6f9040fdb4
Broad-scope commit sweeping in work from parallel sessions plus this session's dev-only utilities. No single unifying theme — this is the "commit everything that's ready" pass. Grouped by area below. AriadneResolver / mobile * Small updates to BchFetcher, Bns, MainActivity, AriadneVpnService, and the Android manifest — from a parallel mobile-resolver session. * AriadneResolver/mobile/webpreview/ — new local dev webview (index.html + server.mjs) for iterating on the mobile UI without a device. Email / SnappyMail * Email/snappymail-plugin/silentmode-addresses — new SnappyMail plugin (README, CSS, PHP entry, JS) for surfacing @silentmode.st address management inside the webmail UI. Hephaestus (Forgejo + auth-proxy) * auth-proxy/src/oidc.ts + docker-compose.yml updates. * scripts/bootstrap-auth.sh — idempotent script that registers the wallet auth-proxy as Forgejo's OIDC provider after `docker compose up -d`. All secrets read from .env — no literals in the script. TheseusNavigator / dev tools * dev/list-tlds.mjs — enumerate every registered BNS name grouped by TLD via our own indexer. * dev/show-tlds-bch.mjs — dump the full records payload of the legacy tlds.bch name (kept as a diagnostic for the list-in-one-NFT era). Deviant sites + brand * site/deviant/ — new microsites (anthemus, potidaea, brand, mindmap, main index) plus the full brand kit under site/deviant/brand/ (logos, icons, palette, social exports as SVG source + PNG renders). * site-sirius-x/portal.html — updates. Coordination * _coordination/sessions/mobile-resolver.md — parallel-session notes. Deliberately excluded from this commit: * scratchpad/ — this session's temp drafts (Sia doc mockups, tlds UPD payloads). * TheseusNavigator/_prev/ — ~372 MB of prior release binaries; belongs in a separate artefacts store, not the git tree. Add to .gitignore next pass.
82 lines
3.1 KiB
YAML
82 lines
3.1 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
auth-proxy:
|
|
build: ./auth-proxy
|
|
restart: unless-stopped
|
|
environment:
|
|
ISSUER: ${AUTH_PROXY_ISSUER}
|
|
CLIENT_ID: ${AUTH_PROXY_CLIENT_ID}
|
|
CLIENT_SECRET: ${AUTH_PROXY_CLIENT_SECRET}
|
|
CHALLENGE_DOMAIN: ${AUTH_PROXY_CHALLENGE_DOMAIN}
|
|
FORGEJO_REDIRECT_URI: ${FORGEJO_ROOT_URL}user/oauth2/hephaestus-wallet/callback
|
|
ports:
|
|
- "4000:4000"
|
|
volumes:
|
|
- auth-proxy-keys:/data
|
|
|
|
forgejo:
|
|
image: codeberg.org/forgejo/forgejo:10
|
|
restart: unless-stopped
|
|
environment:
|
|
USER_UID: "1000"
|
|
USER_GID: "1000"
|
|
FORGEJO__database__DB_TYPE: postgres
|
|
FORGEJO__database__HOST: postgres:5432
|
|
FORGEJO__database__NAME: ${POSTGRES_DB}
|
|
FORGEJO__database__USER: ${POSTGRES_USER}
|
|
FORGEJO__database__PASSWD: ${POSTGRES_PASSWORD}
|
|
FORGEJO__server__DOMAIN: ${FORGEJO_DOMAIN}
|
|
FORGEJO__server__ROOT_URL: ${FORGEJO_ROOT_URL}
|
|
FORGEJO__security__SECRET_KEY: ${FORGEJO_SECRET_KEY}
|
|
FORGEJO__security__INTERNAL_TOKEN: ${FORGEJO_INTERNAL_TOKEN}
|
|
FORGEJO__oauth2__JWT_SECRET: ${FORGEJO_OAUTH_JWT_SECRET}
|
|
# --- Storage backend: local disk for MVP ---
|
|
# sia.storage as S3 backend is deferred until the endpoint TLS cert chains cleanly
|
|
# (currently requires --no-verify-ssl which Forgejo's minio driver won't accept).
|
|
# Storage-on-disk works; the switch back to S3 is a config change only, no rebuild.
|
|
# (defaults to local — no MINIO_* env vars needed)
|
|
# --- Quota (free tier: 500 MB per user) ---
|
|
FORGEJO__quota__ENABLED: "true"
|
|
FORGEJO__quota__DEFAULT_GROUPS: free
|
|
# --- Registration + signin ---
|
|
# Local form is disabled via SHOW_REGISTRATION_BUTTON=false + ALLOW_ONLY_EXTERNAL_REGISTRATION=true.
|
|
# DISABLE_REGISTRATION must stay FALSE — it blocks OIDC auto-provisioning too, not just the form.
|
|
FORGEJO__service__DISABLE_REGISTRATION: "false"
|
|
FORGEJO__service__SHOW_REGISTRATION_BUTTON: "false"
|
|
FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "true"
|
|
# OIDC callback creates users automatically using the preferred_username claim (= cashaddr).
|
|
FORGEJO__oauth2_client__ENABLE_AUTO_REGISTRATION: "true"
|
|
FORGEJO__oauth2_client__ACCOUNT_LINKING: "auto"
|
|
FORGEJO__oauth2_client__USERNAME: "preferred_username"
|
|
FORGEJO__oauth2_client__UPDATE_AVATAR: "false"
|
|
# Skip the web installer wizard — everything is already configured
|
|
FORGEJO__server__INSTALL_LOCK: "true"
|
|
ports:
|
|
- "3000:3000"
|
|
- "2222:22"
|
|
volumes:
|
|
- forgejo-data:/data
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
auth-proxy:
|
|
condition: service_started
|
|
|
|
volumes:
|
|
postgres-data:
|
|
forgejo-data:
|
|
auth-proxy-keys:
|