refactor: drop PayloadCMS legacy traces and consolidate DB SSL handling

- Delete one-shot `scripts/migrate-payload-to-prisma.ts` and the
  SSL-wrapping `run-prisma-migrate-*.mjs` runners; `db:migrate` and
  `db:migrate:deploy` now invoke `prisma migrate` directly.
- Introduce `src/utils/database-url.ts#withDatabaseSslParams` that
  auto-appends `sslmode=require&uselibpqcompat=true` for
  `*.rds.amazonaws.com` hosts, and use it from both `src/utils/prisma.ts`
  and `prisma.config.ts` to keep runtime and migrations aligned.
- Remove `PAYLOAD_*` env vars (`PAYLOAD_DATABASE_URL`,
  `PAYLOAD_DATABASE_SSL_REJECT_UNAUTHORIZED`, `PAYLOAD_S3_BASE_URL`,
  `PAYLOAD_S3_SOURCE_BUCKET`) and rename
  `PAYLOAD_S3_TARGET_BUCKET` -> `S3_BUCKET` across source, Dockerfile,
  GitHub Actions CD secrets, and `.env` / `.env.example`.
- Drop direct `pg` / `@types/pg` deps (still installed transitively via
  `@prisma/adapter-pg`).
- Scrub remaining Payload references from `README.md`, `AGENTS.md`, and
  `src/app/AGENTS.md`; drop the obsolete `DATABASE_SSL_REJECT_UNAUTHORIZED`
  override note.
- Apply `prettier:write` across the repo (admin dashboard/actions, info
  pages, footer, scrolling logos, cms util, CI workflow).

Author: sboh1214

.env.example

@@ -1,10 +1,5 @@
 DATABASE_URL=postgres://user:password@url:port/schema
-DATABASE_SSL_REJECT_UNAUTHORIZED=false
-PAYLOAD_DATABASE_URL=postgres://user:password@old-payload-url:port/schema
-PAYLOAD_DATABASE_SSL_REJECT_UNAUTHORIZED=false
-PAYLOAD_S3_BASE_URL=https://stdev-kr.s3.ap-northeast-2.amazonaws.com
-PAYLOAD_S3_SOURCE_BUCKET=stdev-kr
-PAYLOAD_S3_TARGET_BUCKET=stdev-kr
+S3_BUCKET=stdev-kr
 AWS_REGION=ap-northeast-2
 AWS_ACCESS_KEY=example
 AWS_SECRET_KEY=example

.github/workflows/cd.yml

@@ -41,7 +41,6 @@ jobs:
         if: github.event_name != 'pull_request'
         env:
           DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          DATABASE_SSL_REJECT_UNAUTHORIZED: ${{ secrets.DATABASE_SSL_REJECT_UNAUTHORIZED }}
         run: pnpm db:migrate:deploy
 
       - name: Install cosign
@@ -77,8 +76,7 @@ jobs:
             "NEXT_PUBLIC_GTM_ID=${{ secrets.NEXT_PUBLIC_GTM_ID }}"
             "NEXT_PUBLIC_GA_ID=${{ secrets.NEXT_PUBLIC_GA_ID }}"
             "DATABASE_URL=${{ secrets.DATABASE_URL }}"
-            "PAYLOAD_S3_BASE_URL=${{ secrets.PAYLOAD_S3_BASE_URL }}"
-            "PAYLOAD_S3_TARGET_BUCKET=${{ secrets.PAYLOAD_S3_TARGET_BUCKET }}"
+            "S3_BUCKET=${{ secrets.S3_BUCKET }}"
             "AWS_REGION=${{ secrets.AWS_REGION }}"
             "BETTER_AUTH_SECRET=${{ secrets.BETTER_AUTH_SECRET }}"
             "BETTER_AUTH_URL=${{ secrets.BETTER_AUTH_URL }}"

.github/workflows/ci.yml

@@ -7,7 +7,7 @@ on:
     branches: [main]
 
 env:
-  NODE_VERSION: "24"
+  NODE_VERSION: '24'
 
 jobs:
   build:
@@ -24,7 +24,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: "pnpm"
+          cache: 'pnpm'
 
       - name: Copy example env file
         run: cp .env.example .env
@@ -47,7 +47,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: "pnpm"
+          cache: 'pnpm'
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

AGENTS.md

@@ -10,7 +10,6 @@ STDev Corp. (사단법인 에스티데브) Korean nonprofit homepage. Next.js 16
 stdev/
 ├── prisma/schema.prisma      # CMS/auth data model
 ├── prisma.config.ts          # Prisma config; reads DATABASE_URL
-├── scripts/                  # Data migration utilities
 ├── src/
 │   ├── app/                  # (stdev) public site, (cms) admin, api/auth
 │   ├── components/           # UI building blocks
@@ -28,7 +27,6 @@ stdev/
 | Prisma client           | `src/utils/prisma.ts`                                                                  | Reuses one client during dev hot reload                   |
 | Auth config             | `src/utils/auth.ts` + `src/utils/admin-auth.ts` + `src/app/api/auth/[...all]/route.ts` | Google-only better-auth with Prisma adapter               |
 | Admin UI                | `src/app/(cms)/admin/**`                                                               | DIY CMS forms protected by better-auth                    |
-| Payload migration       | `scripts/migrate-payload-to-prisma.ts`                                                 | Dry-run by default; `--write` persists rows               |
 | Add a public page/route | `src/app/(stdev)/<path>/page.tsx`                                                      | Also update `src/utils/menus.ts` and `src/utils/links.ts` |
 | Shared layout chrome    | `src/components/layout/`                                                               | `basic-layout`, `left-menu-layout`, `navbar`, `footer`    |
 | Markdown rendering      | `src/components/markdown/markdown-view.tsx`                                            | Chakra-mapped react-markdown + remark-gfm                 |
@@ -46,7 +44,6 @@ stdev/
 
 ## ANTI-PATTERNS
 
-- Do not reintroduce Payload CMS packages, generated admin routes, or `payload.config.ts`.
 - Do not edit generated Prisma client output in `node_modules`; change `prisma/schema.prisma` and regenerate.
 - Do not add semicolons.
 - Do not statically render `(stdev)`.
@@ -64,13 +61,11 @@ pnpm prettier:check         # CI-style check
 pnpm db:generate            # Generate Prisma client
 pnpm db:migrate             # Local schema migration
 pnpm db:migrate:deploy      # Production migration deploy
-pnpm migrate:payload        # Dry-run old Payload RDS row counts
-pnpm migrate:payload -- --write # Copy old Payload rows into Prisma tables
 ```
 
 ## NOTES
 
 - No test suite exists. CI runs build + lint.
 - Docker prod port is 1000.
 - Existing S3 object URLs are preserved as CMS asset URLs; remote host is `stdev-kr.s3.ap-northeast-2.amazonaws.com`.
-- `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, and `DATABASE_URL` are required for the CMS/auth stack. Set `DATABASE_SSL_REJECT_UNAUTHORIZED=false` only when your managed Postgres requires unverified/self-signed TLS.
+- `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, and `DATABASE_URL` are required for the CMS/auth stack.

Dockerfile

@@ -22,8 +22,7 @@ RUN --mount=type=secret,id=NEXT_PUBLIC_CHANNEL_PLUGIN_KEY,env=NEXT_PUBLIC_CHANNE
   --mount=type=secret,id=NEXT_PUBLIC_GTM_ID,env=NEXT_PUBLIC_GTM_ID \
   --mount=type=secret,id=NEXT_PUBLIC_GA_ID,env=NEXT_PUBLIC_GA_ID \
   --mount=type=secret,id=DATABASE_URL,env=DATABASE_URL \
-  --mount=type=secret,id=PAYLOAD_S3_BASE_URL,env=PAYLOAD_S3_BASE_URL \
-  --mount=type=secret,id=PAYLOAD_S3_TARGET_BUCKET,env=PAYLOAD_S3_TARGET_BUCKET \
+  --mount=type=secret,id=S3_BUCKET,env=S3_BUCKET \
   --mount=type=secret,id=AWS_REGION,env=AWS_REGION \
   --mount=type=secret,id=BETTER_AUTH_SECRET,env=BETTER_AUTH_SECRET \
   --mount=type=secret,id=BETTER_AUTH_URL,env=BETTER_AUTH_URL \

README.md

@@ -45,15 +45,14 @@ services:
     restart: always
     environment:
       DATABASE_URL: postgres://user:password@url:port/schema
-      DATABASE_SSL_REJECT_UNAUTHORIZED: 'false'
       BETTER_AUTH_SECRET: example
       BETTER_AUTH_URL: https://www.stdev.kr
       GOOGLE_CLIENT_ID: example.apps.googleusercontent.com
       GOOGLE_CLIENT_SECRET: example
       AWS_REGION: ap-northeast-2
       AWS_ACCESS_KEY: example
       AWS_SECRET_KEY: example
-      PAYLOAD_S3_TARGET_BUCKET: stdev-kr
+      S3_BUCKET: stdev-kr
 ```
 
 컨테이너를 올리기 전에 Prisma 스키마 마이그레이션을 먼저 적용합니다.
@@ -69,19 +68,3 @@ docker compose up -d
 ```
 
 Port `1000` 번에 Reverse Proxy를 붙입니다.
-
-## CMS migration
-
-Payload CMS has been replaced by the Prisma-backed DIY CMS at `/admin`. Admin access requires a Google-connected account whose email ends with `@stdev.kr`.
-
-```bash
-pnpm db:generate
-pnpm db:migrate
-pnpm migrate:payload          # dry-run: prints detected Payload rows
-pnpm migrate:payload -- --write
-pnpm migrate:payload -- --write --copy-s3
-```
-
-Set `PAYLOAD_DATABASE_URL` when the old Payload RDS database is separate from the new `DATABASE_URL`. The migration keeps existing S3 object URLs from the old RDS rows, or reconstructs them from `PAYLOAD_S3_BASE_URL`, `prefix`, and `filename` when Payload stored only upload metadata. Add `--copy-s3` to copy objects from `PAYLOAD_S3_SOURCE_BUCKET` to `PAYLOAD_S3_TARGET_BUCKET` with the configured `AWS_REGION`, `AWS_ACCESS_KEY`, and `AWS_SECRET_KEY` instead of only reusing existing URLs.
-
-If your managed Postgres uses self-signed or unverified TLS, set `DATABASE_SSL_REJECT_UNAUTHORIZED=false` and `PAYLOAD_DATABASE_SSL_REJECT_UNAUTHORIZED=false`. Otherwise leave them unset to keep certificate verification enabled.

next.config.ts

@@ -2,11 +2,8 @@ import type { NextConfig } from 'next'
 
 const s3Hosts = new Set([
   'stdev-kr.s3.ap-northeast-2.amazonaws.com',
-  process.env.PAYLOAD_S3_BASE_URL
-    ? new URL(process.env.PAYLOAD_S3_BASE_URL).hostname
-    : null,
-  process.env.PAYLOAD_S3_TARGET_BUCKET
-    ? `${process.env.PAYLOAD_S3_TARGET_BUCKET}.s3.${process.env.AWS_REGION ?? 'ap-northeast-2'}.amazonaws.com`
+  process.env.S3_BUCKET
+    ? `${process.env.S3_BUCKET}.s3.${process.env.AWS_REGION ?? 'ap-northeast-2'}.amazonaws.com`
     : null,
 ])
 

package.json

@@ -11,10 +11,9 @@
     "prettier:write": "prettier --write .",
     "prettier:check": "prettier --check .",
     "db:generate": "prisma generate",
-    "db:migrate": "node scripts/run-prisma-migrate-dev.mjs",
-    "db:migrate:deploy": "node scripts/run-prisma-migrate-deploy.mjs",
-    "db:studio": "prisma studio",
-    "migrate:payload": "tsx scripts/migrate-payload-to-prisma.ts"
+    "db:migrate": "prisma migrate dev",
+    "db:migrate:deploy": "prisma migrate deploy",
+    "db:studio": "prisma studio"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1042.0",
@@ -29,7 +28,6 @@
     "dayjs": "^1.11.20",
     "dotenv": "^17.4.2",
     "next": "16.2.4",
-    "pg": "^8.20.0",
     "react": "^19.2.5",
     "react-dom": "^19.2.5",
     "react-markdown": "^10.1.0",
@@ -39,7 +37,6 @@
   },
   "devDependencies": {
     "@types/node": "^24.12.2",
-    "@types/pg": "^8.20.0",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "eslint": "^9.39.4",