.env.example

@@ -1,5 +1,5 @@
 PORT=3002
-BASE_URL=https://hl.cast.ph
+BASE_URL=https://ghl.cast.ph
 
 # GHL OAuth
 GHL_CLIENT_ID=

.woodpecker.yml

@@ -1,64 +1,34 @@
 steps:
-  - name: lint
+  - name: build
-    image: golangci/golangci-lint:latest
+    image: golang:1.22-alpine
     commands:
-      - golangci-lint run ./...
+      - go build ./cmd/server/
+
+  - name: vet
+    image: golang:1.22-alpine
+    commands:
+      - go vet ./...
 
   - name: test
-    image: golang:1.26-alpine
+    image: golang:1.22-alpine
     commands:
       - go test ./...
 
-  - name: semgrep
+  - name: docker-build
-    image: semgrep/semgrep:latest
+    image: plugins/docker
-    commands:
-      - >
-        semgrep scan --config auto --error
-        --exclude-rule go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure
-        --exclude-rule go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
-        --exclude-rule go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type
-        --exclude-rule html.security.audit.missing-integrity.missing-integrity
-        .
-    when:
-      - event: [push, pull_request]
-
-  - name: gosec
-    image: golang:1.26-bookworm
-    commands:
-      - go install github.com/securego/gosec/v2/cmd/gosec@latest
-      - gosec -exclude=G120,G706,G101,G115,G203,G124 ./...
-    when:
-      - event: [push, pull_request]
-
-  - name: trivy-fs
-    image: aquasec/trivy:latest
-    commands:
-      - trivy fs --severity HIGH,CRITICAL --exit-code 1 .
-    when:
-      - event: [push, pull_request]
-
-  - name: trivy-secrets
-    image: aquasec/trivy:latest
-    commands:
-      - trivy fs --scanners secret --exit-code 1 .
-    when:
-      - event: [push, pull_request]
-
-  - name: build-and-push
-    image: woodpeckerci/plugin-docker-buildx
     settings:
-      repo: git.sds.dev/cast/cast-ghl-provider
+      repo: registry.sds.dev/cast/cast-ghl-provider
-      registry: git.sds.dev
+      registry: registry.sds.dev
-      tag:
+      tags:
-        - ${CI_COMMIT_SHA:0:8}
         - latest
+        - "${CI_COMMIT_TAG}"
       username:
-        from_secret: registry_user
+        from_secret: docker_username
       password:
-        from_secret: registry_password
+        from_secret: docker_password
     when:
-      - branch: main
+      event: tag
-        event: push
+      ref: refs/tags/v*
 
   - name: deploy
     image: appleboy/drone-ssh
@@ -68,29 +38,11 @@ steps:
       username:
         from_secret: deploy_user
       key:
-        from_secret: deploy_ssh_key
+        from_secret: deploy_key
       script:
-        - bash /opt/cast-ghl-provider/deploy/deploy.sh
+        - cd /opt/cast-ghl-provider
+        - docker compose pull
+        - docker compose up -d --remove-orphans
     when:
-      - branch: main
+      event: tag
-        event: push
+      ref: refs/tags/v*
-
-  - name: notify-telegram
-    image: appleboy/drone-telegram
-    settings:
-      token:
-        from_secret: telegram_bot_token
-      to:
-        from_secret: telegram_chat_id
-      message: >
-        {{#success build.status}}✅{{else}}❌{{/success}} **{{repo.name}}**
-
-        Branch: `{{commit.branch}}`
-
-        Status: **{{build.status}}**
-
-        Commit: `{{commit.message}}`
-
-        {{build.link}}
-    when:
-      - status: [success, failure]

CLAUDE.md

@@ -6,7 +6,7 @@
 
 ## Stack
 
-- **Language:** Go 1.26+
+- **Language:** Go 1.22+
 - **HTTP:** `net/http` (stdlib) + `chi` router (lightweight)
 - **Database:** MongoDB (OAuth token storage)
 - **Mongo driver:** `go.mongodb.org/mongo-driver/v2`
@@ -116,7 +116,7 @@ cast-ghl-provider/
 | Variable | Required | Default | Description |
 |----------|----------|---------|-------------|
 | `PORT` | No | `3002` | Server listen port |
-| `BASE_URL` | Yes | — | Public URL (e.g. `https://hl.cast.ph`) |
+| `BASE_URL` | Yes | — | Public URL (e.g. `https://ghl.cast.ph`) |
 | `GHL_CLIENT_ID` | Yes | — | GHL Marketplace app client ID |
 | `GHL_CLIENT_SECRET` | Yes | — | GHL Marketplace app client secret |
 | `GHL_WEBHOOK_PUBLIC_KEY` | Yes | — | PEM-encoded ECDSA public key for webhook sig |

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.22-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

GHL_API_REFERENCE.md

@@ -243,7 +243,7 @@ Version: 2021-04-15
 
 1. Type: **SMS**
 2. Name: **Cast SMS**
-3. Delivery URL: `https://hl.cast.ph/api/ghl/v1/webhook/messages`
+3. Delivery URL: `https://ghl.cast.ph/api/ghl/v1/webhook/messages`
 4. Do NOT check "Is this a Custom Conversation Provider"
 
 ### Enabling the Provider (per sub-account)

cast-ghl-provider-plan.md

@@ -199,7 +199,7 @@ cast-ghl-provider/
 ```env
 # Server
 PORT=3002
-BASE_URL=https://hl.cast.ph         # Public URL for OAuth redirects + webhooks
+BASE_URL=https://ghl.cast.ph        # Public URL for OAuth redirects + webhooks
 
 # GHL OAuth
 GHL_CLIENT_ID=xxx
@@ -250,7 +250,7 @@ volumes:
 
 - **Host:** Vultr (existing Cast infrastructure)
 - **Reverse proxy:** Nginx or Caddy with HTTPS
-- **Domain:** `hl.cast.ph`
+- **Domain:** `ghl.cast.ph` (or similar)
 - **CI/CD:** Woodpecker CI at `git.sds.dev`
 
 ---

deploy/deploy.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-# deploy.sh — Called by Woodpecker CI on every push to main.
-# Can also be run manually for emergency redeployments.
-# Pulls the latest image from the registry and restarts the stack.
-
-set -euo pipefail
-
-APP_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-cd "$APP_DIR"
-
-echo "==> Pulling latest image from registry"
-docker compose pull bridge
-
-echo "==> Restarting services"
-docker compose up -d --remove-orphans
-
-echo "==> Status"
-sleep 3
-docker compose ps bridge
-
-echo ""
-echo "=== Deploy complete — https://hl.cast.ph/health ==="

docker-compose.yaml

@@ -1,21 +1,12 @@
 services:
   bridge:
-    image: git.sds.dev/cast/cast-ghl-provider:latest
+    build: .
-    build: .  # used only for local dev (docker compose up --build); production uses the registry image
+    ports:
-    # No port binding — nginx-proxy routes traffic via the shared proxy network
+      - "${PORT:-3002}:${PORT:-3002}"
     env_file: .env
-    environment:
-      # nginx-proxy / acme-companion auto-routing
-      - VIRTUAL_HOST=${VIRTUAL_HOST:-hl.cast.ph}
-      - VIRTUAL_PORT=${PORT:-3002}
-      - LETSENCRYPT_HOST=${VIRTUAL_HOST:-hl.cast.ph}
-      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL:-ops@cast.ph}
     depends_on:
       mongo:
-        condition: service_healthy
+        condition: service_started
-    networks:
-      - internal
-      - proxy  # shared nginx-proxy network — must match the nginx-proxy container's network
     restart: unless-stopped
     logging:
       driver: json-file
@@ -25,26 +16,9 @@ services:
 
   mongo:
     image: mongo:7
-    # No ports exposed — only reachable by bridge on the internal network
     volumes:
       - mongo-data:/data/db
-    networks:
-      - internal
     restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 20s
-
-networks:
-  internal:
-    # Private network for bridge ↔ mongo
-  proxy:
-    external: true
-    # Must match the name of the existing nginx-proxy Docker network on the server.
-    # Check with: docker network ls | grep proxy
 
 volumes:
   mongo-data: