README's blockers still stand. To bring my.phast.app up on prod:
Create Fly app phast-app (fly.toml is here), a volume at /data, PHAST_DATA_DIR=/data (the registry refuses a non-mount).
Owner auth: replace the explicit mutation guard with caller identity from Gitea OAuth (Green Tea MCP pattern — teahubxyz/teahubmcp/), not a shared secret or env flag.
DNS: my.phast.app (and *.phast.app if the per-app subdomains are kept) currently point at the dead edge (66.241.124.48); move them to phast-app. The apex phast.app stays on Teahub pages (phast/site).
DONE: apps_list/get/create/update work through my.phast.app/mcp as a signed-in owner, and a created app survives a machine replacement.
README's blockers still stand. To bring `my.phast.app` up on prod:
1. Create Fly app `phast-app` (fly.toml is here), a volume at `/data`, `PHAST_DATA_DIR=/data` (the registry refuses a non-mount).
2. Owner auth: replace the explicit mutation guard with caller identity from Gitea OAuth (Green Tea MCP pattern — `teahubxyz/teahub` `mcp/`), not a shared secret or env flag.
3. DNS: `my.phast.app` (and `*.phast.app` if the per-app subdomains are kept) currently point at the dead edge (66.241.124.48); move them to `phast-app`. The apex phast.app stays on Teahub pages (`phast/site`).
DONE: `apps_list/get/create/update` work through `my.phast.app/mcp` as a signed-in owner, and a created app survives a machine replacement.
Done, by a different route than this card planned: the canonical matcha/phast already had the owner auth.
main is now matcha/phast@69bbbab merged in with its history (cbd4a28). The port had taken an older copy from tea-mcp/src, without OAuth and with the light design.
Fly app phast-app (iad, 1 machine, 512 MB). Volume phast_data at /data, with PHAST_DATA_DIR=/data/phast and FASTMCP_HOME=/data/fastmcp. start.sh hands those dirs to uid 10001 and drops root.
It serves phast.app, my.phast.app and *.phast.app. The two pages are this repo's index.html and my/index.html, so phast/site is retired. DNS moved off the dead edge; the certs for phast.app, my.phast.app and *.phast.app are issued.
Owner auth: Teahub OAuth app "Phast app" (owner teahubxyz, redirect https://my.phast.app/auth/callback). The client secret and JWT_SIGNING_KEY exist only as Fly secrets and were never printed. Who can sign in: ALLOWED_GITEA_USERS=matcha,chai.
matcha.phast.app (created Oct 4 on hb-5) moved over and serves its home.
Probe receipts (2026-10-14 22:10 UTC):
GET /healthz returns source_sha cbd4a28….
POST my.phast.app/mcp without a token returns 401 with resource_metadata set.
DCR /register returns 201. /authorize → consent → approve → 302 to teahub.xyz/login/oauth/authorize with the right redirect_uri, and Gitea answers 303 /user/login (the client id is valid).
Not exercised: an end-to-end sign-in as a real owner. That needs matcha to connect https://my.phast.app/mcp from an agent.
Done, by a different route than this card planned: the canonical `matcha/phast` already had the owner auth.
- `main` is now `matcha/phast@69bbbab` merged in with its history (cbd4a28). The port had taken an older copy from `tea-mcp/src`, without OAuth and with the light design.
- Fly app `phast-app` (iad, 1 machine, 512 MB). Volume `phast_data` at `/data`, with `PHAST_DATA_DIR=/data/phast` and `FASTMCP_HOME=/data/fastmcp`. `start.sh` hands those dirs to uid 10001 and drops root.
- It serves **phast.app, my.phast.app and `*.phast.app`**. The two pages are this repo's `index.html` and `my/index.html`, so `phast/site` is retired. DNS moved off the dead edge; the certs for `phast.app`, `my.phast.app` and `*.phast.app` are issued.
- Owner auth: Teahub OAuth app "Phast app" (owner `teahubxyz`, redirect `https://my.phast.app/auth/callback`). The client secret and `JWT_SIGNING_KEY` exist only as Fly secrets and were never printed. Who can sign in: `ALLOWED_GITEA_USERS=matcha,chai`.
- `matcha.phast.app` (created Oct 4 on hb-5) moved over and serves its home.
Probe receipts (2026-10-14 22:10 UTC):
- `GET /healthz` returns `source_sha cbd4a28…`.
- `POST my.phast.app/mcp` without a token returns 401 with `resource_metadata` set.
- DCR `/register` returns 201. `/authorize` → consent → approve → 302 to `teahub.xyz/login/oauth/authorize` with the right `redirect_uri`, and Gitea answers 303 `/user/login` (the client id is valid).
Not exercised: an end-to-end sign-in as a real owner. That needs matcha to connect `https://my.phast.app/mcp` from an agent.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
README's blockers still stand. To bring
my.phast.appup on prod:phast-app(fly.toml is here), a volume at/data,PHAST_DATA_DIR=/data(the registry refuses a non-mount).teahubxyz/teahubmcp/), not a shared secret or env flag.my.phast.app(and*.phast.appif the per-app subdomains are kept) currently point at the dead edge (66.241.124.48); move them tophast-app. The apex phast.app stays on Teahub pages (phast/site).DONE:
apps_list/get/create/updatework throughmy.phast.app/mcpas a signed-in owner, and a created app survives a machine replacement.Done, by a different route than this card planned: the canonical
matcha/phastalready had the owner auth.mainis nowmatcha/phast@69bbbabmerged in with its history (cbd4a28). The port had taken an older copy fromtea-mcp/src, without OAuth and with the light design.phast-app(iad, 1 machine, 512 MB). Volumephast_dataat/data, withPHAST_DATA_DIR=/data/phastandFASTMCP_HOME=/data/fastmcp.start.shhands those dirs to uid 10001 and drops root.*.phast.app. The two pages are this repo'sindex.htmlandmy/index.html, sophast/siteis retired. DNS moved off the dead edge; the certs forphast.app,my.phast.appand*.phast.appare issued.teahubxyz, redirecthttps://my.phast.app/auth/callback). The client secret andJWT_SIGNING_KEYexist only as Fly secrets and were never printed. Who can sign in:ALLOWED_GITEA_USERS=matcha,chai.matcha.phast.app(created Oct 4 on hb-5) moved over and serves its home.Probe receipts (2026-10-14 22:10 UTC):
GET /healthzreturnssource_sha cbd4a28….POST my.phast.app/mcpwithout a token returns 401 withresource_metadataset./registerreturns 201./authorize→ consent → approve → 302 toteahub.xyz/login/oauth/authorizewith the rightredirect_uri, and Gitea answers 303/user/login(the client id is valid).Not exercised: an end-to-end sign-in as a real owner. That needs matcha to connect
https://my.phast.app/mcpfrom an agent.