Finish Persims consolidation
This commit is contained in:
matcha committed
1 parent
c755004684
commit
447eeaeba4
1 file changed
+144
@@ -0,0 +1,144 @@
|
||||
# Dedicated Persimmons identity and vaults
|
||||
|
||||
Persimmons keeps its existing product host and extension crypto. Signup provisions
|
||||
a non-admin user in **git.persimmons.app**, a dedicated Gitea on the Fly app
|
||||
**persimmons-gitea** with a single 1 GiB **persimmons_gitea_data** volume in iad.
|
||||
It does not use Teahub Gitea for product identities or repositories.
|
||||
|
||||
The independent `persimmons-launch.yml` Actions operator holds FLY_INFRA and
|
||||
CLOUD_DNS. It deploys the dedicated Gitea, establishes DNS/HTTPS, checks
|
||||
`/api/healthz` including database/cache, and runs a fixed bootstrap program via
|
||||
Fly Machines exec. The bootstrap creates the provisioning admin before any product
|
||||
signup, with a random unrecoverable login password and an API token scoped to
|
||||
`write:admin,read:user,read:repository`. A root-only 0700 directory/0600 file on
|
||||
the dedicated Gitea volume makes bootstrap resumable. The operator captures that
|
||||
credential response and stages it with `fly secrets import` stdin exclusively on
|
||||
**persimmons-app** as PERSIMMONS_GITEA_TOKEN. No provider credential is sent to
|
||||
product or Gitea runtime; no token enters argv, receipts, logs, source, or clients.
|
||||
Public Gitea registration and Actions are disabled; repositories are private.
|
||||
|
||||
The application has no generic admin proxy. It uses only fixed user provisioning,
|
||||
identity lookup and create-repository endpoints. Password login uses Basic auth
|
||||
over pinned HTTPS to Gitea `/api/v1/user` with redirects refused. Passwords and
|
||||
Gitea user tokens are not retained. Opaque 12-hour HttpOnly/Secure sessions contain
|
||||
only a digest, immutable Gitea ID, login, owner `pg-<id>`, and expiry in SQLite.
|
||||
Admin identities cannot sign in to the product. Username/email conflict is 409.
|
||||
Generated email aliases are private placeholders; no email delivery/recovery is
|
||||
implemented. Gitea account renames require a fresh product login for named vaults.
|
||||
Existing product sessions otherwise remain valid until logout or their expiry.
|
||||
|
||||
The first database open upgrades the disposable local schema to version 2. Under
|
||||
one transaction it drops only old users/sessions/throttle tables and the local
|
||||
`/data/human-vault.sqlite` human_items table. It never resets a version-2 store,
|
||||
and rejects unknown future schema versions. This is the explicitly authorized
|
||||
fresh-account reset. Existing browser keys use a different owner namespace and
|
||||
are not imported. Client-side wrapped keys and encrypted credential capture/fill
|
||||
remain unchanged, as do accepted server-visible origin/username metadata.
|
||||
|
||||
`GET /api/vaults` lists only recorded creations belonging to the authenticated
|
||||
user. `POST /api/vaults` accepts exactly `{name}` from the product origin with the
|
||||
Persimmons request header; caller-supplied owner, repo ID, or privacy is rejected.
|
||||
Whitespace becomes hyphens; valid names otherwise retain spelling. The service
|
||||
checks the live Gitea user ID before creating on behalf of that user, requests
|
||||
`private=true,auto_init=false`, and verifies both the creation response and a fresh
|
||||
GET for the same immutable repo ID, owner ID/login, privacy, and emptiness before
|
||||
recording it. Duplicate/existing repositories are conflicts, never imported.
|
||||
Lists recheck identity, repo ID, ownership and privacy; transferred, replaced or
|
||||
public repositories fail closed. An interrupted create can leave an empty private
|
||||
repo without a local record: retries conflict instead of silently adopting it.
|
||||
|
||||
Named vaults appear below Master vault. Empty repositories are valid. Juice,
|
||||
Actions/scoping, and credential rotation remain future work; retained legacy code
|
||||
and documentation are preserved. New named repositories can later host scoped
|
||||
credentials without changing Master-vault ownership or encryption.
|
||||
|
||||
Validation: `python persimmons/build.py`, standalone host/Gitea/UX tests, extension
|
||||
Node tests, operator HTTP acceptance, then `tests/persimmons-host-browser.cjs`
|
||||
against live UI/API. The live browser harness creates a fresh non-admin user,
|
||||
creates `work-test` through the modal, verifies it independently on Gitea, rejects
|
||||
a duplicate, links/initializes Master vault in the real extension, captures/fills
|
||||
without submitting, deletes the synthetic ciphertext, and verifies logout.
|
||||
Synthetic test identities and empty private repositories remain as evidence;
|
||||
passwords, sessions, and plaintext never appear in receipts.
|
||||
|
||||
Provider references: [Gitea CLI bootstrap and scoped tokens](https://docs.gitea.com/administration/command-line/),
|
||||
[Gitea create user API](https://docs.gitea.com/api/1.23/operations/admin-create-user/),
|
||||
[Gitea create repository on behalf of a user](https://docs.gitea.com/api/1.23/operations/admin-create-repo/),
|
||||
and [Fly Machines API](https://docs.fly.io/machines/api/machines-resource/).
|
||||
|
||||
## Accepted live deployment — 2026-10-01
|
||||
|
||||
**Done.** Deployed source **`2f8fcc8208205b30eaefc8d49ac1991c63ad47a1`**.
|
||||
[Persimmons launch run 1003](https://teahub.xyz/matcha/teahub/actions/runs/1003),
|
||||
job **1005**, completed successfully through the existing independent Actions
|
||||
operator. Provision/deploy/HTTP acceptance took **142.519 seconds**, finishing at
|
||||
04:28:40 UTC. Every operator deploy was preceded by an explicit fetch with
|
||||
HEAD = origin/main = source above, ahead 0 / behind 0 / dirty false. Initial base
|
||||
was `6580c3380554bb1ca38269a1883ec86b7330bd99`. No delegation occurred.
|
||||
|
||||
| Surface | Fly app / machine | Persistent volume | Image digest |
|
||||
| --- | --- | --- | --- |
|
||||
| `https://persimmons.app` | `persimmons-app` / `48e729dc5796e8`, release 28 | `vol_rkgqyxm5k2gxm064` (`persimmons_data`, existing 1 GiB) | `sha256:b414c01a4f70101fd39d35a81475f67494b69df4a38ef2d7234068d1dcc2ec96` |
|
||||
| `https://git.persimmons.app` | `persimmons-gitea` / `0800251ae09308` | `vol_r68lo8o2kwy38md4` (`persimmons_gitea_data`, new 1 GiB) | `sha256:e395e81c7ceb898179fe14d277b4650dc31c74dd94784c05de14446d212847a4` |
|
||||
|
||||
Both machines are in iad, one shared CPU and 512 MiB each. Dedicated Gitea image:
|
||||
`registry.fly.io/persimmons-gitea:deployment-01M3TVDC6PTEF627XDF3VFW1WJ`;
|
||||
product image:
|
||||
`registry.fly.io/persimmons-app:deployment-01M3TVGTF7VZ6HXS8BM85CZ3AW`.
|
||||
Image labels record the exact source above.
|
||||
|
||||
Cloudflare DNS-only records for `git.persimmons.app`: A **66.241.124.151**, AAAA
|
||||
**2a09:8280:1::1a2:6e84:0**, TTL 60. Valid HTTPS was independently exercised.
|
||||
Existing apex records remain A **66.241.124.82**, AAAA
|
||||
**2a09:8280:1::1a0:f8e1:0**. Gitea `/api/healthz` returned 200 and `pass` for both
|
||||
`database:ping` and `cache:ping` in Actions and independently at 04:29:46 UTC.
|
||||
Its public `/user/sign_up` returns a 200 notice saying registration is disabled;
|
||||
it does not offer user-registration inputs. Bootstrap completed automatically;
|
||||
no manual administrator step was required.
|
||||
|
||||
Live API acceptance created **probe-e84a6b84644740fda0d1**, immutable Gitea ID **2**,
|
||||
`is_admin=false`; its **probe-e84a6b84644740fda0d1/work-test**, repo ID **1**, was
|
||||
independently read using that user's own credentials and verified private/empty.
|
||||
Duplicate creation returned 409. Registration/login were 200, encrypted item
|
||||
creation 201, persisted read after logout/login 200, deletion/logout 200. The
|
||||
synthetic ciphertext and active session were removed.
|
||||
|
||||
A fresh Chromium **153.0.8010.12** profile then exercised the actual live page,
|
||||
without source/UI interception. Browser signup created
|
||||
**browser-04780a06f4a43a72**, Gitea ID **3**, `is_admin=false`. The **+ New vault**
|
||||
modal created **browser-04780a06f4a43a72/work-test**, repo ID **2**. Its name/owner
|
||||
and “Private · Empty vault” card appeared below Master vault; an independent
|
||||
Gitea API read confirmed owner ID 3, private=true, empty=true. Repeating the modal
|
||||
showed the duplicate-repository conflict.
|
||||
|
||||
The same browser linked and initialized Master vault using the real pinned
|
||||
extension **0.4.8** (`kiolgjoohhgdohcafgelhikpgkbmckbg`), captured a synthetic login
|
||||
at the real `https://wp.phly.cloud/wp-login.php`, locked/unlocked, explicitly filled
|
||||
both fields with **zero POST submissions**, deleted the synthetic item, and
|
||||
confirmed logout clears the extension connection. Homepage and popup lock state
|
||||
agreed. The harness pregrants the exact Persimmons extension host permission;
|
||||
it does not claim to click Chromium's native permission prompt. The disposable
|
||||
profile was removed. No existing human account or provider credential was used.
|
||||
|
||||
Local checks: **25 Python tests and 18 Node tests passed**. Actions repeated the
|
||||
standalone host/Gitea/UX contract suite (**20 Python tests**) and **18 Node tests**
|
||||
before provisioning. Coverage includes Gitea signup/login/session, duplicate user,
|
||||
Master-vault continuity, private/empty/owner checks, duplicate/no-import behavior,
|
||||
wrong-owner and replaced-repo rejection, request scoping, admin sign-in rejection,
|
||||
credential non-disclosure, one-time bounded reset, package/crypto/capture/fill,
|
||||
and the unchanged no-reveal MCP boundary. A pre-existing Node assertion expecting
|
||||
removed Juice popup controls was updated to the already-accepted human-only popup;
|
||||
legacy implementation and rotate/scoping documentation remain intact.
|
||||
|
||||
Both product URLs returned current health/source and nonempty UI/assets. The live
|
||||
app JS and extension ZIP match built candidate bytes exactly:
|
||||
|
||||
- app.js SHA-256: `706c12437ce1e53723aa54e39c861632477923cf41e32a71c5bdf0b3319c6972`
|
||||
- extension.zip SHA-256: `2ac21e6ac547073d8574ab99fd919645456085bcadf7a970a5ce06033d97097a`
|
||||
|
||||
The reset ran only against Persimmons' disposable local identity/session/human
|
||||
store when the new health check opened schema version 2. Teahub infrastructure,
|
||||
Gitea data, and unrelated apps were not changed. The two synthetic non-admin users
|
||||
and their empty private repositories remain as acceptance evidence. No Juice
|
||||
implementation was added. This receipt-only follow-up does not require another
|
||||
runtime deployment; the runtime/image source SHA is the one recorded above.
|
||||
Reference in new issue
Block a user