6f9040fdb4
Broad-scope commit sweeping in work from parallel sessions plus this session's dev-only utilities. No single unifying theme — this is the "commit everything that's ready" pass. Grouped by area below. AriadneResolver / mobile * Small updates to BchFetcher, Bns, MainActivity, AriadneVpnService, and the Android manifest — from a parallel mobile-resolver session. * AriadneResolver/mobile/webpreview/ — new local dev webview (index.html + server.mjs) for iterating on the mobile UI without a device. Email / SnappyMail * Email/snappymail-plugin/silentmode-addresses — new SnappyMail plugin (README, CSS, PHP entry, JS) for surfacing @silentmode.st address management inside the webmail UI. Hephaestus (Forgejo + auth-proxy) * auth-proxy/src/oidc.ts + docker-compose.yml updates. * scripts/bootstrap-auth.sh — idempotent script that registers the wallet auth-proxy as Forgejo's OIDC provider after `docker compose up -d`. All secrets read from .env — no literals in the script. TheseusNavigator / dev tools * dev/list-tlds.mjs — enumerate every registered BNS name grouped by TLD via our own indexer. * dev/show-tlds-bch.mjs — dump the full records payload of the legacy tlds.bch name (kept as a diagnostic for the list-in-one-NFT era). Deviant sites + brand * site/deviant/ — new microsites (anthemus, potidaea, brand, mindmap, main index) plus the full brand kit under site/deviant/brand/ (logos, icons, palette, social exports as SVG source + PNG renders). * site-sirius-x/portal.html — updates. Coordination * _coordination/sessions/mobile-resolver.md — parallel-session notes. Deliberately excluded from this commit: * scratchpad/ — this session's temp drafts (Sia doc mockups, tlds UPD payloads). * TheseusNavigator/_prev/ — ~372 MB of prior release binaries; belongs in a separate artefacts store, not the git tree. Add to .gitignore next pass.
68 lines
2.4 KiB
Bash
68 lines
2.4 KiB
Bash
#!/usr/bin/env bash
|
|
# One-time bootstrap: register the wallet auth-proxy as Forgejo's OIDC provider.
|
|
# Idempotent — safe to re-run; will fail with "already exists" on second run.
|
|
#
|
|
# Run this AFTER `docker compose up -d` and after Forgejo's healthcheck passes
|
|
# (its Postgres schema needs to be initialised before we can add an auth source).
|
|
#
|
|
# Usage:
|
|
# bash scripts/bootstrap-auth.sh
|
|
set -euo pipefail
|
|
|
|
# shellcheck disable=SC1091
|
|
[[ -f "$(dirname "$0")/../.env" ]] && source "$(dirname "$0")/../.env"
|
|
|
|
: "${AUTH_PROXY_CLIENT_ID:?}"
|
|
: "${AUTH_PROXY_CLIENT_SECRET:?}"
|
|
: "${AUTH_PROXY_ISSUER:?}"
|
|
|
|
echo "Waiting for Forgejo to be ready…"
|
|
for i in {1..60}; do
|
|
if docker compose exec -T forgejo forgejo --version >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
|
|
# Same wait for auth-proxy — its /.well-known/openid-configuration must return 200
|
|
# before Forgejo will accept the auth source (it calls discovery on add).
|
|
echo "Waiting for auth-proxy to be ready…"
|
|
for i in {1..60}; do
|
|
if docker compose exec -T forgejo wget -qO- "${AUTH_PROXY_ISSUER}/.well-known/openid-configuration" >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
|
|
ADMIN_USER="${HEPHAESTUS_ADMIN_USER:-hephaestus-admin}"
|
|
ADMIN_PW="${HEPHAESTUS_ADMIN_PASSWORD:-$(openssl rand -base64 24 | tr -d '=+/' | cut -c1-24)}"
|
|
ADMIN_EMAIL="${HEPHAESTUS_ADMIN_EMAIL:-admin@hephaestus.local}"
|
|
|
|
echo "Creating admin user '${ADMIN_USER}' (idempotent — 'already exists' is fine)…"
|
|
docker compose exec -T --user 1000 forgejo forgejo admin user create \
|
|
--admin \
|
|
--username "${ADMIN_USER}" \
|
|
--email "${ADMIN_EMAIL}" \
|
|
--password "${ADMIN_PW}" \
|
|
--must-change-password=false 2>&1 | tail -3 || true
|
|
|
|
echo ""
|
|
echo "Registering OIDC auth source 'hephaestus-wallet' in Forgejo…"
|
|
docker compose exec -T --user 1000 forgejo forgejo admin auth add-oauth \
|
|
--provider openidConnect \
|
|
--name hephaestus-wallet \
|
|
--key "${AUTH_PROXY_CLIENT_ID}" \
|
|
--secret "${AUTH_PROXY_CLIENT_SECRET}" \
|
|
--auto-discover-url "${AUTH_PROXY_ISSUER}/.well-known/openid-configuration" \
|
|
--scopes "openid profile" \
|
|
--group-claim-name "" \
|
|
--skip-local-2fa 2>&1 | tail -5
|
|
|
|
echo ""
|
|
echo "=== Bootstrap complete ==="
|
|
echo "Admin credentials (save these somewhere — needed for site admin):"
|
|
echo " URL: ${FORGEJO_ROOT_URL}"
|
|
echo " Username: ${ADMIN_USER}"
|
|
echo " Password: ${ADMIN_PW}"
|
|
echo ""
|
|
echo "For normal use: log in at ${FORGEJO_ROOT_URL} → 'Sign in with hephaestus-wallet'."
|