Add infra/openzaak/docker-compose.yml — a lean adaptation of the upstream
open-zaak dev stack: PostGIS db, redis, a one-shot init that runs database
migrations, the OpenZaak API, and a celery worker. (Dropped nginx, beat,
flower, OTEL for leanness.) Images fully qualified (docker.io/...) for
rootless Podman.
Verified locally: stack comes up; migrations run; GET /admin/ -> 302,
GET /zaken/api/v1/ -> 200, and an unauthenticated GET /zaken/api/v1/zaken
-> 403 PermissionDenied (a proper ZGW fout) — i.e. auth is enforced.
Note: the S-01 acceptance says "401", but OpenZaak's ZGW APIs return 403
for missing/invalid JWT. Auth-enforced intent is met; the issue text
should be corrected to 403. Remaining S-01 work: BIG catalogus + zaaktype
seed + JWT client (then list zaaktypen), and Open Notificaties — so this
refs (not closes) #10.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add tools/seed-gitea.sh, which bootstraps the Gitea repo from BACKLOG.md:
the label taxonomy, the seven iteration milestones, and all 26 slice
issues (S-00..S-25). Driven by curl/jq against the Gitea API; reads
GITEA_TOKEN from the environment. Idempotent — every item is matched
before creation, so a partial or failed run can be re-run safely.
Document it in tools/README.md (prerequisites, usage, what it creates,
verification). Overlaps part of S-00's "labels/milestones exist in
Gitea" acceptance; the authoritative runbook moves to docs/ under S-00.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
