Local Dev 9da520d719 docs(site/GOTCHAS): CORS on /js/*.js is required for BCNR pages

Theseus browses BCNR-served sites (sirius.x, theseus.x etc.) under a
'bns://<name>' origin. Those pages import the shared bundles at
silentmode.st/js/*.js — cross-origin. Without an
Access-Control-Allow-Origin header on the JS response the browser
refuses the module and every wallet/register/mint flow silently
breaks (the launcher button does nothing, no visible error unless
you open DevTools).

The nginx block for /js/*.js MUST carry the CORS add_header lines.
Documented what to look for and the exact block to keep so a future
nginx rebuild doesn't drop it.

2026-09-08 12:43:30 +02:00

3.2 KiB

Raw Blame History

site/ — gotchas

Hand-authored static tree for silentmode.st. No build step. Served by nginx from /opt/silent-mode/site/ on the VPS (ssh alias silentmode), and mirrored to Sia (s3://bns/silentmode/ → silentmode.bch) by the silentmode-sia-sync.timer on the VPS every 5 minutes. Anything that lands in /opt/silent-mode/site/ reaches the .bch mirror on its own; you do not need to run sia-upload.js for site files any more.

Never `rsync --delete` (or blanket-overwrite) `site/` → the VPS

/opt/silent-mode/site/ holds far more than this folder: sirius-x/, deviant/ (the full Deviant site incl. wallet/, artemision/, katalogos/, agora/), apps/, code/. Those are deployed from other repos. In particular site/deviant/ here is a stale Aug-31 copy; the canonical source is D:\Dev\Deviant\site\deviant\ and the VPS already carries the newer Sep-1 pages. Pushing this folder wholesale would roll them back.

Ship individual files: scp site/<path> silentmode:/opt/silent-mode/site/<path>.

The release manifest lives in three places

https://dl.silentmode.st/releases-manifest.json — canonical (/opt/silent-mode/dl/), what releases.silentmode.bch points at.
/opt/silent-mode/site/releases-manifest.json — what tools/index.html links as ../releases-manifest.json, and what the Sia mirror syncs.
site/releases-manifest.json — the committed source of both.

The ship checklist (Ship Theseus … commits) must scp it to both VPS paths. It was missed for site/ from 0.3.4 through 0.3.16 (found 2026-09-07): the HTML pages were current while the JSON next to them still said 0.3.3.

Old Theseus builds fill the VPS disk

scripts/theseus-vps-archive.sh <version> moves everything older than N-1 to Sia and deletes it from /opt/silent-mode/dl/. Run it after every ship; when it is skipped the 48 GB disk climbs ~245 MB per release.

Pages that are not silentmode.st pages

hephaestus.x/ is the landing for the .x name and is served from Sia via the gateway (navigate.st/bns/hephaestus.x/); the copy under /opt/silent-mode/site/ is just parity. choose/ has no top nav on purpose.

CORS on `/js/*.js` — required for BCNR pages

The shared bundles (bns-register.js, libauth.js, wizardconnect.js) live under silentmode.st/js/ and are imported cross-origin by pages served on their own origin: sirius.x, theseus.x, any BCNR-served site opened in Theseus (origin bns://<name>). Without CORS the browser refuses to load the module and every wallet/register/mint flow silently breaks — the launcher click does nothing.

The nginx block on VPS (/etc/nginx/sites-enabled/silentmode-st) MUST carry:

location ~ ^/js/.*\.js$ {
  add_header Cache-Control "no-cache, must-revalidate" always;
  add_header Access-Control-Allow-Origin "*" always;
  add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
}

Added 2026-09-08 after Theseus reported "CORS blocked" from origin bns://sirius.x. If a future nginx-config rebuild drops the add_header Access-Control-* lines, every non-silentmode.st page that imports the bundle starts failing again with "No 'Access-Control-Allow-Origin' header".

3.2 KiB Raw Blame History