoken.Jwts
+import io.jsonwebtoken.security.Keys
+import org.junit.jupiter.api.Assertions.assertTrue
+import org.junit.jupiter.api.Test
+
+class JwtServiceTest {
+
+    private val secret = "12345678901234567890123456789012"
+
+    @Test
+    fun should_generate_token_when_expiration_is_empty() {
+        val jwtService = JwtService(secret, "")
+
+        val token = jwtService.generateToken()
+
+        val claims = Jwts.parser()
+            .verifyWith(Keys.hmacShaKeyFor(secret.toByteArray(Charsets.UTF_8)))
+            .build()
+            .parseSignedClaims(token)
+            .payload
+
+        assertTrue(claims.expiration.after(claims.issuedAt))
+    }
+}

backend/src/test/kotlin/com/condado/newsletter/service/TaskGeneratedMessageServiceTest.kt

@@ -5,6 +5,8 @@ import com.condado.newsletter.dto.TaskPreviewGenerateRequestDto
 import com.condado.newsletter.dto.TaskPreviewTaskDto
 import com.condado.newsletter.model.EntityTask
 import com.condado.newsletter.model.GeneratedMessageHistory
+import com.condado.newsletter.model.ParsedAiResponse
+import com.condado.newsletter.model.TaskGenerationSource
 import com.condado.newsletter.model.VirtualEntity
 import com.condado.newsletter.repository.EntityTaskRepository
 import com.condado.newsletter.repository.GeneratedMessageHistoryRepository
@@ -21,15 +23,17 @@ class TaskGeneratedMessageServiceTest {
     private val generatedMessageHistoryRepository: GeneratedMessageHistoryRepository = mockk()
     private val entityTaskRepository: EntityTaskRepository = mockk()
     private val llamaPreviewService: LlamaPreviewService = mockk()
+    private val aiService: AiService = mockk()
 
     private val service = TaskGeneratedMessageService(
         generatedMessageHistoryRepository = generatedMessageHistoryRepository,
         entityTaskRepository = entityTaskRepository,
-        llamaPreviewService = llamaPreviewService
+        llamaPreviewService = llamaPreviewService,
+        aiService = aiService
     )
 
     @Test
-    fun should_generateAndPersistMessage_when_generateAndSaveCalled() {
+    fun should_useLlamaProvider_when_taskGenerationSourceIsLlama() {
         val taskId = UUID.randomUUID()
         val entity = VirtualEntity(name = "Entity", email = "e@x.com", jobTitle = "Ops").apply { id = UUID.randomUUID() }
         val task = EntityTask(
@@ -37,7 +41,8 @@ class TaskGeneratedMessageServiceTest {
             name = "Task",
             prompt = "Prompt",
             scheduleCron = "0 9 * * 1",
-            emailLookback = "last_week"
+            emailLookback = "last_week",
+            generationSource = TaskGenerationSource.LLAMA
         ).apply { id = taskId }
         val captured = slot<GeneratedMessageHistory>()
 
@@ -59,9 +64,40 @@ class TaskGeneratedMessageServiceTest {
         assertThat(captured.captured.task.id).isEqualTo(taskId)
 
         verify(exactly = 1) { llamaPreviewService.generate(any()) }
+        verify(exactly = 0) { aiService.generate(any()) }
         verify(exactly = 1) { generatedMessageHistoryRepository.save(any()) }
     }
 
+    @Test
+    fun should_useOpenAiProvider_when_taskGenerationSourceIsOpenai() {
+        val taskId = UUID.randomUUID()
+        val entity = VirtualEntity(name = "Entity", email = "e@x.com", jobTitle = "Ops").apply { id = UUID.randomUUID() }
+        val task = EntityTask(
+            virtualEntity = entity,
+            name = "Task",
+            prompt = "Prompt",
+            scheduleCron = "0 9 * * 1",
+            emailLookback = "last_week",
+            generationSource = TaskGenerationSource.OPENAI
+        ).apply { id = taskId }
+        val captured = slot<GeneratedMessageHistory>()
+
+        every { aiService.generate(any()) } returns ParsedAiResponse(subject = "Open Subject", body = "Open Body")
+        every { entityTaskRepository.findById(taskId) } returns java.util.Optional.of(task)
+        every { generatedMessageHistoryRepository.countByTask_Id(taskId) } returns 0
+        every { generatedMessageHistoryRepository.save(capture(captured)) } answers {
+            captured.captured.apply {
+                id = UUID.fromString("00000000-0000-0000-0000-000000000001")
+            }
+        }
+
+        val response = service.generateAndSave(taskId, sampleRequest())
+
+        assertThat(response.content).isEqualTo("SUBJECT: Open Subject\nBODY:\nOpen Body")
+        verify(exactly = 1) { aiService.generate(any()) }
+        verify(exactly = 0) { llamaPreviewService.generate(any()) }
+    }
+
     private fun sampleRequest() = TaskPreviewGenerateRequestDto(
         entity = TaskPreviewEntityDto(
             id = UUID.randomUUID().toString(),

docker-compose.prod.yml

@@ -1,15 +1,42 @@
 services:
+  condado-newsletter-postgres:
+    image: postgres:16
+    container_name: condado-newsletter-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${APP_DB_NAME:-condado}
+      POSTGRES_USER: ${POSTGRES_USER:-condado}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-condado}
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    networks:
+      - default
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -h localhost -U $${POSTGRES_USER:-postgres}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+
   condado-newsletter:
     image: sancho41/condado-newsletter:latest
     container_name: condado-newsletter
     restart: unless-stopped
+    depends_on:
+      condado-newsletter-postgres:
+        condition: service_healthy
+    networks:
+      - external
+      - default
     environment:
       SPRING_PROFILES_ACTIVE: prod
-      SPRING_DATASOURCE_USERNAME: ${SPRING_DATASOURCE_USERNAME}
+      SPRING_JPA_HIBERNATE_DDL_AUTO: ${SPRING_JPA_HIBERNATE_DDL_AUTO:-update}
-      SPRING_DATASOURCE_PASSWORD: ${SPRING_DATASOURCE_PASSWORD}
+      SPRING_DATASOURCE_URL: jdbc:postgresql://condado-newsletter-postgres:5432/${APP_DB_NAME:-condado}
+      SPRING_DATASOURCE_USERNAME: ${SPRING_DATASOURCE_USERNAME:-condado}
+      SPRING_DATASOURCE_PASSWORD: ${SPRING_DATASOURCE_PASSWORD:-condado}
       APP_PASSWORD: ${APP_PASSWORD}
       JWT_SECRET: ${JWT_SECRET}
-      JWT_EXPIRATION_MS: ${JWT_EXPIRATION_MS}
+      JWT_EXPIRATION_MS: ${JWT_EXPIRATION_MS:-86400000}
       MAIL_HOST: ${MAIL_HOST}
       MAIL_PORT: ${MAIL_PORT}
       MAIL_USERNAME: ${MAIL_USERNAME}
@@ -25,16 +52,15 @@ services:
     extra_hosts:
       - "celtinha.desktop:host-gateway"
       - "host.docker.internal:host-gateway"
-    volumes:
-      - postgres-data:/var/lib/postgresql/data
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.condado.rule=Host(`condado-newsletter.lab`)"
       - "traefik.http.services.condado.loadbalancer.server.port=80"
+      - "traefik.docker.network=traefik"
       - "homepage.group=Hyperlink"
       - "homepage.name=Condado Newsletter"
       - "homepage.description=Automated newsletter generator using AI"
-      - "homepage.logo=claude-dark.png"
+      - "homepage.logo=claude-ai.png"
       - "homepage.href=http://condado-newsletter.lab"
 
 volumes:
@@ -42,5 +68,8 @@ volumes:
 
 networks:
   default:
+    driver: bridge
+  
+  external:
     name: traefik
     external: true

docker/entrypoint.sh

@@ -5,28 +5,29 @@ APP_DB_NAME=${APP_DB_NAME:-condado}
 APP_DB_USER=${SPRING_DATASOURCE_USERNAME:-condado}
 APP_DB_PASSWORD=${SPRING_DATASOURCE_PASSWORD:-condado}
 
-# ── Initialise PostgreSQL data directory on first run ─────────────────────────
-if [ ! -f /var/lib/postgresql/data/PG_VERSION ]; then
-    echo "Initialising PostgreSQL data directory..."
-    su -c "/usr/lib/postgresql/16/bin/initdb -D /var/lib/postgresql/data --encoding=UTF8 --locale=C" postgres
-
-    # Start postgres temporarily to create the app database and user
-    su -c "/usr/lib/postgresql/16/bin/pg_ctl -D /var/lib/postgresql/data -w start" postgres
-
-    su -c "psql -v ON_ERROR_STOP=1 -c \"CREATE USER ${APP_DB_USER} WITH PASSWORD '${APP_DB_PASSWORD}';\"" postgres
-    su -c "psql -v ON_ERROR_STOP=1 -c \"CREATE DATABASE ${APP_DB_NAME} OWNER ${APP_DB_USER};\"" postgres
-
-    su -c "/usr/lib/postgresql/16/bin/pg_ctl -D /var/lib/postgresql/data -w stop" postgres
-    echo "PostgreSQL initialised."
-fi
-
 # ── Ensure supervisor log directory exists ────────────────────────────────────
 mkdir -p /var/log/supervisor
 
-# ── Defaults for all-in-one local PostgreSQL ─────────────────────────────────
+# ── Defaults for external PostgreSQL service in production compose ───────────
-export SPRING_DATASOURCE_URL=${SPRING_DATASOURCE_URL:-jdbc:postgresql://localhost:5432/${APP_DB_NAME}}
+export SPRING_DATASOURCE_URL=${SPRING_DATASOURCE_URL:-jdbc:postgresql://condado-newsletter-postgres:5432/${APP_DB_NAME}}
 export SPRING_DATASOURCE_USERNAME=${SPRING_DATASOURCE_USERNAME:-${APP_DB_USER}}
 export SPRING_DATASOURCE_PASSWORD=${SPRING_DATASOURCE_PASSWORD:-${APP_DB_PASSWORD}}
+export JWT_EXPIRATION_MS=${JWT_EXPIRATION_MS:-86400000}
+
+# ── Log all Spring Boot environment variables for debugging ──────────────────
+echo "========================================"
+echo "Spring Boot Configuration:"
+echo "========================================"
+echo "SPRING_DATASOURCE_URL=${SPRING_DATASOURCE_URL}"
+echo "SPRING_DATASOURCE_USERNAME=${SPRING_DATASOURCE_USERNAME}"
+echo "SPRING_DATASOURCE_PASSWORD=${SPRING_DATASOURCE_PASSWORD}"
+echo "JWT_EXPIRATION_MS=${JWT_EXPIRATION_MS}"
+echo "JAVA_OPTS=${JAVA_OPTS:-not set}"
+echo "OPENAI_API_KEY=${OPENAI_API_KEY:-not set}"
+echo "========================================"
 
 # ── Start all services via supervisord ───────────────────────────────────────
+# Export unbuffered output for both Python and Java
+export PYTHONUNBUFFERED=1
+export JAVA_OPTS="${JAVA_OPTS} -Dfile.encoding=UTF-8 -Djava.awt.headless=true"
 exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf

docker/supervisord.conf

@@ -1,21 +1,13 @@
 [supervisord]
 nodaemon=true
+silent=false
 logfile=/dev/stdout
 logfile_maxbytes=0
 pidfile=/var/run/supervisord.pid
-
+loglevel=info
-[program:postgres]
-command=/usr/lib/postgresql/16/bin/postgres -D /var/lib/postgresql/data
-user=postgres
-autostart=true
-autorestart=true
-stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/stderr
-stderr_logfile_maxbytes=0
 
 [program:backend]
-command=java -jar /app/app.jar
+command=java -Dspring.output.ansi.enabled=always -Dlogging.level.root=DEBUG -jar /app/app.jar
 autostart=true
 autorestart=true
 startsecs=15

frontend/src/__tests__/api/tasksApi.test.ts

@@ -39,6 +39,7 @@ const taskOne: EntityTaskResponse = {
   prompt: 'Summarize jokes',
   scheduleCron: '0 9 * * 1',
   emailLookback: 'last_week',
+  generationSource: 'openai',
   active: true,
   createdAt: '2026-03-26T10:00:00Z',
 }
@@ -50,6 +51,7 @@ const taskTwo: EntityTaskResponse = {
   prompt: 'Escalate sandwich policy',
   scheduleCron: '0 11 1 * *',
   emailLookback: 'last_month',
+  generationSource: 'llama',
   active: false,
   createdAt: '2026-03-26T11:00:00Z',
 }
@@ -72,6 +74,7 @@ const previewTask = {
   prompt: 'Draft an absurdly official update about disappearing crackers.',
   scheduleCron: '15 10 * * 2',
   emailLookback: 'last_week' as const,
+  generationSource: 'openai' as const,
 }
 
 describe('tasksApi', () => {
@@ -143,6 +146,7 @@ describe('tasksApi', () => {
       prompt: 'Ask about ceremonial coffee',
       scheduleCron: '0 8 * * 1-5',
       emailLookback: 'last_day',
+      generationSource: 'openai',
     })
 
     expect(createdTask).toEqual(
@@ -157,6 +161,7 @@ describe('tasksApi', () => {
       prompt: 'Ask about ceremonial coffee',
       scheduleCron: '0 8 * * 1-5',
       emailLookback: 'last_day',
+      generationSource: 'openai',
     })
   })
 
@@ -168,6 +173,7 @@ describe('tasksApi', () => {
         prompt: 'Ask about ceremonial coffee',
         scheduleCron: '0 8 * * 1-5',
         emailLookback: 'last_day',
+        generationSource: 'llama',
       },
     })
 
@@ -177,6 +183,7 @@ describe('tasksApi', () => {
       prompt: 'Ask about ceremonial coffee',
       scheduleCron: '0 8 * * 1-5',
       emailLookback: 'last_day',
+      generationSource: 'llama',
     })
 
     expect(updatedTask).toEqual({
@@ -185,6 +192,7 @@ describe('tasksApi', () => {
       prompt: 'Ask about ceremonial coffee',
       scheduleCron: '0 8 * * 1-5',
       emailLookback: 'last_day',
+      generationSource: 'llama',
     })
     expect(mockedApiClient.put).toHaveBeenCalledWith('/v1/tasks/task-1', {
       entityId: 'entity-1',
@@ -192,6 +200,7 @@ describe('tasksApi', () => {
       prompt: 'Ask about ceremonial coffee',
       scheduleCron: '0 8 * * 1-5',
       emailLookback: 'last_day',
+      generationSource: 'llama',
     })
   })
 

frontend/src/__tests__/pages/CreateTaskPage.test.tsx

@@ -50,6 +50,7 @@ describe('CreateTaskPage', () => {
 
     expect(screen.getByLabelText(/task name/i)).toBeInTheDocument()
     expect(screen.queryByLabelText(/task prompt/i)).not.toBeInTheDocument()
+    expect(screen.getByLabelText(/^Generation Source$/i)).toHaveValue('openai')
     expect(screen.getByLabelText(/^Email Period$/i)).toBeInTheDocument()
     expect(screen.getByLabelText(/^Minute$/i)).toBeInTheDocument()
     expect(screen.getByLabelText(/^Hour$/i)).toBeInTheDocument()
@@ -68,6 +69,7 @@ describe('CreateTaskPage', () => {
       prompt: '',
       scheduleCron: '0 8 * * 1-5',
       emailLookback: 'last_week',
+      generationSource: 'openai',
       active: false,
       createdAt: '2026-03-26T10:00:00Z',
     })
@@ -78,6 +80,7 @@ describe('CreateTaskPage', () => {
       prompt: '',
       scheduleCron: '0 8 * * 1-5',
       emailLookback: 'last_week',
+      generationSource: 'openai',
       active: false,
       createdAt: '2026-03-26T10:00:00Z',
     })
@@ -118,6 +121,7 @@ describe('CreateTaskPage', () => {
           prompt: '',
           scheduleCron: '0 8 * * 1-5',
           emailLookback: 'last_week',
+          generationSource: 'openai',
         })
       )
       expect(tasksApi.inactivateTask).toHaveBeenCalledWith('task-2')

frontend/src/__tests__/pages/EditTaskPage.test.tsx

@@ -57,6 +57,7 @@ const mockTask = {
   prompt: 'Summarize jokes',
   scheduleCron: '0 9 * * 1',
   emailLookback: 'last_week' as const,
+  generationSource: 'openai' as const,
   active: true,
   createdAt: '2026-03-26T10:00:00Z',
 }
@@ -77,7 +78,7 @@ describe('EditTaskPage', () => {
     vi.mocked(tasksApi.getTask).mockResolvedValue(mockTask)
     vi.mocked(tasksApi.buildTaskPreviewPrompt).mockImplementation(
       (entity, task) =>
-        `PROMPT FOR ${entity.name}: ${task.name} | ${task.prompt} | ${task.scheduleCron} | ${task.emailLookback}`
+        `PROMPT FOR ${entity.name}: ${task.name} | ${task.prompt} | ${task.scheduleCron} | ${task.emailLookback} | ${task.generationSource}`
     )
     vi.mocked(tasksApi.activateTask).mockResolvedValue({ ...mockTask, active: true })
     vi.mocked(tasksApi.inactivateTask).mockResolvedValue({ ...mockTask, active: false })
@@ -97,6 +98,7 @@ describe('EditTaskPage', () => {
     expect(screen.getByRole('heading', { name: /edit task/i })).toBeInTheDocument()
     expect(screen.getByLabelText(/task name/i)).toHaveValue('Weekly Check-in')
     expect(screen.getByLabelText(/task prompt/i)).toHaveValue('Summarize jokes')
+    expect(screen.getByLabelText(/^Generation Source$/i)).toHaveValue('openai')
     expect(screen.getByLabelText(/^Email Period$/i)).toHaveValue('last_week')
     expect(screen.getByLabelText(/^Minute$/i)).toHaveValue('0')
     expect(screen.getByLabelText(/^Hour$/i)).toHaveValue('9')
@@ -124,6 +126,7 @@ describe('EditTaskPage', () => {
       prompt: 'Ask about ceremonial coffee',
       scheduleCron: '0 8 * * 1-5',
       emailLookback: 'last_day',
+      generationSource: 'llama',
     })
 
     const { queryClient } = renderPage()
@@ -137,13 +140,16 @@ describe('EditTaskPage', () => {
     fireEvent.change(screen.getByLabelText(/^Email Period$/i), {
       target: { value: 'last_day' },
     })
+    fireEvent.change(screen.getByLabelText(/^Generation Source$/i), {
+      target: { value: 'llama' },
+    })
     fireEvent.click(screen.getByRole('button', { name: /Weekdays/i }))
     fireEvent.change(screen.getByLabelText(/^Hour$/i), { target: { value: '8' } })
 
     expect(screen.getByText(/Final Prompt/i)).toBeInTheDocument()
     expect(
       screen.getByText(
-        'PROMPT FOR Entity A: Daily Check-in | Ask about ceremonial coffee | 0 8 * * 1-5 | last_day'
+        'PROMPT FOR Entity A: Daily Check-in | Ask about ceremonial coffee | 0 8 * * 1-5 | last_day | llama'
       )
     ).toBeInTheDocument()
 
@@ -159,6 +165,7 @@ describe('EditTaskPage', () => {
           prompt: 'Ask about ceremonial coffee',
           scheduleCron: '0 8 * * 1-5',
           emailLookback: 'last_day',
+          generationSource: 'llama',
         })
       )
       expect(vi.mocked(tasksApi.generateTaskPreview).mock.calls[0][0]).toEqual('task-1')
@@ -171,6 +178,7 @@ describe('EditTaskPage', () => {
             prompt: 'Ask about ceremonial coffee',
             scheduleCron: '0 8 * * 1-5',
             emailLookback: 'last_day',
+            generationSource: 'llama',
           }),
         })
       )
@@ -186,6 +194,7 @@ describe('EditTaskPage', () => {
         prompt: 'Ask about ceremonial coffee',
         scheduleCron: '0 8 * * 1-5',
         emailLookback: 'last_day',
+        generationSource: 'llama',
       })
       expect(invalidateQueriesSpy).toHaveBeenCalledWith({ queryKey: ['entity-tasks', 'entity-1'] })
       expect(invalidateQueriesSpy).toHaveBeenCalledWith({ queryKey: ['entity-task', 'task-1'] })

frontend/src/__tests__/pages/EntityDetailPage.test.tsx

@@ -120,6 +120,7 @@ describe('EntityDetailPage', () => {
         prompt: 'Summarize jokes',
         scheduleCron: '0 9 * * 1',
         emailLookback: 'last_week',
+        generationSource: 'openai',
         active: true,
         createdAt: '2026-03-26T10:00:00Z',
       },
@@ -165,6 +166,7 @@ describe('EntityDetailPage', () => {
         prompt: 'Archive the sandwich minutes',
         scheduleCron: '0 9 * * 1',
         emailLookback: 'last_week',
+        generationSource: 'llama',
         active: false,
         createdAt: '2026-03-26T10:00:00Z',
       },

frontend/src/api/tasksApi.ts

@@ -2,6 +2,7 @@ import type { VirtualEntityResponse } from './entitiesApi'
 import apiClient from './apiClient'
 
 export type EmailLookback = 'last_day' | 'last_week' | 'last_month'
+export type GenerationSource = 'openai' | 'llama'
 
 export interface EntityTaskResponse {
   id: string
@@ -10,6 +11,7 @@ export interface EntityTaskResponse {
   prompt: string
   scheduleCron: string
   emailLookback: EmailLookback
+  generationSource: GenerationSource
   active: boolean
   createdAt: string
 }
@@ -20,6 +22,7 @@ export interface EntityTaskCreateDto {
   prompt: string
   scheduleCron: string
   emailLookback: EmailLookback
+  generationSource: GenerationSource
 }
 
 export type EntityTaskUpdateDto = EntityTaskCreateDto

frontend/src/pages/CreateTaskPage.tsx

@@ -6,12 +6,14 @@ import {
   createTask,
   inactivateTask,
   type EmailLookback,
+  type GenerationSource,
 } from '../api/tasksApi'
 
 interface TaskFormState {
   name: string
   scheduleCron: string
   emailLookback: EmailLookback
+  generationSource: GenerationSource
 }
 
 interface CronParts {
@@ -72,6 +74,7 @@ const DEFAULT_TASK_FORM: TaskFormState = {
   name: '',
   scheduleCron: buildCron(DEFAULT_CRON_PARTS),
   emailLookback: 'last_week',
+  generationSource: 'openai',
 }
 
 export default function CreateTaskPage() {
@@ -151,6 +154,7 @@ export default function CreateTaskPage() {
               prompt: '',
               scheduleCron: taskForm.scheduleCron,
               emailLookback: taskForm.emailLookback,
+              generationSource: taskForm.generationSource,
             })
           }}
         >
@@ -167,6 +171,26 @@ export default function CreateTaskPage() {
             />
           </div>
 
+          <div>
+            <label htmlFor="task-generation-source" className="text-sm font-medium text-slate-200">
+              Generation Source
+            </label>
+            <select
+              id="task-generation-source"
+              value={taskForm.generationSource}
+              onChange={(event) =>
+                setTaskForm((prev) => ({
+                  ...prev,
+                  generationSource: event.target.value as GenerationSource,
+                }))
+              }
+              className="mt-1 w-full rounded-md border border-slate-700 bg-slate-900 px-3 py-2 text-sm text-slate-100"
+            >
+              <option value="openai">OpenAI</option>
+              <option value="llama">Llama</option>
+            </select>
+          </div>
+
           <div>
             <label htmlFor="task-lookback" className="text-sm font-medium text-slate-200">
               Email Period

frontend/src/pages/DashboardPage.tsx

@@ -23,6 +23,7 @@ export default function DashboardPage() {
       <div>
         <h1 className="text-3xl font-bold text-slate-100">Dashboard</h1>
         <p className="mt-2 text-xs text-slate-400">Version {appVersion}</p>
+        <p className="mt-2 text-xs text-slate-400">Is this the real life?</p>
       </div>
 
       <div className="grid gap-4 md:grid-cols-2">

frontend/src/pages/EditTaskPage.tsx

@@ -13,6 +13,7 @@ import {
   inactivateTask,
   updateTask,
   type EmailLookback,
+  type GenerationSource,
 } from '../api/tasksApi'
 
 interface TaskFormState {
@@ -20,6 +21,7 @@ interface TaskFormState {
   prompt: string
   scheduleCron: string
   emailLookback: EmailLookback
+  generationSource: GenerationSource
 }
 
 interface CronParts {
@@ -97,6 +99,7 @@ const DEFAULT_TASK_FORM: TaskFormState = {
   prompt: '',
   scheduleCron: buildCron(DEFAULT_CRON_PARTS),
   emailLookback: 'last_week',
+  generationSource: 'openai',
 }
 
 async function invalidateTaskQueries(
@@ -164,6 +167,7 @@ export default function EditTaskPage() {
       prompt: task.prompt,
       scheduleCron: task.scheduleCron,
       emailLookback: task.emailLookback,
+      generationSource: task.generationSource,
     })
   }, [task])
 
@@ -175,6 +179,7 @@ export default function EditTaskPage() {
         prompt: data.prompt,
         scheduleCron: data.scheduleCron,
         emailLookback: data.emailLookback,
+        generationSource: data.generationSource,
       }),
     onSuccess: async () => {
       await invalidateTaskQueries(queryClient, entityId, taskId)
@@ -236,8 +241,16 @@ export default function EditTaskPage() {
       prompt: taskForm.prompt,
       scheduleCron: taskForm.scheduleCron,
       emailLookback: taskForm.emailLookback,
+      generationSource: taskForm.generationSource,
     }),
-    [entityId, taskForm.emailLookback, taskForm.name, taskForm.prompt, taskForm.scheduleCron]
+    [
+      entityId,
+      taskForm.emailLookback,
+      taskForm.generationSource,
+      taskForm.name,
+      taskForm.prompt,
+      taskForm.scheduleCron,
+    ]
   )
 
   const finalPrompt = useMemo(() => {
@@ -352,6 +365,26 @@ export default function EditTaskPage() {
             />
           </div>
 
+          <div>
+            <label htmlFor="task-generation-source" className="text-sm font-medium text-slate-200">
+              Generation Source
+            </label>
+            <select
+              id="task-generation-source"
+              value={taskForm.generationSource}
+              onChange={(event) =>
+                setTaskForm((prev) => ({
+                  ...prev,
+                  generationSource: event.target.value as GenerationSource,
+                }))
+              }
+              className="mt-1 w-full rounded-md border border-slate-700 bg-slate-900 px-3 py-2 text-sm text-slate-100"
+            >
+              <option value="openai">OpenAI</option>
+              <option value="llama">Llama</option>
+            </select>
+          </div>
+
           <div>
             <label htmlFor="task-lookback" className="text-sm font-medium text-slate-200">
               Email Period