Mega commit

.dockerignore

@@ -1,6 +1,7 @@
-# Applies to builds that use the repo root as their context -- now all three
-# design-tool API images, which are built on lib/stardesign (the shared design
-# core) alongside their own sources. Without this the context would include
+# Applies to builds that use the repo root as their context -- now every
+# design-tool API and frontend image, which are built on lib/stardesign and
+# lib/stardesign-ui (the shared design core and its UI) alongside their own
+# sources. Without this the context would include
 # every sibling project and their node_modules, which is slow and bloats the
 # layer cache.
 
@@ -22,9 +23,14 @@ lib
 !lib/stardesign
 !lib/stardesign-ui
 
-# recovery-calculator and pid-designer now build from the repo root too, so
-# their sources have to reach the context -- but only their own image copies
-# them, and each Dockerfile copies just the subtrees it needs.
+# star-openrocket and pid-designer now build from the repo root too, so their
+# sources have to reach the context -- but only their own image copies them, and
+# each Dockerfile copies just the subtrees it needs.
+
+# star-openrocket's built-model cache: gitignored, and up to hundreds of MB on a
+# machine that has run a build. The image mounts it as a volume instead.
+star-openrocket/cache
+**/.userdata
 
 # Dependencies and build output
 **/node_modules

.env.example

@@ -39,6 +39,17 @@ AUTH_PUBLIC_URL=https://auth.starberkeley.org
 SCHEME=https
 ACME_EMAIL=infra@starberkeley.org
 
+# ── Image version ──────────────────────────────────────────────────────────
+# Which tag of the ghcr.io/calstar/star-* images the stack runs. CI publishes
+# two tags on every push to main: `latest` (moving) and `sha-<short>` (immutable,
+# e.g. sha-abc1234).
+#   unset / latest → track the newest build on main (current default).
+#   sha-<short>    → pin the whole stack to one build; roll back by editing this
+#                    one line and re-running `docker compose … up -d`.
+# Pin to a sha that CI actually published (check the repo's GHCR packages, or the
+# short hash of a commit that ran the publish workflow). See deploy/apps/README.md.
+STAR_IMAGE_TAG=latest
+
 # Only needed with `--profile tunnel`. From the Cloudflare Zero Trust
 # dashboard: Networks → Tunnels → your tunnel → install connector.
 # CLOUDFLARE_TUNNEL_TOKEN=
@@ -76,7 +87,7 @@ ELODIN_DB_HOST_DIR=/home/aidan/.local/share/elodin
 # AWS_ACCESS_KEY_ID=
 # AWS_SECRET_ACCESS_KEY=
 
-# ── Engine Design + Recovery Calculator config versioning (S3) ─────────────
+# ── Engine Design + STAR OpenRocket config versioning (S3) ─────────────────
 # Same model as the P&ID versioning above: per-user design history
 # (microversions + releases) in a versioned S3 bucket, or the local userdata
 # volume when the bucket var is empty. Reuses the AWS_* credentials above. Give
@@ -86,14 +97,14 @@ ELODIN_DB_HOST_DIR=/home/aidan/.local/share/elodin
 # deploy/apps/README.md.
 # ENGINE_S3_BUCKET=star-engine-design
 # ENGINE_S3_PREFIX=engine
-# RECOVERY_S3_BUCKET=star-recovery-calculator
-# RECOVERY_S3_PREFIX=recovery
+# OPENROCKET_S3_BUCKET=star-openrocket
+# OPENROCKET_S3_PREFIX=openrocket
 
 # ── Onshape CM Viewer API key pair ─────────────────────────────────────────
 # Leave empty and the stack still comes up -- cache-first endpoints work; only
 # live Onshape calls (Search / refresh / build) fail until these are set. Get a
 # key pair at https://dev-portal.onshape.com. After filling these in:
-#   docker compose up -d --force-recreate onshape-viewer-api
+#   docker compose up -d --force-recreate star-openrocket-api
 # ONSHAPE_ACCESS_KEY=
 # ONSHAPE_SECRET_KEY=
 # ONSHAPE_BASE_URL=          # optional; only for a non-default Onshape instance