chore(release): v1.2.0

.claude/launch.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "dev",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "dev"],
+      "port": 5173
+    }
+  ]
+}

.env.development.example

@@ -1,9 +1,7 @@
 VITE_APP_TITLE="Ocotillo (Dev)"
 VITE_NMBGMR_AMP_API_URL=
-VITE_NMBGMR_GEOTHERMAL_API_URL=
 VITE_OCOTILLO_API_URL=
 VITE_REFINE_PROJECT_ID=
-VITE_MAPBOX_TOKEN=
 VITE_POSTHOG_KEY=
 VITE_POSTHOG_HOST=https://us.i.posthog.com
 VITE_APP_TIMEZONE=America/Denver
@@ -12,3 +10,11 @@ VITE_AUTHENTIK_CLIENT_ID=
 VITE_AUTHENTIK_URL=
 VITE_AUTHENTIK_REDIRECT_URI=
 VITE_TEST_AUTH=true
+
+# Wellntel analytics API (direct access, ported from wellpy)
+VITE_WELLNTEL_API_URL=
+VITE_WELLNTEL_API_KEY=
+
+# Diver-HUB (VanEssen GroundwaterOnline) API
+VITE_DIVERHUB_API_URL=
+VITE_DIVERHUB_API_KEY=

.env.devserver.example

@@ -1,10 +1,8 @@
 VITE_APP_TITLE="Ocotillo"
 VITE_NMBGMR_AMP_API_URL=
-VITE_NMBGMR_GEOTHERMAL_API_URL=
 VITE_OCOTILLO_API_URL=
 VITE_API_URL=
 VITE_REFINE_PROJECT_ID=
-VITE_MAPBOX_TOKEN=
 VITE_POSTHOG_KEY=
 VITE_POSTHOG_HOST=https://us.i.posthog.com
 VITE_APP_ENV=development
@@ -14,3 +12,11 @@ VITE_APP_TIMEZONE=America/Denver
 VITE_AUTHENTIK_CLIENT_ID=
 VITE_AUTHENTIK_URL=
 VITE_AUTHENTIK_REDIRECT_URI=
+
+# Wellntel analytics API (direct access, ported from wellpy)
+VITE_WELLNTEL_API_URL=
+VITE_WELLNTEL_API_KEY=
+
+# Diver-HUB (VanEssen GroundwaterOnline) API
+VITE_DIVERHUB_API_URL=
+VITE_DIVERHUB_API_KEY=

.env.production.example

@@ -1,10 +1,8 @@
 VITE_APP_TITLE="Ocotillo"
 VITE_NMBGMR_AMP_API_URL=
-VITE_NMBGMR_GEOTHERMAL_API_URL=
 VITE_OCOTILLO_API_URL=
 VITE_API_URL=
 VITE_REFINE_PROJECT_ID=
-VITE_MAPBOX_TOKEN=
 VITE_POSTHOG_KEY=
 VITE_POSTHOG_HOST=https://us.i.posthog.com
 VITE_APP_ENV=production
@@ -16,3 +14,11 @@ VITE_APP_TIMEZONE=America/Denver
 VITE_AUTHENTIK_CLIENT_ID=
 VITE_AUTHENTIK_URL=
 VITE_AUTHENTIK_REDIRECT_URI=
+
+# Wellntel analytics API (direct access, ported from wellpy)
+VITE_WELLNTEL_API_URL=
+VITE_WELLNTEL_API_KEY=
+
+# Diver-HUB (VanEssen GroundwaterOnline) API
+VITE_DIVERHUB_API_URL=
+VITE_DIVERHUB_API_KEY=

.github/preview/api-service.tmpl.yaml

@@ -0,0 +1,168 @@
+# Cloud Run service spec for an ephemeral preview backend.
+#
+# This is the docker-compose stack the Cypress job runs (OcotilloAPI "app" +
+# postgis "db") re-expressed as a single multi-container Cloud Run service.
+# Sidecars share a network namespace, so "db" becomes 127.0.0.1:5432.
+#
+# Rendered by _preview_deploy.yml with envsubst and an explicit variable
+# allowlist -- every other $VAR below is meant to be evaluated at runtime by the
+# container shell, not at render time. Render-time placeholders all carry a
+# TPL_ prefix precisely so they cannot collide with a runtime variable:
+# envsubst substitutes $VAR as readily as ${VAR}, so an allowlisted name that
+# also appears in the startup script would get frozen at render time.
+#
+# The database is an in-memory tmpfs. Everything in it is lost when the instance
+# restarts. That is the point: these previews are disposable.
+apiVersion: serving.knative.dev/v1
+kind: Service
+metadata:
+  name: ${TPL_API_SERVICE_NAME}
+  labels:
+    preview: "true"
+    preview-branch: ${TPL_SANITIZED_BRANCH}
+    preview-role: api
+    preview-expires: "${TPL_EXPIRES_AT}"
+  annotations:
+    run.googleapis.com/ingress: all
+spec:
+  template:
+    metadata:
+      annotations:
+        # One always-warm instance: the database lives in that instance's
+        # memory, so scaling to zero or out to two would lose or fork the data.
+        autoscaling.knative.dev/minScale: "1"
+        autoscaling.knative.dev/maxScale: "1"
+        # Postgres needs CPU between requests to run its background workers.
+        run.googleapis.com/cpu-throttling: "false"
+        run.googleapis.com/execution-environment: gen2
+        run.googleapis.com/container-dependencies: '{"api":["db"]}'
+    spec:
+      containerConcurrency: 40
+      timeoutSeconds: 300
+      containers:
+        - name: db
+          image: postgis/postgis:17-3.5
+          env:
+            - name: POSTGRES_USER
+              value: postgres
+            - name: POSTGRES_PASSWORD
+              value: postgres
+            - name: POSTGRES_DB
+              value: ocotillo_preview
+            # PGDATA has to be a subdirectory of the mount: the postgis
+            # entrypoint refuses to initialise into a non-empty directory, and
+            # a fresh mount point is not guaranteed to look empty to it.
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          volumeMounts:
+            - name: pgdata
+              mountPath: /var/lib/postgresql/data
+          resources:
+            limits:
+              cpu: "1"
+              memory: 2Gi
+          startupProbe:
+            tcpSocket:
+              port: 5432
+            periodSeconds: 5
+            # Cloud Run rejects a probe whose timeout exceeds its period.
+            timeoutSeconds: 3
+            failureThreshold: 60
+
+        - name: api
+          image: ${TPL_API_IMAGE}
+          ports:
+            - name: http1
+              containerPort: 8000
+          env:
+            - name: MODE
+              value: development
+            - name: POSTGRES_HOST
+              value: 127.0.0.1
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: POSTGRES_USER
+              value: postgres
+            - name: POSTGRES_PASSWORD
+              value: postgres
+            - name: POSTGRES_DB
+              value: ocotillo_preview
+            - name: AUTHENTIK_DISABLE_AUTHENTICATION
+              value: "${TPL_DISABLE_AUTH}"
+            - name: AUTHENTIK_URL
+              value: https://authentik.newmexicowaterdata.org/application/o/ocotillo/
+            - name: AUTHENTIK_AUTHORIZE_URL
+              value: https://authentik.newmexicowaterdata.org/application/o/authorize/
+            - name: AUTHENTIK_TOKEN_URL
+              value: https://authentik.newmexicowaterdata.org/application/o/token/
+            - name: AUTHENTIK_CLIENT_ID
+              value: "${TPL_AUTHENTIK_CLIENT_ID}"
+            # create_api_app() mounts pygeoapi unconditionally -- the
+            # MOUNT_PYGEOAPI_IN_API flag in OcotilloAPI's app.yaml reads like an
+            # opt-out but no Python reads it. Of these, only the password is
+            # actually required: host/port/db/user each fall back to their
+            # POSTGRES_* equivalent, while the password is checked for None with
+            # no fallback and aborts boot. Set the full block anyway, to match
+            # docker-compose.yml and to keep the next reader out of pygeoapi.py.
+            - name: PYGEOAPI_POSTGRES_HOST
+              value: 127.0.0.1
+            - name: PYGEOAPI_POSTGRES_PORT
+              value: "5432"
+            - name: PYGEOAPI_POSTGRES_DB
+              value: ocotillo_preview
+            - name: PYGEOAPI_POSTGRES_USER
+              value: postgres
+            - name: PYGEOAPI_POSTGRES_PASSWORD
+              value: postgres
+            - name: APP_VERSION
+              value: "${TPL_API_SOURCE_SHA}"
+            - name: RUN_SEED
+              value: "${TPL_RUN_SEED}"
+          # Replaces entrypoint.sh so the seed can run between the migration and
+          # uvicorn. Cloud Run has no exec, so this is the only hook available.
+          command:
+            - sh
+            - -c
+          args:
+            - |
+              set -e
+
+              until PGPASSWORD="$POSTGRES_PASSWORD" pg_isready \
+                    -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" \
+                    -U "$POSTGRES_USER" -d "$POSTGRES_DB"; do
+                echo "Waiting for postgres at $POSTGRES_HOST:$POSTGRES_PORT..."
+                sleep 2
+              done
+
+              echo "Applying migrations..."
+              alembic upgrade head
+
+              if [ "$RUN_SEED" = "true" ]; then
+                echo "Seeding preview database..."
+                # A seed failure leaves an empty-but-working API, which is more
+                # useful for a preview than no API at all.
+                python -m transfers.seed || echo "WARNING: seed failed; continuing with an empty database"
+              fi
+
+              echo "Starting the application..."
+              exec uvicorn main:app --host 0.0.0.0 --port 8000
+          # A preview serves a handful of reviewers, and the expensive part of
+          # startup (migrate + seed) measured in seconds, not minutes. Sized to
+          # keep the always-warm instance cheap rather than fast.
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1536Mi
+          startupProbe:
+            tcpSocket:
+              port: 8000
+            periodSeconds: 10
+            timeoutSeconds: 5
+            # Migration + seed can take several minutes on a cold instance.
+            failureThreshold: 90
+
+      volumes:
+        - name: pgdata
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Gi