Skip to content

Changelog

This project does not use tagged releases yet. Deploys happen continuously from main (see Architecture). The history below groups the repository's actual git history by theme.

2026-07-23 — Provider credentials required in production

PR #1 (security/externalize-provider-credentials) merged and deployed. The alots.in SMS and SafeGold API keys are no longer hardcoded anywhere in the source (libs/config/src/app.config.ts, libs/common/src/sms/sms.service.ts); they are read from the environment only. Operator-visible: the backend now fails to boot in production unless SMS_USERNAME, SMS_APIKEY, SAFEGOLD_API_KEY, and SAFEGOLD_GOLD_TOKEN are set in /opt/aim/deploy/.env.production (libs/config/src/validation.schema.ts). A fresh install fills these via deploy/gen-env.sh (__FILL_ME__ slots). The previously-committed keys must still be rotated at the providers.

2026-07-23 — Security hardening

A review pass fixed and deployed several backend/edge issues (ADR 0013):

  • Webhook HMAC checks now verify the raw request body, not a re-serialized one (Razorpay, RazorpayX, KYC).
  • Closed an IDOR on bank-account penny-drop verification (now owner-scoped).
  • Payout retry no longer bypasses the ₹1L ADMIN approval cap.
  • Rate limiting is now actually enforced (global ThrottlerGuard, 100/60 s).
  • Admin API CORS defaults closed instead of allow-all.
  • /metrics returns 404 publicly (still scraped internally).

Separately, provider credentials (alots.in SMS, SafeGold) were moved out of source into env-only, required in production — see the entry below.

2026-07-23 — CI/CD, admin portal, monitoring, migrations

The repository went from "manually deployed snapshot" to a fully automated platform in one day (commits 7a3cb8d..1addd3c):

  • CI/CD: GitHub Actions workflows build Docker images, push them to GHCR (ghcr.io/aimgoldorg/*), and deploy to the production VPS over SSH (docker compose pull + restart, health-check verified). Deploys are serialized on the server with flock; SSH scripts fail fast (set -e).
  • Admin portal recovered: the digigold-admin Next.js app (previously only on the old server) was brought into the repo, given a Build Tools page (pipeline status + deploy buttons backed by the new admin-api devops module) and a View Monitoring link, and deployed at admin.aimgold.org.
  • Monitoring committed + migrated: the Grafana/Prometheus/Loki/Tempo/Alloy stack moved into git and onto the production VPS at monitor.aimgold.org.
  • Schema now migration-managed: DB_SYNCHRONIZE turned off in production. The three never-executed migrations were squashed into a generated InitialSchema migration; prod was baselined with migration:run --fake after a schema-diff proved equivalence. The backend deploy workflow now takes a pg_dump backup and runs pending migrations before restarting.
  • Domain consolidation: everything moved to aimgold.org (aimgold.org/www website, api, admin-api, admin, monitor). All references to the retired aimstoreorg.com domain and the old server (187.127.130.205) were purged, including the legacy aim-digigold-real/infra/ deployment tooling.
  • Cleanup: removed a stray 8.5 MB compiled binary (aim-backend/), removed the website's unused package-lock.json (builds use Bun), restored the backend's lost .eslintrc.js, added .dockerignore.

2026-07-21 — Repository created

  • 9dc09ea — initial import of the AIM GOLD projects from the internal aim-code monorepo (source snapshot only; no history carried over).
  • 4a9bf54 — website styling pass across shop, trade, and transactions pages.
  • da0e461 — first version of the deploy/ stack for the new VPS.