# Operations Runbook

## Start service

```bash
docker compose up -d postgres
cargo run --bin server --features server
```

## Stop service

- `Ctrl+C` in server terminal
- `docker compose stop postgres`

## Restart service

```bash
docker compose restart postgres
cargo run --bin server --features server
```

## Health and readiness checks

Primary health endpoint:

```bash
curl -i http://localhost:3000/api/auth/health
```

Expected: HTTP `200`.

## Runtime logging expectations

Startup logs should include:

- `Athena Auth server booted`
- `Hosting now on ...`
- `Auth routes: .../api/auth`

Per request logs should include:

- HTTP method
- path
- status code
- `athena_time_ms`

## Common environment misconfiguration checks

- `JWT_SECRET` length must be at least 32 chars
- `DATABASE_URL` must be reachable from server process
- `BASE_URL` should match public origin for cookies/redirects
- `AUTH_BASE_PATH` should usually be `/api/auth`
- `TRUSTED_ORIGINS` must include browser origin if cross-origin

## Email verification operations

If users report "verify email doesn’t work":

1. Confirm verify link contains `/api/auth/verify-email`.
2. Confirm token exists and is not expired.
3. Confirm redirect `callbackURL` is valid.
4. Confirm response status and `Set-Cookie` header behavior.

## Docker image operations

Build image:

```bash
docker build -t athena-auth .
```

Run container:

```bash
docker run -p 3000:3000 \
  -e DATABASE_URL=postgresql://postgres:postgres@host.docker.internal:5432/athena_auth \
  -e JWT_SECRET=replace_with_at_least_32_chars \
  -e BASE_URL=http://localhost:3000 \
  -e AUTH_BASE_PATH=/api/auth \
  athena-auth
```