chore: trigger CI rebuild

Switch Kaniko registry-mirror from mirror.gcr.io to 10.100.9.70:5000
to pull base images from local registry instead of GCR.

.woodpecker.yml

@@ -3,7 +3,7 @@ steps:
   # PR VALIDATION: Parallel type checks (PRs only)
   # ===========================================
   typecheck-backend:
-    image: git.spdy.io/creationshop/node:20
+    image: node:22
     commands:
       - cd backend
       - npm ci --prefer-offline
@@ -13,7 +13,7 @@ steps:
       event: pull_request
 
   typecheck-cannaiq:
-    image: git.spdy.io/creationshop/node:20
+    image: node:22
     commands:
       - cd cannaiq
       - npm ci --prefer-offline
@@ -23,7 +23,7 @@ steps:
       event: pull_request
 
   typecheck-findadispo:
-    image: git.spdy.io/creationshop/node:20
+    image: node:22
     commands:
       - cd findadispo/frontend
       - npm ci --prefer-offline
@@ -33,7 +33,7 @@ steps:
       event: pull_request
 
   typecheck-findagram:
-    image: git.spdy.io/creationshop/node:20
+    image: node:22
     commands:
       - cd findagram/frontend
       - npm ci --prefer-offline
@@ -68,113 +68,122 @@ steps:
       event: pull_request
 
   # ===========================================
-  # MASTER DEPLOY: Parallel Docker builds
-  # NOTE: cache_from/cache_to removed due to plugin bug splitting on commas
+  # DOCKER: Multi-stage builds with layer caching
   # ===========================================
   docker-backend:
-    image: plugins/docker
-    settings:
-      registry: git.spdy.io
-      repo: git.spdy.io/creationshop/cannaiq
-      tags:
-        - latest
-        - sha-${CI_COMMIT_SHA:0:8}
-      dockerfile: backend/Dockerfile
-      context: backend
-      username:
-        from_secret: registry_username
-      password:
-        from_secret: registry_password
-      build_args:
-        - APP_BUILD_VERSION=sha-${CI_COMMIT_SHA:0:8}
-        - APP_GIT_SHA=${CI_COMMIT_SHA}
-        - APP_BUILD_TIME=${CI_PIPELINE_CREATED}
-        - CONTAINER_IMAGE_TAG=sha-${CI_COMMIT_SHA:0:8}
+    image: gcr.io/kaniko-project/executor:debug
+    commands:
+      - /kaniko/executor
+        --context=/woodpecker/src/git.spdy.io/Creationshop/cannaiq/backend
+        --dockerfile=/woodpecker/src/git.spdy.io/Creationshop/cannaiq/backend/Dockerfile
+        --destination=10.100.9.70:5000/cannaiq/backend:latest
+        --destination=10.100.9.70:5000/cannaiq/backend:sha-${CI_COMMIT_SHA:0:8}
+        --build-arg=APP_BUILD_VERSION=sha-${CI_COMMIT_SHA:0:8}
+        --build-arg=APP_GIT_SHA=${CI_COMMIT_SHA}
+        --build-arg=APP_BUILD_TIME=${CI_PIPELINE_CREATED}
+        --registry-mirror=10.100.9.70:5000
+        --insecure-registry=10.100.9.70:5000
+        --cache=true
+        --cache-repo=10.100.9.70:5000/cannaiq/cache-backend
+        --cache-ttl=168h
     depends_on: []
     when:
       branch: [master, develop]
       event: push
 
   docker-cannaiq:
-    image: plugins/docker
-    settings:
-      registry: git.spdy.io
-      repo: git.spdy.io/creationshop/cannaiq-frontend
-      tags:
-        - latest
-        - sha-${CI_COMMIT_SHA:0:8}
-      dockerfile: cannaiq/Dockerfile
-      context: cannaiq
-      username:
-        from_secret: registry_username
-      password:
-        from_secret: registry_password
+    image: gcr.io/kaniko-project/executor:debug
+    commands:
+      - /kaniko/executor
+        --context=/woodpecker/src/git.spdy.io/Creationshop/cannaiq/cannaiq
+        --dockerfile=/woodpecker/src/git.spdy.io/Creationshop/cannaiq/cannaiq/Dockerfile
+        --destination=10.100.9.70:5000/cannaiq/frontend:latest
+        --destination=10.100.9.70:5000/cannaiq/frontend:sha-${CI_COMMIT_SHA:0:8}
+        --registry-mirror=10.100.9.70:5000
+        --insecure-registry=10.100.9.70:5000
+        --cache=true
+        --cache-repo=10.100.9.70:5000/cannaiq/cache-cannaiq
+        --cache-ttl=168h
     depends_on: []
     when:
       branch: [master, develop]
       event: push
 
   docker-findadispo:
-    image: plugins/docker
-    settings:
-      registry: git.spdy.io
-      repo: git.spdy.io/creationshop/findadispo-frontend
-      tags:
-        - latest
-        - sha-${CI_COMMIT_SHA:0:8}
-      dockerfile: findadispo/frontend/Dockerfile
-      context: findadispo/frontend
-      username:
-        from_secret: registry_username
-      password:
-        from_secret: registry_password
+    image: gcr.io/kaniko-project/executor:debug
+    commands:
+      - /kaniko/executor
+        --context=/woodpecker/src/git.spdy.io/Creationshop/cannaiq/findadispo/frontend
+        --dockerfile=/woodpecker/src/git.spdy.io/Creationshop/cannaiq/findadispo/frontend/Dockerfile
+        --destination=10.100.9.70:5000/cannaiq/findadispo:latest
+        --destination=10.100.9.70:5000/cannaiq/findadispo:sha-${CI_COMMIT_SHA:0:8}
+        --registry-mirror=10.100.9.70:5000
+        --insecure-registry=10.100.9.70:5000
+        --cache=true
+        --cache-repo=10.100.9.70:5000/cannaiq/cache-findadispo
+        --cache-ttl=168h
     depends_on: []
     when:
       branch: [master, develop]
       event: push
 
   docker-findagram:
-    image: plugins/docker
-    settings:
-      registry: git.spdy.io
-      repo: git.spdy.io/creationshop/findagram-frontend
-      tags:
-        - latest
-        - sha-${CI_COMMIT_SHA:0:8}
-      dockerfile: findagram/frontend/Dockerfile
-      context: findagram/frontend
-      username:
-        from_secret: registry_username
-      password:
-        from_secret: registry_password
+    image: gcr.io/kaniko-project/executor:debug
+    commands:
+      - /kaniko/executor
+        --context=/woodpecker/src/git.spdy.io/Creationshop/cannaiq/findagram/frontend
+        --dockerfile=/woodpecker/src/git.spdy.io/Creationshop/cannaiq/findagram/frontend/Dockerfile
+        --destination=10.100.9.70:5000/cannaiq/findagram:latest
+        --destination=10.100.9.70:5000/cannaiq/findagram:sha-${CI_COMMIT_SHA:0:8}
+        --registry-mirror=10.100.9.70:5000
+        --insecure-registry=10.100.9.70:5000
+        --cache=true
+        --cache-repo=10.100.9.70:5000/cannaiq/cache-findagram
+        --cache-ttl=168h
     depends_on: []
     when:
       branch: [master, develop]
       event: push
 
   # ===========================================
-  # STAGE 3: Deploy and Run Migrations
+  # DEPLOY: Pull from local registry
   # ===========================================
   deploy:
     image: bitnami/kubectl:latest
     environment:
-      KUBECONFIG_CONTENT:
-        from_secret: kubeconfig_data
+      K8S_TOKEN:
+        from_secret: k8s_token
     commands:
       - mkdir -p ~/.kube
-      - echo "$KUBECONFIG_CONTENT" | tr -d '[:space:]' | base64 -d > ~/.kube/config
+      - |
+        cat > ~/.kube/config << KUBEEOF
+        apiVersion: v1
+        kind: Config
+        clusters:
+        - cluster:
+            certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkakNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzTmpVM05UUTNPRE13SGhjTk1qVXhNakUwTWpNeU5qSXpXaGNOTXpVeE1qRXlNak15TmpJegpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzTmpVM05UUTNPRE13V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFRWDRNdFJRTW5lWVJVV0s2cjZ3VEV2WjAxNnV4T3NUR3JJZ013TXVnNGwKajQ1bHZ6ZkM1WE1NY1pESnUxZ0t1dVJhVGxlb0xVOVJnSERIUUI4TUwzNTJvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVXIzNDZpNE42TFhzaEZsREhvSlU0CjJ1RjZseGN3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnVUtqdWRFQWJyS1JDVHROVXZTc1Rmb3FEaHFSeDM5MkYKTFFSVWlKK0hCVElDSUJqOFIxbG1zSnFSRkRHMEpwMGN4OG5ZZnFCaElRQzh6WWdRdTdBZmR4L3IKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+            server: https://10.100.6.10:6443
+          name: spdy-k3s
+        contexts:
+        - context:
+            cluster: spdy-k3s
+            namespace: cannaiq
+            user: cannaiq-admin
+          name: cannaiq
+        current-context: cannaiq
+        users:
+        - name: cannaiq-admin
+          user:
+            token: $K8S_TOKEN
+        KUBEEOF
       - chmod 600 ~/.kube/config
-      # Deploy backend first
-      - kubectl set image deployment/scraper scraper=git.spdy.io/creationshop/cannaiq:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
+      - kubectl set image deployment/scraper scraper=10.100.9.70:5000/cannaiq/backend:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
       - kubectl rollout status deployment/scraper -n cannaiq --timeout=300s
-      # Note: Migrations run automatically at startup via auto-migrate
-      # Deploy remaining services
-      # Resilience: ensure workers are scaled up if at 0
-      - REPLICAS=$(kubectl get deployment scraper-worker -n cannaiq -o jsonpath='{.spec.replicas}'); if [ "$REPLICAS" = "0" ]; then echo "Scaling workers from 0 to 5"; kubectl scale deployment/scraper-worker --replicas=5 -n cannaiq; fi
-      - kubectl set image deployment/scraper-worker worker=git.spdy.io/creationshop/cannaiq:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
-      - kubectl set image deployment/cannaiq-frontend cannaiq-frontend=git.spdy.io/creationshop/cannaiq-frontend:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
-      - kubectl set image deployment/findadispo-frontend findadispo-frontend=git.spdy.io/creationshop/findadispo-frontend:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
-      - kubectl set image deployment/findagram-frontend findagram-frontend=git.spdy.io/creationshop/findagram-frontend:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
+      - REPLICAS=$(kubectl get deployment scraper-worker -n cannaiq -o jsonpath='{.spec.replicas}'); if [ "$REPLICAS" = "0" ]; then kubectl scale deployment/scraper-worker --replicas=5 -n cannaiq; fi
+      - kubectl set image deployment/scraper-worker worker=10.100.9.70:5000/cannaiq/backend:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
+      - kubectl set image deployment/cannaiq-frontend cannaiq-frontend=10.100.9.70:5000/cannaiq/frontend:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
+      - kubectl set image deployment/findadispo-frontend findadispo-frontend=10.100.9.70:5000/cannaiq/findadispo:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
+      - kubectl set image deployment/findagram-frontend findagram-frontend=10.100.9.70:5000/cannaiq/findagram:sha-${CI_COMMIT_SHA:0:8} -n cannaiq
       - kubectl rollout status deployment/cannaiq-frontend -n cannaiq --timeout=120s
     depends_on:
       - docker-backend

backend/Dockerfile

@@ -1,6 +1,6 @@
 # Build stage
 # Image: git.spdy.io/creationshop/dispensary-scraper
-FROM node:20-slim AS builder
+FROM node:22-slim AS builder
 
 # Install build tools for native modules (bcrypt, sharp)
 RUN apt-get update && apt-get install -y \
@@ -27,7 +27,7 @@ RUN npm run build
 RUN npm prune --production
 
 # Production stage
-FROM node:20-slim
+FROM node:22-slim
 
 # Build arguments for version info
 ARG APP_BUILD_VERSION=dev

backend/src/index.ts

@@ -105,6 +105,7 @@ import { createSystemRouter, createPrometheusRouter } from './system/routes';
 import { createPortalRoutes } from './portals';
 import { createStatesRouter } from './routes/states';
 import { createAnalyticsV2Router } from './routes/analytics-v2';
+import { createBrandsRouter } from './routes/brands';
 import { createDiscoveryRoutes } from './discovery';
 import pipelineRoutes from './routes/pipeline';
 
@@ -229,6 +230,15 @@ try {
   console.warn('[AnalyticsV2] Failed to register routes:', error);
 }
 
+// Brand Analytics API - Hoodie Analytics-style market intelligence
+try {
+  const brandsRouter = createBrandsRouter(getPool());
+  app.use('/api/brands', brandsRouter);
+  console.log('[Brands] Routes registered at /api/brands');
+} catch (error) {
+  console.warn('[Brands] Failed to register routes:', error);
+}
+
 // Public API v1 - External consumer endpoints (WordPress, etc.)
 // Uses dutchie_az data pipeline with per-dispensary API key auth
 app.use('/api/v1', publicApiRoutes);

backend/src/services/visibility-events.ts

@@ -110,8 +110,8 @@ export async function detectVisibilityEvents(
     `
     SELECT
       provider_product_id as id,
-      name,
-      brand,
+      name_raw as name,
+      brand_name_raw as brand,
       price_rec as price
     FROM store_products
     WHERE dispensary_id = $1

cannaiq/Dockerfile

@@ -1,5 +1,5 @@
 # Build stage
-FROM node:20-slim AS builder
+FROM node:22-slim AS builder
 
 WORKDIR /app
 

docs/SPDY_INFRASTRUCTURE.md

@@ -0,0 +1,104 @@
+# CannaIQ Infrastructure (spdy.io)
+
+External services for the spdy.io Kubernetes cluster. **Do not create containers for these.**
+
+## PostgreSQL
+
+| Setting  | Value                |
+|----------|----------------------|
+| Host     | 10.100.6.50          |
+| Port     | 5432                 |
+| Database | cannaiq              |
+| Username | cannaiq              |
+| Password | SpDyCannaIQ2024      |
+
+```bash
+# Connection string
+DATABASE_URL=postgres://cannaiq:SpDyCannaIQ2024@10.100.6.50:5432/cannaiq
+
+# Test connection
+PGPASSWORD='SpDyCannaIQ2024' psql -h 10.100.6.50 -p 5432 -U cannaiq -d cannaiq -c "SELECT 1"
+```
+
+## Redis
+
+| Setting  | Value          |
+|----------|----------------|
+| Host     | 10.100.9.50    |
+| Port     | 6379           |
+| Password | SpDyR3d1s2024! |
+
+```bash
+# Connection URL
+REDIS_URL=redis://:SpDyR3d1s2024!@10.100.9.50:6379
+
+# Node.js .env
+REDIS_HOST=10.100.9.50
+REDIS_PORT=6379
+REDIS_PASSWORD=SpDyR3d1s2024!
+```
+
+## MinIO (S3-Compatible Storage)
+
+| Setting        | Value            |
+|----------------|------------------|
+| Endpoint       | 10.100.9.80:9000 |
+| Console        | 10.100.9.80:9001 |
+| Region         | us-east-1        |
+| Use Path Style | true             |
+
+### CannaIQ Bucket
+
+| Setting    | Value          |
+|------------|----------------|
+| Bucket     | cannaiq        |
+| Access Key | cannaiq-app    |
+| Secret Key | cannaiq-secret |
+
+```bash
+# Node.js .env
+MINIO_ENDPOINT=10.100.9.80
+MINIO_PORT=9000
+MINIO_ACCESS_KEY=cannaiq-app
+MINIO_SECRET_KEY=cannaiq-secret
+MINIO_BUCKET=cannaiq
+MINIO_USE_SSL=false
+```
+
+### Cannabrands Bucket
+
+| Setting    | Value                                    |
+|------------|------------------------------------------|
+| Bucket     | cannabrands                              |
+| Access Key | cannabrands-app                          |
+| Secret Key | cdbdcd0c7b6f3994d4ab09f68eaff98665df234f |
+
+## Kubernetes Secrets
+
+Create secrets in the `cannaiq` namespace:
+
+```bash
+# Database
+kubectl create secret generic db-credentials -n cannaiq \
+  --from-literal=DATABASE_URL='postgres://cannaiq:SpDyCannaIQ2024@10.100.6.50:5432/cannaiq'
+
+# Redis
+kubectl create secret generic redis-credentials -n cannaiq \
+  --from-literal=REDIS_URL='redis://:SpDyR3d1s2024!@10.100.9.50:6379'
+
+# MinIO
+kubectl create secret generic minio-credentials -n cannaiq \
+  --from-literal=MINIO_ACCESS_KEY='cannaiq-app' \
+  --from-literal=MINIO_SECRET_KEY='cannaiq-secret'
+```
+
+## Network
+
+All services are on the `10.100.x.x` internal network:
+
+| Service    | IP           | Port |
+|------------|--------------|------|
+| PostgreSQL | 10.100.6.50  | 5432 |
+| Redis      | 10.100.9.50  | 6379 |
+| MinIO      | 10.100.9.80  | 9000 |
+| Registry   | 10.100.9.70  | 5000 |

findadispo/frontend/Dockerfile

@@ -1,5 +1,5 @@
 # Build stage
-FROM node:20-slim AS builder
+FROM node:22-slim AS builder
 
 WORKDIR /app
 

findagram/frontend/Dockerfile

@@ -1,5 +1,5 @@
 # Build stage
-FROM node:20-slim AS builder
+FROM node:22-slim AS builder
 
 WORKDIR /app
 

k8s/postgres.yaml

@@ -1,76 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: postgres-pvc
-  namespace: cannaiq
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: postgres
-  namespace: cannaiq
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: postgres
-  template:
-    metadata:
-      labels:
-        app: postgres
-    spec:
-      containers:
-        - name: postgres
-          image: postgres:15-alpine
-          ports:
-            - containerPort: 5432
-          env:
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: scraper-secrets
-                  key: POSTGRES_USER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: scraper-secrets
-                  key: POSTGRES_PASSWORD
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: scraper-secrets
-                  key: POSTGRES_DB
-            - name: PGDATA
-              value: /var/lib/postgresql/data/pgdata
-          volumeMounts:
-            - name: postgres-storage
-              mountPath: /var/lib/postgresql/data
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "250m"
-            limits:
-              memory: "512Mi"
-              cpu: "500m"
-      volumes:
-        - name: postgres-storage
-          persistentVolumeClaim:
-            claimName: postgres-pvc
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: postgres
-  namespace: cannaiq
-spec:
-  selector:
-    app: postgres
-  ports:
-    - port: 5432
-      targetPort: 5432

k8s/redis.yaml

@@ -1,66 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: redis-data
-  namespace: cannaiq
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: redis
-  namespace: cannaiq
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: redis
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-        - name: redis
-          image: redis:7-alpine
-          ports:
-            - containerPort: 6379
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
-          volumeMounts:
-            - name: redis-data
-              mountPath: /data
-          command:
-            - redis-server
-            - --appendonly
-            - "yes"
-            - --maxmemory
-            - "200mb"
-            - --maxmemory-policy
-            - allkeys-lru
-      volumes:
-        - name: redis-data
-          persistentVolumeClaim:
-            claimName: redis-data
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis
-  namespace: cannaiq
-spec:
-  selector:
-    app: redis
-  ports:
-    - port: 6379
-      targetPort: 6379

k8s/secrets.yaml

@@ -5,12 +5,29 @@ metadata:
   namespace: cannaiq
 type: Opaque
 stringData:
+  # PostgreSQL (external: 10.100.7.50 - primary)
   POSTGRES_USER: "cannaiq"
   POSTGRES_PASSWORD: "SpDyCannaIQ2024"
   POSTGRES_DB: "cannaiq"
-  DATABASE_URL: "postgresql://cannaiq:SpDyCannaIQ2024@10.100.6.50:5432/cannaiq"
-  JWT_SECRET: "aW7vN3xKpM9qLsT2fB5jDc8hR4wY6zXe"
+  DATABASE_URL: "postgresql://cannaiq:SpDyCannaIQ2024@10.100.7.50:5432/cannaiq"
+
+  # Redis (external: 10.100.9.50)
+  REDIS_HOST: "10.100.9.50"
+  REDIS_PORT: "6379"
+  REDIS_PASSWORD: "SpDyR3d1s2024!"
+  REDIS_URL: "redis://:SpDyR3d1s2024!@10.100.9.50:6379"
+
+  # MinIO (external: 10.100.9.80)
+  MINIO_ENDPOINT: "10.100.9.80"
+  MINIO_PORT: "9000"
   MINIO_ACCESS_KEY: "cannaiq-app"
-  MINIO_SECRET_KEY: "62a37268f2fe4163ef46fe1c29ad93f817b415fc"
+  MINIO_SECRET_KEY: "cannaiq-secret"
+  MINIO_BUCKET: "cannaiq"
+  MINIO_USE_SSL: "false"
+
+  # Auth
+  JWT_SECRET: "aW7vN3xKpM9qLsT2fB5jDc8hR4wY6zXe"
+
+  # Evomi Proxy
   EVOMI_USER: "kl8"
   EVOMI_PASS: "ogh9U1Xe7Gzxzozo4rmP"