fix: migration order

* docs: add migrate service to self hosting guide

* chore: remove build from readme compose

.github/workflows/docker-publish.yml

@@ -26,6 +26,7 @@ env:
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
+  MIGRATE_IMAGE_NAME: ${{ github.repository }}-migrate
 
 jobs:
   build:
@@ -85,6 +86,19 @@ jobs:
             type=semver,pattern={{major}}
             type=raw,value=latest,enable={{is_default_branch}}
 
+      - name: Extract Docker metadata (migrate)
+        id: meta-migrate
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.MIGRATE_IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
       # Extract version from git tag or ref
       # Uses git describe to get latest tag + commit hash in SemVer format: 1.2.3+abc1234
       - name: Extract version
@@ -138,6 +152,22 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Build and push migrate Docker image
+        id: build-and-push-migrate
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
+        with:
+          context: .
+          file: apps/web/Dockerfile
+          target: migrate
+          push: ${{ github.event_name != 'pull_request' }}
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta-migrate.outputs.tags }}
+          labels: ${{ steps.meta-migrate.outputs.labels }}
+          build-args: |
+            APP_VERSION=${{ steps.version.outputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       # Sign the resulting Docker image digest except on PRs.
       # This will only write to the public Rekor transparency log when the Docker
       # repository is public to avoid leaking data.  If you would like to publish
@@ -152,3 +182,10 @@ jobs:
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
         run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
+
+      - name: Sign the published migrate Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          TAGS: ${{ steps.meta-migrate.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push-migrate.outputs.digest }}
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

README.md

@@ -57,39 +57,61 @@ The easiest way to deploy Kan is through Railway. We've partnered with Railway t
 
 ### Docker Compose
 
-Alternatively, you can self-host Kan with Docker Compose. This will set up everything for you including your postgres database.
+Alternatively, you can self-host Kan with Docker Compose. This will set up everything for you including your postgres database and automatically run migrations.
 
-1. Create a new file called `docker-compose.yml` and paste the following configuration:
+1. Create a `.env` file with your environment variables (see [Environment Variables](#environment-variables-) section below)
+
+2. Use the provided `docker-compose.yml` file or create your own with the following configuration:
 
 ```yaml
 services:
+  migrate:
+    image: ghcr.io/kanbn/kan-migrate:latest
+    container_name: kan-migrate
+    networks:
+      - kan-network
+    environment:
+      - POSTGRES_URL=${POSTGRES_URL}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: "no"
+
   web:
     image: ghcr.io/kanbn/kan:latest
     container_name: kan-web
     ports:
-      - "3000:3000"
+      - "${WEB_PORT:-3000}:3000"
     networks:
       - kan-network
+    env_file:
+      - .env
     environment:
-      NEXT_PUBLIC_BASE_URL: http://localhost:3000
-      BETTER_AUTH_SECRET: your_auth_secret
-      POSTGRES_URL: postgresql://kan:your_postgres_password@postgres:5432/kan_db
-      NEXT_PUBLIC_ALLOW_CREDENTIALS: true
+      - NEXT_PUBLIC_BASE_URL=${NEXT_PUBLIC_BASE_URL}
+      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
+      - POSTGRES_URL=${POSTGRES_URL}
+      - NEXT_PUBLIC_ALLOW_CREDENTIALS=true
     depends_on:
-      - postgres
+      migrate:
+        condition: service_completed_successfully
     restart: unless-stopped
 
   postgres:
     image: postgres:15
     container_name: kan-db
     environment:
-      POSTGRES_DB: kan_db
-      POSTGRES_USER: kan
-      POSTGRES_PASSWORD: your_postgres_password
+      - POSTGRES_DB=kan_db
+      - POSTGRES_USER=kan
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
     ports:
       - 5432:5432
     volumes:
       - kan_postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U kan -d kan_db"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
     restart: unless-stopped
     networks:
       - kan-network
@@ -101,23 +123,23 @@ volumes:
   kan_postgres_data:
 ```
 
-2. Start the containers in detached mode:
+3. Start the containers in detached mode:
 
 ```bash
 docker compose up -d
 ```
 
-3. Access Kan at http://localhost:3000
+The `migrate` service will automatically run database migrations before the web service starts. The application will be available at http://localhost:3000 (or the port specified in `WEB_PORT`).
 
-The application will be running in the background. You can manage the containers using these commands:
+**Managing containers:**
 
 - To stop the containers: `docker compose down`
 - To view logs: `docker compose logs -f`
+- To view logs for a specific service: `docker compose logs -f web` or `docker compose logs -f migrate`
 - To restart the containers: `docker compose restart`
+- To rebuild after code changes: `docker compose up -d --build`
 
-For the complete Docker Compose configuration, see [docker-compose.yml](./docker-compose.yml) in the repository.
-
-> **Note**: The Docker Compose configuration shown above is a minimal example. For a complete setup with all features (email, OAuth, file uploads, etc.), you'll need to create a `.env` file with the required environment variables. See the Environment Variables section below for the full list of available options.
+For the complete Docker Compose configuration with all optional features, see [docker-compose.yml](./docker-compose.yml) in the repository.
 
 ## Local Development 🧑‍💻
 

packages/api/src/utils/webhook.ts

@@ -2,8 +2,8 @@ import crypto from "crypto";
 import { z } from "zod";
 
 import type { dbClient } from "@kan/db/client";
-import * as webhookRepo from "@kan/db/repository/webhook.repo";
 import type { WebhookEvent } from "@kan/db/schema";
+import * as webhookRepo from "@kan/db/repository/webhook.repo";
 
 export type WebhookEventType = WebhookEvent;
 
@@ -92,7 +92,7 @@ export const webhookUrlSchema = z
     (url) => {
       try {
         const hostname = new URL(url).hostname.toLowerCase();
-        const ipv4Match = hostname.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+        const ipv4Match = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(hostname);
         if (ipv4Match) {
           const [, a, b] = ipv4Match.map(Number);
           if (
@@ -185,15 +185,16 @@ export async function sendWebhooksForWorkspace(
   payload: WebhookPayload,
 ): Promise<void> {
   try {
-    // Get active webhooks for this workspace, pre-filtered by event at the DB level
-    const webhooks = await webhookRepo.getActiveByWorkspaceId(
-      db,
-      workspaceId,
-      payload.event,
+    // Get active webhooks for this workspace
+    const webhooks = await webhookRepo.getActiveByWorkspaceId(db, workspaceId);
+
+    // Filter webhooks that are subscribed to this specific event
+    const webhooksForEvent = webhooks.filter((webhook) =>
+      webhook.events.includes(payload.event),
     );
 
-    // Send to all webhooks in parallel (fire and forget)
-    const promises = webhooks.map((webhook) =>
+    // Send to all subscribed webhooks in parallel (fire and forget)
+    const promises = webhooksForEvent.map((webhook) =>
       sendWebhookToUrl(webhook.url, webhook.secret ?? undefined, payload).then(
         (result) => {
           if (!result.success) {

packages/db/migrations/meta/_journal.json

@@ -187,12 +187,19 @@
     {
       "idx": 26,
       "version": "7",
+      "when": 1770521594167,
+      "tag": "20260208033314_AddAttachmentToActivity",
+      "breakpoints": true
+    },
+    {
+      "idx": 27,
+      "version": "7",
       "when": 1771192000000,
       "tag": "20260129210000_AddWorkspaceWebhooks",
       "breakpoints": true
     },
     {
-      "idx": 27,
+      "idx": 28,
       "version": "7",
       "when": 1772049587901,
       "tag": "20260225195947_AddIsArchivedToBoard",