docs+ci: final wording fixes (restore TL;DR, crypt-key note, overlay allow-list comment)

- Makefile restore TL;DR: files/ + config/ tarballs (not uploads/storage); drop orphan test-glpi .PHONY entry
- lint.yml + bin/compose-file.sh: clarify GLPI .env secrets / shipped overlays
- migration runbook: clearer 'crypt key is a file, not an env var' note

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>

Author: CybotTM

.github/workflows/lint.yml

@@ -60,7 +60,8 @@ jobs:
         run: |
           cp .env.example .env
           # supply just-good-enough placeholders so validation passes
-          # (GLPI has no APP_KEY — its crypt key is generated on first boot)
+          # (GLPI's only .env secrets are the DB passwords; its crypt key is
+          # minted on first boot inside the glpi-config volume)
           sed -i \
             -e 's/^GLPI_DB_PASSWORD=$/GLPI_DB_PASSWORD=ci-placeholder/' \
             -e 's/^DB_ROOT_PASSWORD=$/DB_ROOT_PASSWORD=ci-placeholder/' \

Makefile

@@ -191,8 +191,8 @@ restore: ## Print pointer to the disaster-recovery runbook (not automated)
 	@printf '         runbook step by step:\n\n'
 	@printf '           docs/runbook-restore.md\n\n'
 	@printf '         TL;DR: stop app+scheduler, pick a dump from the backups volume,\n'
-	@printf '         drop+recreate the database, gunzip | mariadb, restore uploads/\n'
-	@printf '         and storage/ tarballs, then `make restart`.\n'
+	@printf '         drop+recreate the database, gunzip | mariadb, restore the\n'
+	@printf '         files/ and config/ tarballs, then `make restart`.\n'
 
 clean: ## DESTRUCTIVE: down + delete ALL volumes (db + uploads + backups)
 	@read -r -p "This deletes ALL data — the database, uploads AND the backups volume. Type 'yes' to proceed: " ans; \
@@ -202,7 +202,7 @@ clean: ## DESTRUCTIVE: down + delete ALL volumes (db + uploads + backups)
 .PHONY: \
 	help init up down restart logs logs-app ps \
 	backup backup-list backup-verify \
-	health test test-image test-glpi test-bats hardening-check \
+	health test test-image test-bats hardening-check \
 	dev build lint pull upgrade \
 	shell console restore clean \
 	overlays \

bin/compose-file.sh

@@ -60,8 +60,7 @@ case "$action" in
     for p in "$@"; do
       # Allow-list the overlays this stack actually ships — anything else is
       # either a typo or someone wiring an untrusted compose file into the
-      # stack. GLPI has no built-in error tracking, so (unlike the Snipe-IT
-      # sibling) there is deliberately no bugsink/sentry overlay here.
+      # stack. The shipped overlays are traefik, caddy and observability.
       case "$p" in
         examples/compose.traefik.yml|examples/compose.caddy.yml|examples/compose.observability.yml) ;;
         *) echo "compose-file: unknown overlay (allowed: traefik, caddy, observability): $p" >&2; exit 1 ;;

docs/migration-from-upstream-single-container.md

@@ -139,8 +139,9 @@ Edit `.env`. The values that matter for a migration:
   DB + config restored, the entrypoint detects the existing install and runs
   `database:update` instead.
 - `TZ`, `GLPI_HTTP_PORT`, `GLPI_HOST` — set to taste.
-- There is **no `APP_KEY`** here — GLPI's encryption key is the
-  `glpicrypt.key` *file* you're migrating, not an env var.
+- GLPI's encryption key is **not** an env var — it is the `glpicrypt.key`
+  *file* you're migrating (see above). There is nothing crypto-related to set
+  in `.env`.
 
 Leave the `make init` DB passwords as they are; we adopt the bundled `db`
 service and rewrite the restored `config_db.php` to match it during cutover.

tests/bin/compose-file.bats

@@ -10,9 +10,8 @@
 # (sibling under bin/), so the fake repo includes both scripts.
 #
 # The accepted overlay allow-list is exactly: traefik, caddy,
-# observability. GLPI has no built-in error tracking, so (unlike the
-# Snipe-IT sibling) there is no bugsink/sentry overlay — those are
-# rejected even when the file exists.
+# observability. Any other examples/compose.*.yml path is rejected by the
+# allow-list — even when the file exists on disk.
 
 load test_helper
 
@@ -116,15 +115,14 @@ setup() {
   ! grep -q '^COMPOSE_FILE=' .env
 }
 
-@test "compose-file add: rejects a dropped overlay (bugsink) even if the file exists" {
-  # The bugsink overlay is intentionally NOT in the allow-list (GLPI has no
-  # built-in error tracking). The allow-list check runs before the file
-  # stat, so this is rejected even though setup_fake_repo created the file.
-  [ -f examples/compose.bugsink.yml ]
-  run ./bin/compose-file.sh add examples/compose.bugsink.yml
-  [ "$status" -eq 1 ]
-  [[ "$output" == *"unknown overlay"* ]]
-  ! grep -q '^COMPOSE_FILE=' .env
+@test "compose-file add: accepts the observability overlay" {
+  # observability is one of the three allow-listed overlays — adding it must
+  # succeed and append it to COMPOSE_FILE. (The "file exists but not
+  # allow-listed → rejected" path is covered by the examples/random.yml test
+  # below.)
+  run ./bin/compose-file.sh add examples/compose.observability.yml
+  [ "$status" -eq 0 ]
+  grep -qx 'COMPOSE_FILE=compose.yml:examples/compose.observability.yml' .env
 }
 
 @test "compose-file add: rejects an allow-listed overlay whose file is missing" {

tests/bin/test_helper.bash

@@ -13,10 +13,7 @@
 #   ├── examples/
 #   │   ├── compose.caddy.yml           (empty placeholder, accepted overlay)
 #   │   ├── compose.observability.yml   (empty placeholder, accepted overlay)
-#   │   ├── compose.traefik.yml         (empty placeholder, accepted overlay)
-#   │   └── compose.bugsink.yml         (empty placeholder, DROPPED overlay —
-#   │                                    present only to prove the allow-list
-#   │                                    rejects it even when the file exists)
+#   │   └── compose.traefik.yml         (empty placeholder, accepted overlay)
 #   └── .env                  ← mode 0600, optional seed content
 #
 # Both helpers `cd "$(dirname "$0")/.."` to the repo root before
@@ -66,14 +63,11 @@ setup_fake_repo() {
   cp "$REAL_BIN/compose-file.sh" "$BATS_TEST_TMPDIR/bin/compose-file.sh"
   chmod +x "$BATS_TEST_TMPDIR/bin/"*.sh
 
-  # Touch the three overlay files compose-file.sh accepts, plus a bugsink
-  # file representing the deliberately-dropped overlay (so a test can prove
-  # it is rejected by the allow-list even though the file exists). Empty
-  # content is fine — the script only stats these, never reads them.
+  # Touch the three overlay files compose-file.sh accepts. Empty content is
+  # fine — the script only stats these, never reads them.
   : > "$BATS_TEST_TMPDIR/examples/compose.caddy.yml"
   : > "$BATS_TEST_TMPDIR/examples/compose.observability.yml"
   : > "$BATS_TEST_TMPDIR/examples/compose.traefik.yml"
-  : > "$BATS_TEST_TMPDIR/examples/compose.bugsink.yml"
 
   # Seed .env. umask 077 ensures the file is born at 0600 even before
   # the explicit chmod below — mirrors init.sh.