chore: bump version to 1.0.2

/app/data is a bind mount, so the chown baked into the image is
overwritten by the host directory's ownership at runtime. On a fresh
prod deploy Docker creates ./data as root-owned, but the container ran
as the non-root nextjs user, so Prisma couldn't open lovelope.db
("unable to open database file").

Add an entrypoint that starts as root, chowns /app/data, then drops to
nextjs via su-exec before running migrations and starting the server.

.env.example

@@ -1,5 +1,5 @@
 # SQLite database file (mounted on a persistent volume in Docker)
-DATABASE_URL="file:/app/data/askedout.db"
+DATABASE_URL="file:/app/data/lovelope.db"
 
 # Public base URL (used in QR codes and share links)
 APP_URL="http://localhost:3000"

Dockerfile

@@ -28,7 +28,7 @@ RUN npm run build
 
 # ── Stage 3: runner ────────────────────────────────────────────────────────────
 FROM node:20-alpine AS runner
-RUN apk add --no-cache libc6-compat openssl
+RUN apk add --no-cache libc6-compat openssl su-exec
 WORKDIR /app
 
 ENV NODE_ENV=production
@@ -48,11 +48,11 @@ COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 
 RUN mkdir -p /app/data && chown nextjs:nodejs /app/data
 
-USER nextjs
+COPY --chmod=755 docker-entrypoint.sh ./docker-entrypoint.sh
 
 EXPOSE 3000
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
 
-# Run migrations then start the server
-CMD ["sh", "-c", "npx prisma migrate deploy && node server.js"]
+# Fix ownership of the bind-mounted /app/data volume, then drop to nextjs
+ENTRYPOINT ["./docker-entrypoint.sh"]

GIT_WORKFLOW.md

@@ -46,23 +46,68 @@ Types: `feat`, `fix`, `refactor`, `style`, `docs`, `chore`, `test`.
 - Never force-push `main`. Force-pushing a feature branch you own (after a
   rebase) is fine; never force-push a branch someone else might be using.
 
-## Tags / releases
+## Releases & Docker images
 
-Tag production releases as `v<major>.<minor>.<patch>` (semver) once this
-project has a deployment cadence worth marking. Not required for every merge.
+CI (`.gitea/workflows/docker-publish.yml`) never builds an image from a
+plain commit or merge to `main`/`master` — only from two deliberate
+triggers, each producing tags on both the Gitea registry and GHCR:
 
-## Docker images
+| Trigger         | Produces                | Purpose                            |
+|------------------|--------------------------|-------------------------------------|
+| push to `dev`    | `:dev`                   | test a build before releasing       |
+| push a `v*` tag  | `:latest` + `:vX.Y.Z`    | ship an actual release               |
 
-CI (`.gitea/workflows/docker-publish.yml`) only builds an image on two
-events, not on every commit:
+### Testing a build (`dev`)
 
-- push to `dev` — builds a rolling `:dev` tag, for testing in-progress work
-  before it's ready to release.
-- push a `v*` tag — builds `:latest` plus the version tag, for actual
-  releases.
+`dev` is a disposable pointer, not a branch with history of its own — it
+should always match `main`/`master` exactly. Bring it up to date and push
+whenever you want a fresh test image:
 
-Push to `dev` when you want a throwaway build to test; tag a release on
-`main`/`master` when you want a real one.
+```
+git checkout dev
+git merge main --ff-only
+git push origin dev
+```
+
+If `dev` has drifted and won't fast-forward (e.g. after a rebase, or a
+commit landed only on `dev` by mistake), reset it instead of merging —
+`dev` has no unique history worth preserving:
+
+```
+git checkout dev
+git reset --hard main
+git push origin dev --force-with-lease
+```
+
+### Shipping a release (tag)
+
+1. Bump the version in `package.json` on `main`/`master` (a plain commit —
+   builds nothing on its own):
+   ```
+   # edit package.json: "version": "X.Y.Z"
+   git add package.json
+   git commit -m "chore: bump version to X.Y.Z"
+   git push origin main
+   ```
+2. Tag that commit and push the tag — this is what actually triggers the
+   release build:
+   ```
+   git tag vX.Y.Z
+   git push origin vX.Y.Z
+   ```
+3. Never move or re-push an existing tag once it's out (it may already be
+   pulled/deployed). If you need to fix something after tagging, bump to
+   the next patch version and tag again instead.
+
+Use `v<major>.<minor>.<patch>` (semver) for tags.
+
+### Required repo secrets/variables (Gitea → Settings → Actions)
+
+- `vars.REGISTRY_HOST` — the Gitea instance hostname (no protocol), used to
+  tag/push to the built-in Gitea container registry.
+- `secrets.REGISTRY_TOKEN` — a Gitea PAT with `write:package` scope.
+- `secrets.GHCR_TOKEN` — a GitHub PAT with `write:packages` scope, used to
+  also push to `ghcr.io`.
 
 ## What not to commit
 

README.md

@@ -21,7 +21,7 @@ services:
     ports:
       - "3000:3000"
     environment:
-      DATABASE_URL: "file:/app/data/askedout.db"
+      DATABASE_URL: "file:/app/data/lovelope.db"
       APP_URL: "http://localhost:3000"
       GIPHY_API_KEY: "${GIPHY_API_KEY:-}"
     volumes:
@@ -35,11 +35,11 @@ Then:
 docker compose up -d
 ```
 
-Open **http://localhost:3000**. Your data lives in `./data/askedout.db` on your machine.
+Open **http://localhost:3000**. Your data lives in `./data/lovelope.db` on your machine.
 
 Want GIF search to work? Grab a free key at [developers.giphy.com](https://developers.giphy.com/), export it as `GIPHY_API_KEY` before running `docker compose up` (or drop it in a `.env` file next to `docker-compose.yml`), then restart. Without it, the app still runs fine, GIF search is just disabled.
 
-Pin a specific version instead of always tracking `latest` by using a release tag, e.g. `ghcr.io/jeangaston/lovelope:v0.1.0`.
+Pin a specific version instead of always tracking `latest` by using a release tag, e.g. `ghcr.io/jeangaston/lovelope:v1.0.0`.
 
 ### Build from source
 
@@ -83,7 +83,7 @@ Browsers never send the part after `#` to any server, so that key never reaches
 
 | Variable | Required | Description |
 |---|---|---|
-| `DATABASE_URL` | ✅ | SQLite file path, default `file:/app/data/askedout.db` works out of the box with Docker |
+| `DATABASE_URL` | ✅ | SQLite file path, default `file:/app/data/lovelope.db` works out of the box with Docker |
 | `APP_URL` | ✅ | Base URL used to build share links, e.g. `http://localhost:3000` |
 | `GIPHY_API_KEY` | optional | Enables GIF search. Free key at [developers.giphy.com](https://developers.giphy.com/), leave blank to disable |
 

docker-compose.yml

@@ -6,7 +6,7 @@ services:
     ports:
       - "3000:3000"
     environment:
-      DATABASE_URL: "file:/app/data/askedout.db"
+      DATABASE_URL: "file:/app/data/lovelope.db"
       APP_URL: "http://localhost:3000"
       NODE_ENV: "development"
       GIPHY_API_KEY: "${GIPHY_API_KEY:-}"

docker-entrypoint.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+set -e
+
+chown -R nextjs:nodejs /app/data
+
+exec su-exec nextjs sh -c "npx prisma migrate deploy && node server.js"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "lovelope",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "private": true,
   "license": "MIT",
   "scripts": {