[ismisepaul]

⚠️ Manual testing required before merging

This changes the default timezone of all three containers. The upgrade behaviour and the CTF schedule can only be checked on a running stack.

Please run this branch, follow the steps, and comment on this PR with the result: pass, or the step that failed and what you saw.

Branch: dev#970-tz-utc

Set up. Use a machine where the Shepherd Docker volumes can be thrown away: down -v deletes their data. JDK 17 and Maven 3.9.2+ are needed.

git fetch origin
git checkout 'dev#970-tz-utc'
mvn -Pdocker clean install -DskipTests
docker compose down -v
docker compose up -d --build

1. Open https://localhost, accept the self-signed certificate warning, log in as admin / password and set a new password when asked.

Test

1. Run docker exec secshep_tomcat date and docker exec secshep_mongo date. Both should report UTC.
2. Run docker exec secshep_mariadb sh -c 'mariadb -uroot -p"$MYSQL_ROOT_PASSWORD" -e "SELECT @@system_time_zone, NOW(), UTC_TIMESTAMP()"'. NOW() and UTC_TIMESTAMP() should be the same.
3. Optional upgrade check: set TZ=Europe/Dublin in .env, run docker compose up -d --build, and check that date reports Irish time again.

It's broken if: any container still reports Irish time (IST/GMT) with the default .env, or NOW() differs from UTC_TIMESTAMP().

---

Fixes #970.

What

.env shipped TZ=Europe/Dublin, and docker compose passes it to the MariaDB, Tomcat and MongoDB containers. Dublin moves an hour twice a year. On the last Sunday of October, 01:00–02:00 happens twice, so suspension times and results written in that hour can't be told apart. Nothing told operators the setting existed either.

• .env: TZ=UTC, with a comment saying what it sets and that it takes any IANA zone.
• README.md: a new Timezone section under the Docker setup. It covers:
  • the default and how to change it;
  • that stored timestamps and the CTF start/lock/end times use this zone;
  • an upgrade note for installs that never changed TZ: what moves to UTC, and how to keep Europe/Dublin.

This doesn't fix the timezone-dependent code paths themselves (#841, #843). Operators can still set any TZ, so the code has to keep working when it isn't UTC. Showing the server timezone next to the CTF schedule fields, the optional item in the issue, is not included.

Checked

• docker compose config gives TZ: UTC for all three services.
• mariadb:12.3, tomcat:11.0-jre17-temurin and mongo all report UTC with TZ=UTC, and IST with TZ=Europe/Dublin, so the variable takes effect in each image.
• Every step of test.yml passed locally (lint, build, PGP check, compose build, Tomcat config check, unit tests, integration tests).

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The upgrade guidance incorrectly assures operators that expired suspensions are unaffected, although recently expired suspensions can temporarily block login again.

1 open issue

• Prevent expired suspensions from reactivating after DST transition · New

What changed in this PR

Changes the Docker stack’s default timezone to UTC to avoid daylight-saving gaps and repeated hours, while preserving operator-configurable timezones. The underlying timezone-dependent code paths remain out of scope.

Changes:

• Defaults TZ to UTC and documents supported timezone values.
• Explains timezone effects on stored timestamps, CTF schedules, and upgrades.

File	Description
README.md	Adds timezone configuration and upgrade guidance.
.env	Defaults container timezones to UTC with explanatory comments.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The focused configuration and documentation changes are consistent with the existing container setup and have no unresolved findings.

No open issues 🎉

1 resolved since last review

• Prevent expired suspensions from reactivating after DST transition

_{Review effort: Balanced}