807037ee9b
Our own keyless Bun service (not Linky's): watches relays for kind-1059 wraps
carrying the plaintext marker ["skatespots","push"] on the recipient copy,
extracts only {recipient, wrapId}, and sends a Web Push. NEVER decrypts - the
client fetches + decrypts the named wrap itself.
Endpoints: GET /health, GET /vapid-public-key, POST /auth/challenge ->
/subscribe|/unsubscribe with a one-time NIP-98 (kind 27235) challenge proof.
State is a JSON file; VAPID keys from env. Wired like the other standalone
servers (typecheck:push + check:push in npm test, deploy:push, Caddyfile +
systemd unit). Verified locally end-to-end: auth -> subscribe -> marked wrap ->
watcher -> push attempt, and proof replay rejected.
Client half (service worker, subscribe hook + Settings toggle, marker on DM
sends) is the next step.
26 lines
953 B
Text
26 lines
953 B
Text
# SkateSpots push service — copy to .env and fill in.
|
|
|
|
# Port to listen on (Caddy proxies to this).
|
|
PORT=8788
|
|
|
|
# VAPID keys for Web Push. Generate once with:
|
|
# node -e "console.log(require('web-push').generateVAPIDKeys())"
|
|
# Keep the private key secret. Changing these INVALIDATES all subscriptions.
|
|
PUSH_VAPID_SUBJECT=mailto:owner@skate-spots.org
|
|
PUSH_VAPID_PUBLIC_KEY=
|
|
PUSH_VAPID_PRIVATE_KEY=
|
|
|
|
# Relays to watch for push-marked kind-1059 wraps (comma-separated).
|
|
PUSH_RELAYS=wss://goskatespots.nostr1.com
|
|
|
|
# The plaintext push marker tag name on recipient wraps: ["<marker>", "push"].
|
|
PUSH_MARKER=skatespots
|
|
|
|
# Where subscriptions + challenges are stored.
|
|
PUSH_STORAGE_PATH=/home/ubuntu/skatespots-push/push-state.json
|
|
|
|
# How far back to look on each (re)subscribe, in seconds. Default 3 days.
|
|
PUSH_LOOKBACK_SECONDS=259200
|
|
|
|
# Origins allowed to call /subscribe (comma-separated).
|
|
PUSH_ALLOWED_ORIGINS=https://skate-spots.org,http://localhost:8080
|