807037ee9b
Our own keyless Bun service (not Linky's): watches relays for kind-1059 wraps
carrying the plaintext marker ["skatespots","push"] on the recipient copy,
extracts only {recipient, wrapId}, and sends a Web Push. NEVER decrypts - the
client fetches + decrypts the named wrap itself.
Endpoints: GET /health, GET /vapid-public-key, POST /auth/challenge ->
/subscribe|/unsubscribe with a one-time NIP-98 (kind 27235) challenge proof.
State is a JSON file; VAPID keys from env. Wired like the other standalone
servers (typecheck:push + check:push in npm test, deploy:push, Caddyfile +
systemd unit). Verified locally end-to-end: auth -> subscribe -> marked wrap ->
watcher -> push attempt, and proof replay rejected.
Client half (service worker, subscribe hook + Settings toggle, marker on DM
sends) is the next step.
28 lines
1.1 KiB
Desktop File
28 lines
1.1 KiB
Desktop File
# ─────────────────────────────────────────────────────────────────────────────
|
|
# systemd unit for the SkateSpots push service (Bun, on the CVM host).
|
|
# Installed by scripts/deploy-push.sh — do not hand-edit on the host.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
[Unit]
|
|
Description=SkateSpots push service
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=ubuntu
|
|
WorkingDirectory=/home/ubuntu/skatespots-push
|
|
EnvironmentFile=/home/ubuntu/skatespots-push/.env
|
|
ExecStart=/home/ubuntu/.bun/bin/bun run server.ts
|
|
Restart=always
|
|
RestartSec=5
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=skatespots-push
|
|
|
|
# Basic hardening — mirrors the AI proxy unit (bun stays happy; binds localhost).
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|