ident

4.8 KB

1. # Mission 006 (old 010) — ident per-IP limit + deploy scripts for ident and tickets
3. One-shot worker. The architect (Claude Code on Byrodin) verifies your report and does the first real
4. deploy to Byrodin himself. You do NOT touch Byrodin.
6. ## Read first
7. 1. `loreana:/media/STORAGE/projects/ident.worldapi.org/` `CONCEPT.md`, `README.md`, `STATUS.md`.
8. 2. `loreana:/media/STORAGE/projects/tickets.worldapi.org/` `README.md`, `STATUS.md`.
9. 3. `/CONTAINERS/projects/antcolony/README.md` — "Conventions for all apps", "Lessons learned".
10. 4. How notes.worldapi.org runs on Byrodin (the model): `/CONTAINERS/projects/notes.worldapi.org/README.md`
11. and `docker-compose.yml` (debian:12-slim, host network, app on 127.0.0.1:<port>, nginx proxies it,
12. TLS ends at nginx; the manifest declares NO baseUrl and NO tls — README explains why).
14. ## Hybriel (standard block)
15. Read `/CONTAINERS/projects/antcolony/docs/hybriel-for-app-workers.md` first. Report new Hybriel findings
16. under "Hybriel issues"; do not edit that guide.
18. ## Part 1 — ident: per-IP limit for code requests
19. Today the only limit is per email address (3 codes / 10 min), so a public ident could be used to mail
20. many addresses. Add a limit per client IP on code sends (your numbers; list them).
21. - **Client IP source**: behind nginx on Byrodin every request carries **`X-Client-IP`**, set by nginx
22. (`/CONTAINERS/web/nginx/conf.d/cloudflare-client-ip.conf`): the CF-Connecting-IP when the request
23. really came through Cloudflare, else the TCP peer. nginx always overwrites what a client sends, so
24. ident trusts `X-Client-IP` and nothing else (never `CF-Connecting-IP` / `X-Forwarded-For` directly).
25. - Without the header (dev on Loreana, no nginx): fall back to the connection's peer address if hl:webex
26. exposes one, else one shared bucket — say which.
27. - Both the web face and any API that triggers a mail are covered. Refusals are visible to the user.
28. - Gate: extend with per-IP cases (two IPs via the header, the limit hits one, not the other; the
29. header can't be bypassed by sending another IP header). Mail only into the sink.
31. ## Part 2 — deploy readiness for BOTH apps
32. Target on Byrodin (the architect creates it on first deploy):
33. | app | Byrodin folder | container | port (127.0.0.1) |
34. |---|---|---|---|
35. | ident | `/CONTAINERS/projects/ident.worldapi.org` | `ident.worldapi.org` | 45002 |
36. | tickets | `/CONTAINERS/projects/tickets.worldapi.org` | `tickets.worldapi.org` | 45003 |
37. For each app:
38. 1. A `docker-compose.yml` in the app folder (notes pattern: `debian:12-slim`, `network_mode: host`,
39. `restart: unless-stopped`, whole folder mounted, runs the vendored `bin/hybriel`). The app must bind
40. **127.0.0.1** on Byrodin (check how: HL_HOST or the app's own env; make it configurable, default
41. unchanged for dev). Port via env.
42. 2. A `deploy.sh` run ON LOREANA: refuses to run if any gate fails (or takes `--skip-tests`, loud);
43. rsyncs the code to `[email protected]:<Byrodin folder>` — **excluding** `storage/`, `.sessions/`,
44. `.env`, `.scratch/`, `server.*`, `testapp/`, logs; then restarts the container over ssh
45. (`docker compose up -d` / `restart`); then checks the public URL answers 200. Print every step.
46. Loreana's ssh to Byrodin: see ident STATUS (`ssh -F /dev/null [email protected]` may be needed).
47. **Write it, check it with `bash -n` and a `--dry-run` mode (rsync -n, no restart) — do NOT run it
48. for real and do NOT connect to Byrodin.** Dry-run output against Byrodin is also not allowed; test
49. the dry-run against a local target directory instead (make the target configurable).
50. 3. Behind a TLS-terminating proxy: make sure nothing emits `http://` absolute URLs and cookies still
51. work on https (notes' lesson). Check ident's session cookie and the selector/CORS code with an
52. `https://tickets.worldapi.org` origin in mind (apps registered with https origins).
53. 4. README of each app: "Deploy" section (first deploy is done by the architect; later: `./deploy.sh`).
55. ## Mail — IMPORTANT (unchanged)
56. ident's dev server on :8351 sends **real mail**. Never trigger an OTP on :8351. Gates use their own
57. servers with `IDENT_MAIL_SINK`. **Do not read, print, copy or edit any `.env`.**
59. ## Rules
60. - No git. Only kill your own PIDs or the named pid files. Clean up headless Chromes. Scratch in the
61. app's `.scratch/`. Do NOT POST to the live tickets server. Only ever open COPIES of mpackdb stores (#40).
62. - If any action is refused by the permission system, don't retry or work around it; report it.
63. - All existing gates of both apps must stay green. Restart the dev servers at the end as before
64. (ident: `server.pid`, `testapp/testapp.pid`; tickets: `server.pid`) and check 200.
65. - Update `README.md` / `STATUS.md` of both apps. Do NOT edit `CONCEPT.md`.
67. ## Report (final answer, this structure)
68. ```
69. ## Done
70. ## Verified (each: command run + observed output)
71. ## Not verified / open
72. ## Hybriel issues (repro, observed, expected)
73. ## Questions for the creator
74. ## Running (URL, PID, log path)
75. ```