skatespots/SkateSpots
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Wiki Activity Actions 1

docs: record 1.7.55 operator dashboard and TLS hardening

Browse source
This commit is contained in:
SkateSpots 2026-10-30 18:47:43 +07:00
parent 52a84479d4
commit 344b41afc8
1 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
AGENTS.md
View file

@ -2228,7 +2228,7 @@ session with **no other memory of this project**. So:
instead of showing the error boundary. instead of showing the error boundary.
- **Baselines** (verified 2026-10-29): `npm test` → **0 errors, 0 warnings**, - **Baselines** (verified 2026-10-29): `npm test` → **0 errors, 0 warnings**,
**156 tests**, build ok. The gate also type-checks the CVM server **156 tests**, build ok. The gate also type-checks the CVM server
(`tsc -p cvm-server/tsconfig.json`). `package.json` version **1.7.54**. (`tsc -p cvm-server/tsconfig.json`). `package.json` version **1.7.55**.
- ✅ Lint is **clean**: `no-explicit-any` = 0 · `react-hooks/exhaustive-deps` = 0 - ✅ Lint is **clean**: `no-explicit-any` = 0 · `react-hooks/exhaustive-deps` = 0
· `no-unused-vars` = 0 · `react-refresh` = 0. Non-component exports were · `no-unused-vars` = 0 · `react-refresh` = 0. Non-component exports were
**split into their own modules** (`contexts/language.ts`, `lib/sortOptions.ts`, **split into their own modules** (`contexts/language.ts`, `lib/sortOptions.ts`,
@ -2771,6 +2771,11 @@ Rules:
hourly backstop, 20 GB relay cap), app-side image/type/size guard and clear hourly backstop, 20 GB relay cap), app-side image/type/size guard and clear
errors; uploads use only our Blossom (mirrors are read-only fallbacks). errors; uploads use only our Blossom (mirrors are read-only fallbacks).
APK sha256 `f554d934…`, versionCode 10754. Web live at `465683c`. APK sha256 `f554d934…`, versionCode 10754. Web live at `465683c`.
- **1.7.55 (2026-10-30):** private read-only `/ops` status page for the two
relay admins, NIP-98-signed status endpoint fed by the host health timer;
admin link in Settings → Advanced. Added HSTS to relay/blossom and CAA
records limiting their certificates to Let’s Encrypt. APK sha256
`1142c425…`, versionCode 10755. Web live at `52a8447`.
### Relay archive (dataset backup) ### Relay archive (dataset backup)
- **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):** - **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):**
@ -3136,6 +3141,13 @@ The community relay moved off the hosted relay.tools instance
service, and >18 GiB media. App uploads now use **only** our Blossom; public service, and >18 GiB media. App uploads now use **only** our Blossom; public
mirrors are read-side fallbacks only, so a quota rejection cannot silently mirrors are read-side fallbacks only, so a quota rejection cannot silently
land on a third party. No video upload support was added. land on a third party. No video upload support was added.
**2026-10-30 — transport/ops hardening:** HSTS is set on `relay.` and
`blossom.` (`max-age=31536000; includeSubDomains`); CAA records restrict
issuance for those two hosts to `letsencrypt.org`. The health timer writes an
aggregate `/home/ubuntu/skatespots-quota/status.json`; the quota proxy serves
it at `https://relay.skate-spots.org/ops` only for a NIP-98-signed request
from one of the two admin pubkeys. `/ops` is a read-only app page linked from
Settings → Advanced (AdminReviewCard). No restart/config actions are exposed.
- **Cordn coordinator (2026-10-12):** the relay also runs Newlay's **embedded Cordn - **Cordn coordinator (2026-10-12):** the relay also runs Newlay's **embedded Cordn
coordinator** for crew MLS chat (`[cordn] enabled`, `mode = "embedded"`, coordinator** for crew MLS chat (`[cordn] enabled`, `mode = "embedded"`,
`data_dir = /var/lib/newlay/data/cordn` inside the volume, `relay_url = `data_dir = /var/lib/newlay/data/cordn` inside the volume, `relay_url =