2 Commits

Include renames

Author	SHA1	Message	Date
ehoandClaude Sonnet 5	3588057a75	feat(openzaak): real secrets + TLS for the production OpenZaak harness (WP-55) ... docker-compose.openzaak.prod.yml layers real SECRET_KEY/DB password/site domain/allowed-hosts (all required, fail-fast via ${VAR:?...}) on top of the WP-54 dev harness, switches Postgres off trust auth, and sets IS_HTTPS for a front-facing reverse-proxy TLS setup. The ZGW client secret lives inside a file setup_configuration reads rather than a compose env var, so it's templated (data.prod.yaml.template, no secret) and rendered host-side via render-prod-secrets.sh into a gitignored data.prod.yaml, mounted over the container's dev data.yaml. ZgwOptions.cs already binds from IConfiguration, so the BFF side needed no code change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-30 12:27:21 +02:00
ehoandClaude Sonnet 5	f21c3c7ca2	docs(backlog): add phase 10 (OpenZaak hardening) and phase 11 (behandelportal) ... WP-55..60 harden the OpenZaak integration for production (secrets/TLS, idempotent provisioning, least-privilege scopes, real notifications, confidentialiteit config, write-divergence resilience). WP-61..66 stand up a staff-facing behandelportal per ADR-0002, wired to the same backend via BFF-lite decision DTOs. Both phases are independent tracks; WP-60's Decisions block is deliberately left open for a planner-agent kickoff. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-30 11:59:11 +02:00