docs: record safe legacy migration data contract

Reviewed-on: #2

.env.unraid.example

@@ -16,8 +16,8 @@ DJANGO_SECRET_KEY=CHANGE_ME_generate_at_least_50_random_characters
 DJANGO_DEBUG=0
 # Leeg laten tot er een publieke HTTPS-URL is.
 PUBLIC_BASE_URL=
-DJANGO_ALLOWED_HOSTS=192.168.10.150,127.0.0.1,localhost
-DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.10.150:1226,http://127.0.0.1:1226
+DJANGO_ALLOWED_HOSTS=vacatureradar.local,127.0.0.1,localhost
+DJANGO_CSRF_TRUSTED_ORIGINS=http://vacatureradar.local:1226,http://127.0.0.1:1226
 DJANGO_TIME_ZONE=Europe/Brussels
 VACATURERADAR_OWNER_NAME=Jens
 VACATURERADAR_VERSION=0.3.12

.gitea/workflows/managed-validation.yml

@@ -21,6 +21,8 @@ concurrency:
 jobs:
   full:
     name: full
+    # Public fork code must never execute automatically on the private runner.
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:

SECURITY.md

@@ -38,7 +38,8 @@ Deze data mag nooit shell-, netwerk-, e-mail-, bestandssysteem- of sollicitatiea
 
 ## Kwetsbaarheid melden
 
-Maak geen publieke issue met secrets of persoonlijke vacaturegegevens. Documenteer intern:
+Maak geen publieke issue met secrets of persoonlijke vacaturegegevens. Meld een
+kwetsbaarheid privé via `security@itworx.tech` en vermeld:
 
 1. component en versie/commit;
 2. reproduceerbare stappen met synthetische data;

apps/jobs/services/demo_seed.py

@@ -152,6 +152,7 @@ def seed_demo_environment(user) -> None:
         profile.save(update_fields=["is_active"])
 
     now = timezone.now()
+    today = timezone.localdate(now)
     workplace_map = {
         "hybrid": JobPosting.Workplace.HYBRID,
         "remote": JobPosting.Workplace.REMOTE,
@@ -254,7 +255,7 @@ def seed_demo_environment(user) -> None:
             defaults={
                 "status": Application.Status.INTERVIEW,
                 "applied_at": now - timedelta(days=6),
-                "follow_up_date": (now + timedelta(days=2)).date(),
+                "follow_up_date": today + timedelta(days=2),
                 "contact_name": "Sofie Vandael",
                 "contact_email": "sofie.vandael@cloudnexus.example",
                 "notes": "Eerste gesprek gepland. Demo-data.",
@@ -267,7 +268,7 @@ def seed_demo_environment(user) -> None:
             defaults={
                 "status": Application.Status.APPLIED,
                 "applied_at": now - timedelta(days=2),
-                "follow_up_date": (now + timedelta(days=5)).date(),
+                "follow_up_date": today + timedelta(days=5),
                 "notes": "Sollicitatie verstuurd. Demo-data.",
             },
         )

docker-compose.migration.yml

@@ -0,0 +1,34 @@
+# Append after docker-compose.unraid.yml. Operator-only migration prerequisite;
+# every path must be a verified cold clone, never the original live data.
+# Also pass MIGRATION_ENV_FILE as Compose --env-file for interpolation parity.
+name: vacatureradar-managed
+services:
+  app:
+    labels:
+      io.itworx.migration-attempt: ${MIGRATION_ATTEMPT:?journaled migration attempt required}
+    image: ${MIGRATION_IMAGE:?set an attempt-specific candidate image}
+    env_file:
+      - ${VACATURERADAR_ENV_FILE:?set the protected external runtime env file}
+    build:
+      labels:
+        org.opencontainers.image.source: jens/vacatureradar
+        org.opencontainers.image.revision: ${MIGRATION_SOURCE_REVISION:?full verified Git commit required}
+        org.opencontainers.image.source-tree: ${MIGRATION_SOURCE_TREE:?verified Git tree required}
+        org.opencontainers.image.version: ${MIGRATION_BUILD_ID:?broker build ID required}
+        org.opencontainers.image.created: ${MIGRATION_BUILD_DATE:?broker UTC build date required}
+    volumes:
+      - type: bind
+        source: ${MIGRATION_LOCAL_ROOT:?verified cold clone of the complete local tree required}/media
+        target: /app/media
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${MIGRATION_LOCAL_ROOT:?verified cold clone of the complete local tree required}/logs
+        target: /app/logs
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${MIGRATION_LOCAL_ROOT:?verified cold clone of the complete local tree required}
+        target: /app/local
+        bind:
+          create_host_path: false

docs/LEGACY_DEPLOYMENT_MIGRATION.md

@@ -0,0 +1,19 @@
+# Gecontroleerde migratie van legacy deployments
+
+`docker-compose.migration.yml` is een optionele operatoroverride, geen wijziging
+aan de standaarddeployment. Gebruik deze alleen na de expliciete migratieprocedure
+in ProjectBrain `scripts/legacy-deployment-migration/`.
+
+De operator valideert de exacte Git-revisie en imageprovenance, stopt de oude
+container en maakt een gecontroleerde koude kopie van de volledige `local`-map.
+`MIGRATION_LOCAL_ROOT` verwijst uitsluitend naar die kopie. Media, logs en de
+PostgreSQL-data houden hun geneste mountrelatie. De originele data, image en
+container blijven bewaard voor rollback; startupmigraties mogen ze niet wijzigen.
+
+Alle migratievariabelen zijn verplicht, paden worden niet automatisch aangemaakt,
+en een attemptlabel bindt de nieuwe container aan precies één hersteltransactie.
+De operator controleert gemergde Compose-mounts, gezondheid, HTTP en de echte
+brokerreceipt voordat de configuratie definitief wordt overgezet.
+
+De override is offline getest met echte Compose-rendering en ontbrekende
+invoervariabelen. Toevoeging van dit bestand bewijst geen uitgevoerde productiemigratie.

docs/ai/PROJECT_STATE.md

@@ -461,7 +461,7 @@ VR-208-herverificatie op 2026-07-22:
 ## Deploymentstatus
 
 - `main` is via de bestaande Gitea-SSH-sleutel naar `NuklearRabbit/VacatureRadar` gepusht.
-- De applicatie draait op de Unraid-server via `http://192.168.10.150:1226/` als één Dockerman-container; Supervisor bewaakt intern PostgreSQL 17, Redis, web, worker en scheduler.
+- De applicatie draait op de Unraid-server via de geconfigureerde private host en poort `1226` als één Dockerman-container; Supervisor bewaakt intern PostgreSQL 17, Redis, web, worker en scheduler.
 - De Dockerman-tegel gebruikt de lokale VacatureRadar-favicon en opent rechtstreeks de WebUI op poort 1226.
 - De server-side `.env` heeft rechten `0600`; gegenereerde secrets zijn niet naar Git of logs gekopieerd.
 - Historisch bewijs (2026-07-22, inmiddels vervangen): de self-hosted runner was

docs/operations/UNRAID_DEPLOYMENT.md

@@ -105,7 +105,7 @@ Gebruik vanaf een beheerwerkstation altijd een benoemde SSH-hostalias met een af
 
 ```sshconfig
 Host unraid-itworx
-    HostName 192.168.10.150
+    HostName server.example.test
     Port 22
     User root
     IdentityFile ~/.ssh/itworx_unraid_deploy

tests/integration/test_auth_login.py

@@ -145,15 +145,22 @@ def test_demo_login_logs_in_and_seeds_environment(client):
     assert "minstens één import actief" in sources.content.decode("utf-8")
 
 
-def test_demo_login_is_idempotent(client):
-    from datetime import timedelta
+def test_demo_login_is_idempotent(client, monkeypatch):
+    from datetime import UTC, datetime, timedelta
 
     from django.utils import timezone
 
     from apps.jobs.models import Application, JobPosting
+    from apps.jobs.services import demo_seed
     from apps.profiles.models import SearchProfile
     from apps.sources.models import MailboxConnection, Source
 
+    # 22:30 UTC is already the following calendar day in Europe/Brussels.
+    # Freezing this boundary prevents UTC `.date()` calls from creeping back in.
+    near_local_midnight = datetime(2026, 9, 2, 22, 30, tzinfo=UTC)
+    monkeypatch.setattr(demo_seed.timezone, "now", lambda: near_local_midnight)
+    expected_local_day = timezone.localdate(near_local_midnight)
+
     client.post(reverse("demo-login"))
     first = JobPosting.objects.count()
     demo_user = get_user_model().objects.get(username=settings.DEMO_USERNAME)
@@ -172,8 +179,8 @@ def test_demo_login_is_idempotent(client):
     job.refresh_from_db()
     application.refresh_from_db()
     assert job.status == JobPosting.Status.ACTIVE
-    assert job.last_seen.date() == timezone.localdate()
-    assert application.follow_up_date > timezone.localdate()
+    assert timezone.localdate(job.last_seen) == expected_local_day
+    assert application.follow_up_date > expected_local_day
     assert profile.scores.count() == 6
     assert MailboxConnection.objects.filter(user=demo_user, enabled=True).count() == 9
     assert Source.objects.filter(source_type=Source.Type.EMAIL, failure_count=0).count() >= 9

tests/unit/test_public_configuration.py

@@ -49,8 +49,8 @@ def test_configure_public_url_updates_only_public_security_settings(tmp_path: Pa
     env_file.write_text(
         "DJANGO_SECRET_KEY=keep-this-secret\n"
         "POSTGRES_PASSWORD=keep-this-password\n"
-        "DJANGO_ALLOWED_HOSTS=192.168.10.150,localhost\n"
-        "DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.10.150:1226\n",
+        "DJANGO_ALLOWED_HOSTS=vacatureradar.local,localhost\n"
+        "DJANGO_CSRF_TRUSTED_ORIGINS=http://vacatureradar.local:1226\n",
         encoding="utf-8",
     )
 
@@ -67,7 +67,7 @@ def test_configure_public_url_updates_only_public_security_settings(tmp_path: Pa
     assert "DJANGO_DEBUG=0" in content
     assert "vacatureradar.itworx.tech" in content
     assert (
-        "DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.10.150:1226,https://vacatureradar.itworx.tech"
+        "DJANGO_CSRF_TRUSTED_ORIGINS=http://vacatureradar.local:1226,https://vacatureradar.itworx.tech"
     ) in content
     assert "CACHE_URL=redis://127.0.0.1:6379/1" in content
     assert "TRUSTED_PROXY_CIDRS=172.18.0.0/16" in content