v0.4.0 — Staging Environment

Fourth release of the infra repository: the Staging Environment, plus the self-hosted registry and TLS-fronted Jenkins it depends on.

Added

• Private Docker Registry (docker/registry/) - self-hosted, htpasswd-authenticated, TLS-terminated; deliberately no Docker Hub/GHCR dependency
• ssl/obtain-cert.sh - shared Let's Encrypt (webroot) / self-signed certificate helper, domain-parametrized, used by every TLS-terminating service in this repo
• Jenkins fronted by TLS-terminating Nginx (jenkins/nginx.conf) - GitHub webhooks now have a real HTTPS endpoint; Jenkins no longer publishes a host port directly
• vars/standardDeployPipeline.groovy's Docker Build stage now also pushes to the private registry (registryUrl/registryCredentialsId params)
• Staging/production app stack (docker/app/): Nginx + PostgreSQL + Next.js + .NET API deployed as one unit - first real use of the base + docker-compose.staging.yml/docker-compose.production.yml override pattern decided back at v0.1.0
• nginx/app.conf: TLS termination, gzip, security headers, /api/ routed to the .NET API, everything else to Next.js

Fixed

• ShellCheck CI job now scans all **/*.sh repo-wide instead of only scripts/**/*.sh
• Added .gitattributes forcing LF line endings - Windows git was about to ship shell scripts with CRLF, which breaks the shebang on the Linux hosts this repo targets

Notes

• App images (nextjs, dotnet-api) are pulled from the private registry, never built in this repo, per the app/infra separation principle - healthchecks assume conventional ports/paths (3000, /health) until the real app images exist to confirm against
• Postgres backup/restore automation is out of scope here - that's v0.6.0 (Operations)

What's next

v0.5.0 - Production Environment (Oracle Cloud deployment, hardened Nginx, real production config, healthchecks).

Full changelog: CHANGELOG.md