Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
  teahubxyzandClaude Opus 5.5
|
f8ba904341 |
No files matched your search
@@ -1,60 +0,0 @@
|
||||
name: cf-mint-token
|
||||
# Mints a narrowly scoped Cloudflare API token using the broad CROWD_FAIR secret,
|
||||
# then seals it to the caller's RSA public key so only the caller can read it.
|
||||
# The plaintext token never appears in logs.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
pubkey_b64:
|
||||
description: base64 of a PEM RSA public key (>=2048 bits)
|
||||
required: true
|
||||
name:
|
||||
description: token name
|
||||
required: true
|
||||
default: well-known-mail-deploy
|
||||
zone:
|
||||
description: zone name the token is scoped to
|
||||
required: true
|
||||
default: well-known.online
|
||||
jobs:
|
||||
mint:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: mint and seal
|
||||
env:
|
||||
CF: ${{ secrets.CROWD_FAIR }}
|
||||
PUB: ${{ inputs.pubkey_b64 }}
|
||||
TNAME: ${{ inputs.name }}
|
||||
ZNAME: ${{ inputs.zone }}
|
||||
run: |
|
||||
cat > /tmp/mint.mjs <<'EOF'
|
||||
import crypto from 'node:crypto';
|
||||
const H = { Authorization: `Bearer ${process.env.CF}`, 'Content-Type': 'application/json' };
|
||||
const api = async (p, o = {}) => { const r = await fetch('https://api.cloudflare.com/client/v4/' + p, { headers: H, ...o }); return r.json(); };
|
||||
const z = (await api('zones?name=' + process.env.ZNAME)).result?.[0];
|
||||
if (!z) throw new Error('zone not visible to CROWD_FAIR');
|
||||
const A = z.account.id, Z = z.id;
|
||||
let base = 'user/tokens';
|
||||
let pg = await api(base + '/permission_groups');
|
||||
if (!pg.success) { base = `accounts/${A}/tokens`; pg = await api(base + '/permission_groups'); }
|
||||
if (!pg.success) throw new Error('cannot list permission groups: ' + JSON.stringify(pg.errors));
|
||||
const want = {
|
||||
acct: ['Workers Scripts Write', 'Workers R2 Storage Write', 'Email Routing Addresses Write', 'Account Settings Read'],
|
||||
zone: ['Email Routing Rules Write', 'Zone Settings Write', 'DNS Write', 'Workers Routes Write', 'Zone Read'],
|
||||
};
|
||||
const pick = (names) => names.map((n) => { const g = pg.result.find((x) => x.name === n); if (!g) console.log('missing group:', n); return g && { id: g.id }; }).filter(Boolean);
|
||||
const body = {
|
||||
name: process.env.TNAME,
|
||||
policies: [
|
||||
{ effect: 'allow', resources: { [`com.cloudflare.api.account.${A}`]: '*' }, permission_groups: pick(want.acct) },
|
||||
{ effect: 'allow', resources: { [`com.cloudflare.api.account.zone.${Z}`]: '*' }, permission_groups: pick(want.zone) },
|
||||
],
|
||||
};
|
||||
const t = await api(base, { method: 'POST', body: JSON.stringify(body) });
|
||||
if (!t.success) throw new Error('create failed: ' + JSON.stringify(t.errors));
|
||||
const pub = Buffer.from(process.env.PUB, 'base64').toString();
|
||||
const sealed = crypto.publicEncrypt({ key: pub, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' }, Buffer.from(t.result.value));
|
||||
console.log('account', A, 'zone', Z, 'token id', t.result.id, 'via', base);
|
||||
console.log('SEALED=' + sealed.toString('base64'));
|
||||
EOF
|
||||
node /tmp/mint.mjs
|
||||
@@ -1,102 +0,0 @@
|
||||
name: mail-e2e
|
||||
# End-to-end check of internal mail between @well-known.online names on production.
|
||||
# Signs NIP-98 requests with the factory key (SNAIL_KNOWN) inside Actions; the key never leaves the runner.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
base: { description: mail base URL, required: true, default: https://mail.well-known.online }
|
||||
keep: { description: "keep test mail (true/false)", required: true, default: "false" }
|
||||
jobs:
|
||||
e2e:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: run
|
||||
env:
|
||||
K: ${{ secrets.SNAIL_KNOWN }}
|
||||
B: ${{ inputs.base }}
|
||||
KEEP: ${{ inputs.keep }}
|
||||
run: |
|
||||
mkdir -p /tmp/e2e && cd /tmp/e2e
|
||||
npm init -y >/dev/null && npm i --silent @noble/curves@1.9.7 >/dev/null
|
||||
cat > t.mjs <<'EOF'
|
||||
import { schnorr } from '@noble/curves/secp256k1';
|
||||
import { createHash } from 'node:crypto';
|
||||
const B = process.env.B, CH = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
|
||||
const toHex = (s) => { s = s.trim().toLowerCase(); if (/^[0-9a-f]{64}$/.test(s)) return s;
|
||||
const d = [...s.slice(s.lastIndexOf('1') + 1)].map((c) => CH.indexOf(c)).slice(0, -6); let a = 0, b = 0; const o = [];
|
||||
for (const v of d) { a = (a << 5) | v; b += 5; while (b >= 8) { b -= 8; o.push((a >> b) & 255); } } return Buffer.from(o).toString('hex'); };
|
||||
const sk = toHex(process.env.K), pk = Buffer.from(schnorr.getPublicKey(sk)).toString('hex');
|
||||
const nip98 = (url, method) => { const ev = { pubkey: pk, created_at: Math.floor(Date.now() / 1000), kind: 27235, tags: [['u', url.split('?')[0]], ['method', method]], content: '' };
|
||||
ev.id = createHash('sha256').update(JSON.stringify([0, ev.pubkey, ev.created_at, ev.kind, ev.tags, ev.content])).digest('hex');
|
||||
ev.sig = Buffer.from(schnorr.sign(ev.id, sk)).toString('hex'); return 'Nostr ' + Buffer.from(JSON.stringify(ev)).toString('base64'); };
|
||||
const api = async (method, path, body) => { const url = B + path; const r = await fetch(url, { method, headers: { authorization: nip98(url, method), 'content-type': 'application/json' }, body: body ? JSON.stringify(body) : undefined });
|
||||
const t = await r.text(); let j; try { j = JSON.parse(t); } catch { j = t; } return { status: r.status, j }; };
|
||||
const GET = 'get@well-known.online', UNI = 'uniqornlabz@well-known.online', mb = (m) => `/api/v1/mailboxes/${encodeURIComponent(m)}`;
|
||||
const tag = 'e2e-' + Date.now(); let fails = 0; const made = [];
|
||||
const check = (name, ok, extra = '') => { console.log(`${ok ? 'PASS' : 'FAIL'} ${name}${extra ? ' ' + extra : ''}`); if (!ok) fails++; };
|
||||
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
|
||||
const find = async (m, folder, subj) => { for (let i = 0; i < 10; i++) { const r = await api('GET', `${mb(m)}/emails?folder=${folder}&limit=50`);
|
||||
const e = (r.j.emails || []).find((x) => x.subject === subj); if (e) return e; await sleep(1500); } return null; };
|
||||
|
||||
// 1. API send get@ -> uniqornlabz@
|
||||
const s1 = `${tag} hello`;
|
||||
let r = await api('POST', `${mb(GET)}/emails`, { to: UNI, from: GET, subject: s1, text: 'internal hello', html: '<p>internal hello</p>' });
|
||||
check('api send get@ -> uniqornlabz@ accepted', r.status === 202, `${r.status} ${JSON.stringify(r.j).slice(0, 120)}`);
|
||||
const inb1 = await find(UNI, 'inbox', s1), sent1 = await find(GET, 'sent', s1);
|
||||
check('delivered to uniqornlabz@ INBOX', !!inb1); check('sender keeps SENT copy', !!sent1);
|
||||
if (inb1) made.push([UNI, inb1.id]); if (sent1) made.push([GET, sent1.id]);
|
||||
if (inb1) check('from header is the sender mailbox', (inb1.sender || '').toLowerCase() === GET, inb1.sender);
|
||||
|
||||
// 2. gates
|
||||
r = await api('POST', `${mb(GET)}/emails`, { to: 'someone@example.com', from: GET, subject: `${tag} ext`, text: 'x' });
|
||||
check('external recipient refused', r.status === 422 && /external/i.test(JSON.stringify(r.j)), `${r.status} ${JSON.stringify(r.j).slice(0, 140)}`);
|
||||
r = await api('POST', `${mb(GET)}/emails`, { to: [UNI, 'someone@example.com'], from: GET, subject: `${tag} mixed`, text: 'x' });
|
||||
check('mixed internal+external refused whole send', r.status === 422);
|
||||
check('nothing delivered for refused mixed send', !(await (async () => { await sleep(2000); const x = await api('GET', `${mb(UNI)}/emails?folder=inbox&limit=50`); return (x.j.emails || []).some((e) => e.subject === `${tag} mixed`); })()));
|
||||
r = await api('POST', `${mb(GET)}/emails`, { to: `nobody-${tag}@well-known.online`, from: GET, subject: `${tag} nobody`, text: 'x' });
|
||||
check('non-receiving name refused', r.status === 422 && /can't receive/i.test(JSON.stringify(r.j)), `${r.status} ${JSON.stringify(r.j).slice(0, 140)}`);
|
||||
r = await api('POST', `${mb(GET)}/emails`, { to: UNI, from: UNI, subject: `${tag} spoof`, text: 'x' });
|
||||
check('from must be the sending mailbox', r.status === 400, String(r.status));
|
||||
|
||||
// 3. API reply uniqornlabz@ -> get@ threads in both mailboxes
|
||||
if (inb1) {
|
||||
r = await api('POST', `${mb(UNI)}/emails/${inb1.id}/reply`, { to: GET, from: UNI, subject: `Re: ${s1}`, text: 'reply via api', html: '<p>reply via api</p>' });
|
||||
check('api reply accepted', r.status === 202, `${r.status} ${JSON.stringify(r.j).slice(0, 120)}`);
|
||||
const inb2 = await find(GET, 'inbox', `Re: ${s1}`), sent2 = await find(UNI, 'sent', `Re: ${s1}`);
|
||||
check('reply delivered to get@ INBOX', !!inb2); if (inb2) made.push([GET, inb2.id]); if (sent2) made.push([UNI, sent2.id]);
|
||||
check('reply threads with original in get@', !!(inb2 && sent1 && inb2.thread_id === sent1.thread_id), `${inb2?.thread_id} vs ${sent1?.thread_id}`);
|
||||
check('reply threads with original in uniqornlabz@', !!(sent2 && sent2.thread_id === inb1.thread_id), `${sent2?.thread_id} vs ${inb1.thread_id}`);
|
||||
|
||||
// 4. MCP send_reply get@ -> uniqornlabz@ via the signer token flow
|
||||
const tr = await fetch(B + '/auth/mcp-token', { method: 'POST', headers: { authorization: nip98(B + '/auth/mcp-token', 'POST') } });
|
||||
const tj = await tr.json(); const tok = tj.access_token || tj.token;
|
||||
check('mcp token issued', tr.status === 200 && !!tok, String(tr.status));
|
||||
const H = { 'content-type': 'application/json', accept: 'application/json, text/event-stream', authorization: 'Bearer ' + tok };
|
||||
const rpc = async (body, sid) => { const x = await fetch(B + '/mcp', { method: 'POST', headers: sid ? { ...H, 'mcp-session-id': sid } : H, body: JSON.stringify(body) });
|
||||
const t = await x.text(); const m = t.match(/data: (.*)/); return { x, j: m ? JSON.parse(m[1]) : (t ? JSON.parse(t) : null) }; };
|
||||
let { x, j } = await rpc({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'mail-e2e', version: '0' } } });
|
||||
const sid = x.headers.get('mcp-session-id'); await rpc({ jsonrpc: '2.0', method: 'notifications/initialized' }, sid);
|
||||
if (inb2) {
|
||||
({ j } = await rpc({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'send_reply', arguments: { mailboxId: GET, originalEmailId: inb2.id, to: UNI, subject: `Re: ${s1}`, bodyHtml: '<p>Thanks, this is a reply sent over MCP between two well-known names.</p>' } } }, sid));
|
||||
const txt = j?.result?.content?.[0]?.text || JSON.stringify(j);
|
||||
check('mcp send_reply ok', !j?.result?.isError && /sent/i.test(txt), txt.slice(0, 140));
|
||||
await sleep(2500);
|
||||
const list = await api('GET', `${mb(UNI)}/emails?folder=inbox&limit=50`);
|
||||
const thread = (list.j.emails || []).filter((e) => e.thread_id === inb1.thread_id);
|
||||
check('mcp reply lands in the same uniqornlabz@ thread', thread.length >= 2, `${thread.length} in thread`);
|
||||
for (const e of thread) if (e.id !== inb1.id) made.push([UNI, e.id]);
|
||||
const gs = await api('GET', `${mb(GET)}/emails?folder=sent&limit=50`);
|
||||
for (const e of (gs.j.emails || []).filter((e) => e.subject === `Re: ${s1}`)) made.push([GET, e.id]);
|
||||
}
|
||||
({ j } = await rpc({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'send_email', arguments: { mailboxId: GET, to: 'someone@example.com', subject: `${tag} mcp ext`, bodyHtml: '<p>x</p>' } } }, sid));
|
||||
const t3 = j?.result?.content?.[0]?.text || JSON.stringify(j);
|
||||
check('mcp send_email to external refused', /external/i.test(t3), t3.slice(0, 140));
|
||||
const gs2 = await api('GET', `${mb(GET)}/emails?folder=sent&limit=50`);
|
||||
check('refused mcp send leaves no SENT copy', !(gs2.j.emails || []).some((e) => e.subject === `${tag} mcp ext`));
|
||||
}
|
||||
|
||||
// 5. cleanup
|
||||
if (process.env.KEEP !== 'true') { let n = 0; for (const [m, id] of made) { const d = await api('DELETE', `${mb(m)}/emails/${id}`); if (d.status < 300) n++; } console.log(`cleanup: deleted ${n}/${made.length}`); }
|
||||
console.log(fails ? `FAILED: ${fails}` : 'ALL PASS'); process.exit(fails ? 1 : 0);
|
||||
EOF
|
||||
node t.mjs
|
||||
@@ -1,71 +0,0 @@
|
||||
name: nostr-publish
|
||||
# Sign nostr events with one of the factory's account keys and publish them to relays.
|
||||
# Keys live only in Actions secrets: factory = SNAIL_KNOWN (uniqornlabz), well-known = WK_NSEC.
|
||||
# Input `events` is a JSON array of {kind, content, tags?}; content may be a string or an object (kind-0 profile).
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
account:
|
||||
description: factory | well-known
|
||||
required: true
|
||||
default: factory
|
||||
events:
|
||||
description: 'JSON array: [{"kind":0,"content":{...}},{"kind":1,"content":"..."}]'
|
||||
required: true
|
||||
relays:
|
||||
description: comma-separated relay URLs
|
||||
required: true
|
||||
default: wss://relay.damus.io,wss://nos.lol,wss://relay.primal.net
|
||||
jobs:
|
||||
publish:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: sign and publish
|
||||
env:
|
||||
ACCOUNT: ${{ inputs.account }}
|
||||
K_FACTORY: ${{ secrets.SNAIL_KNOWN }}
|
||||
K_WK: ${{ secrets.WK_NSEC }}
|
||||
EVENTS: ${{ inputs.events }}
|
||||
RELAYS: ${{ inputs.relays }}
|
||||
run: |
|
||||
mkdir -p /tmp/np && cd /tmp/np
|
||||
npm init -y >/dev/null && npm i --silent @noble/curves@1.9.7 >/dev/null
|
||||
cat > p.mjs <<'EOF'
|
||||
import { schnorr } from '@noble/curves/secp256k1';
|
||||
import { createHash } from 'node:crypto';
|
||||
const CH = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
|
||||
const toHex = (s) => {
|
||||
s = (s || '').trim().toLowerCase();
|
||||
if (/^[0-9a-f]{64}$/.test(s)) return s;
|
||||
const d = [...s.slice(s.lastIndexOf('1') + 1)].map((c) => CH.indexOf(c)).slice(0, -6);
|
||||
let acc = 0, bits = 0; const out = [];
|
||||
for (const v of d) { acc = (acc << 5) | v; bits += 5; while (bits >= 8) { bits -= 8; out.push((acc >> bits) & 255); } }
|
||||
return Buffer.from(out).toString('hex');
|
||||
};
|
||||
const raw = { factory: process.env.K_FACTORY, 'well-known': process.env.K_WK }[process.env.ACCOUNT];
|
||||
if (!raw) { console.error('unknown account or missing secret'); process.exit(1); }
|
||||
const sk = toHex(raw);
|
||||
const pubkey = Buffer.from(schnorr.getPublicKey(sk)).toString('hex');
|
||||
console.log('account', process.env.ACCOUNT, 'pubkey', pubkey);
|
||||
const relays = process.env.RELAYS.split(',').map((s) => s.trim()).filter(Boolean);
|
||||
const publish = (url, ev) => new Promise((resolve) => {
|
||||
let done = false; const fin = (r) => { if (!done) { done = true; try { ws.close(); } catch {} resolve(r); } };
|
||||
const ws = new WebSocket(url);
|
||||
const t = setTimeout(() => fin('timeout'), 8000);
|
||||
ws.onopen = () => ws.send(JSON.stringify(['EVENT', ev]));
|
||||
ws.onmessage = (m) => { try { const x = JSON.parse(m.data); if (x[0] === 'OK' && x[1] === ev.id) { clearTimeout(t); fin(x[2] ? 'ok' : 'rejected: ' + x[3]); } } catch {} };
|
||||
ws.onerror = () => { clearTimeout(t); fin('error'); };
|
||||
});
|
||||
let i = 0;
|
||||
for (const e of JSON.parse(process.env.EVENTS)) {
|
||||
const ev = { pubkey, created_at: Math.floor(Date.now() / 1000) + i++, kind: e.kind,
|
||||
tags: e.tags || [], content: typeof e.content === 'string' ? e.content : JSON.stringify(e.content) };
|
||||
ev.id = createHash('sha256').update(JSON.stringify([0, ev.pubkey, ev.created_at, ev.kind, ev.tags, ev.content])).digest('hex');
|
||||
ev.sig = Buffer.from(schnorr.sign(ev.id, sk)).toString('hex');
|
||||
const res = await Promise.all(relays.map(async (r) => [r, await publish(r, ev)]));
|
||||
const ok = res.filter(([, s]) => s === 'ok').length;
|
||||
console.log(`kind ${ev.kind} id ${ev.id}: ${ok}/${relays.length} ok`, JSON.stringify(Object.fromEntries(res)));
|
||||
if (!ok) process.exitCode = 1;
|
||||
}
|
||||
EOF
|
||||
node p.mjs
|
||||
@@ -1,110 +0,0 @@
|
||||
name: og-badges
|
||||
# NIP-58 OG badge for well-known.online, run every 15 minutes (and on demand).
|
||||
# 1. Ensures the badge definition (kind 30009, d=og) by the well-known account (WK_NSEC) is on the relays.
|
||||
# 2. Diffs og.well-known.online/.well-known/nostr.json against existing awards (kind 8, #a=30009:<wk>:og)
|
||||
# on the relays and awards only keys that don't have it yet, so repeat runs are no-ops.
|
||||
# 3. Our own keys (factory = SNAIL_KNOWN, well-known = WK_NSEC) accept their award via a kind-30008
|
||||
# profile_badges list, so clients show it on those profiles.
|
||||
on:
|
||||
schedule:
|
||||
- cron: '*/15 * * * *'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
republish_definition:
|
||||
description: re-sign the definition even if one exists (true/false)
|
||||
required: false
|
||||
default: 'false'
|
||||
jobs:
|
||||
badges:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 8
|
||||
steps:
|
||||
- name: define, diff, award
|
||||
env:
|
||||
K_WK: ${{ secrets.WK_NSEC }}
|
||||
K_FACTORY: ${{ secrets.SNAIL_KNOWN }}
|
||||
REPUBLISH: ${{ inputs.republish_definition }}
|
||||
RELAYS: wss://relay.damus.io,wss://nos.lol,wss://relay.primal.net
|
||||
OG_DIR: https://og.well-known.online/.well-known/nostr.json
|
||||
run: |
|
||||
mkdir -p /tmp/ob && cd /tmp/ob
|
||||
npm init -y >/dev/null && npm i --silent @noble/curves@1.9.7 >/dev/null
|
||||
cat > b.mjs <<'EOF'
|
||||
import { schnorr } from '@noble/curves/secp256k1';
|
||||
import { createHash } from 'node:crypto';
|
||||
const CH = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
|
||||
const toHex = (s) => {
|
||||
s = (s || '').trim().toLowerCase();
|
||||
if (/^[0-9a-f]{64}$/.test(s)) return s;
|
||||
const d = [...s.slice(s.lastIndexOf('1') + 1)].map((c) => CH.indexOf(c)).slice(0, -6);
|
||||
let acc = 0, bits = 0; const out = [];
|
||||
for (const v of d) { acc = (acc << 5) | v; bits += 5; while (bits >= 8) { bits -= 8; out.push((acc >> bits) & 255); } }
|
||||
return Buffer.from(out).toString('hex');
|
||||
};
|
||||
const key = (raw) => { const sk = toHex(raw); return { sk, pk: Buffer.from(schnorr.getPublicKey(sk)).toString('hex') }; };
|
||||
if (!process.env.K_WK) { console.error('WK_NSEC missing'); process.exit(1); }
|
||||
const WK = key(process.env.K_WK);
|
||||
const FACTORY = process.env.K_FACTORY ? key(process.env.K_FACTORY) : null;
|
||||
const RELAYS = process.env.RELAYS.split(',').map((s) => s.trim()).filter(Boolean);
|
||||
const A = `30009:${WK.pk}:og`;
|
||||
const now = () => Math.floor(Date.now() / 1000);
|
||||
const sign = (k, kind, tags, content = '') => {
|
||||
const ev = { pubkey: k.pk, created_at: now(), kind, tags, content };
|
||||
ev.id = createHash('sha256').update(JSON.stringify([0, ev.pubkey, ev.created_at, ev.kind, ev.tags, ev.content])).digest('hex');
|
||||
ev.sig = Buffer.from(schnorr.sign(ev.id, k.sk)).toString('hex');
|
||||
return ev;
|
||||
};
|
||||
const ws = (url, onopen, onmsg, ms) => new Promise((resolve) => {
|
||||
let done = false, sock; const fin = (r) => { if (!done) { done = true; try { sock.close(); } catch {} resolve(r); } };
|
||||
const t = setTimeout(() => fin('timeout'), ms);
|
||||
try { sock = new WebSocket(url); } catch { clearTimeout(t); return fin('error'); }
|
||||
sock.onopen = () => onopen(sock);
|
||||
sock.onmessage = (m) => { let x; try { x = JSON.parse(m.data); } catch { return; } const r = onmsg(x); if (r !== undefined) { clearTimeout(t); fin(r); } };
|
||||
sock.onerror = () => { clearTimeout(t); fin('error'); };
|
||||
});
|
||||
const query = async (filter) => {
|
||||
const seen = new Map();
|
||||
await Promise.all(RELAYS.map((url) => ws(url, (s) => s.send(JSON.stringify(['REQ', 'q', filter])),
|
||||
(x) => { if (x[0] === 'EVENT' && x[1] === 'q') seen.set(x[2].id, x[2]); else if (x[0] === 'EOSE') return 'eose'; }, 8000)));
|
||||
return [...seen.values()];
|
||||
};
|
||||
const publish = async (ev, label) => {
|
||||
const res = await Promise.all(RELAYS.map(async (url) => [url, await ws(url, (s) => s.send(JSON.stringify(['EVENT', ev])),
|
||||
(x) => (x[0] === 'OK' && x[1] === ev.id ? (x[2] ? 'ok' : 'rejected: ' + x[3]) : undefined), 8000)]));
|
||||
const ok = res.filter(([, r]) => r === 'ok').length;
|
||||
console.log(`${label}: kind ${ev.kind} id ${ev.id} ${ok}/${RELAYS.length}`, JSON.stringify(Object.fromEntries(res)));
|
||||
if (!ok) process.exitCode = 1;
|
||||
return ok;
|
||||
};
|
||||
// 1. definition
|
||||
const defs = await query({ kinds: [30009], authors: [WK.pk], '#d': ['og'] });
|
||||
if (!defs.length || process.env.REPUBLISH === 'true') {
|
||||
const img = 'https://well-known.online/badges/og.png';
|
||||
await publish(sign(WK, 30009, [['d', 'og'], ['name', 'OG'],
|
||||
['description', 'One of the first names on well-known.online: an OG handle, with a free inbox at name@well-known.online.'],
|
||||
['image', img, '512x512'], ['thumb', img, '512x512']]), 'definition');
|
||||
} else console.log('definition: present', defs[0].id);
|
||||
// 2. diff directory vs awards
|
||||
const dir = await (await fetch(process.env.OG_DIR)).json();
|
||||
const ogKeys = [...new Set(Object.values(dir.names || {}).map((k) => String(k).toLowerCase()).filter((k) => /^[0-9a-f]{64}$/.test(k)))];
|
||||
const awards = await query({ kinds: [8], authors: [WK.pk], '#a': [A] });
|
||||
const awarded = new Set(awards.flatMap((e) => e.tags.filter((t) => t[0] === 'p').map((t) => t[1])));
|
||||
const missing = ogKeys.filter((k) => !awarded.has(k));
|
||||
console.log(`og directory: ${ogKeys.length} keys; already awarded: ${awarded.size}; to award: ${missing.length}`);
|
||||
for (let i = 0; i < missing.length; i += 50) {
|
||||
await publish(sign(WK, 8, [['a', A], ...missing.slice(i, i + 50).map((p) => ['p', p, RELAYS[0]])]), 'award');
|
||||
}
|
||||
// 3. our own keys accept (kind 30008 profile_badges), once
|
||||
const allAwards = missing.length ? await query({ kinds: [8], authors: [WK.pk], '#a': [A] }) : awards;
|
||||
for (const [label, k] of [['factory', FACTORY], ['well-known', WK]]) {
|
||||
if (!k || !ogKeys.includes(k.pk)) continue;
|
||||
const award = allAwards.find((e) => e.tags.some((t) => t[0] === 'p' && t[1] === k.pk));
|
||||
if (!award) continue;
|
||||
const pb = await query({ kinds: [30008], authors: [k.pk], '#d': ['profile_badges'] });
|
||||
const latest = pb.sort((a, b) => b.created_at - a.created_at)[0];
|
||||
if (latest && latest.tags.some((t) => t[0] === 'a' && t[1] === A)) { console.log(`${label}: profile_badges already lists OG`); continue; }
|
||||
const keep = latest ? latest.tags.filter((t) => t[0] !== 'd') : [];
|
||||
await publish(sign(k, 30008, [['d', 'profile_badges'], ...keep, ['a', A], ['e', award.id, RELAYS[0]]]), `${label} accept`);
|
||||
}
|
||||
EOF
|
||||
node b.mjs
|
||||
@@ -1,58 +0,0 @@
|
||||
name: wk-house
|
||||
# Assign well-known.online "house" handles to a pubkey (default: the factory key) via POST /house,
|
||||
# signed with the factory nsec (SNAIL_KNOWN). The key never appears in logs.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
names:
|
||||
description: comma-separated names
|
||||
required: true
|
||||
og:
|
||||
description: list in og.well-known.online (free inbox)
|
||||
required: true
|
||||
default: 'true'
|
||||
pubkey:
|
||||
description: owner pubkey (hex or npub); empty = the factory key
|
||||
required: false
|
||||
default: ''
|
||||
jobs:
|
||||
house:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: assign
|
||||
env:
|
||||
NSEC: ${{ secrets.SNAIL_KNOWN }}
|
||||
NAMES: ${{ inputs.names }}
|
||||
OG: ${{ inputs.og }}
|
||||
OWNER: ${{ inputs.pubkey }}
|
||||
run: |
|
||||
mkdir -p /tmp/h && cd /tmp/h
|
||||
npm init -y >/dev/null && npm i --silent @noble/curves@1.9.7 >/dev/null
|
||||
cat > h.mjs <<'EOF'
|
||||
import { schnorr } from '@noble/curves/secp256k1';
|
||||
import { createHash } from 'node:crypto';
|
||||
const CH = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
|
||||
function nsecToHex(s) {
|
||||
s = s.trim().toLowerCase();
|
||||
if (/^[0-9a-f]{64}$/.test(s)) return s;
|
||||
const d = [...s.slice(s.lastIndexOf('1') + 1)].map((c) => CH.indexOf(c)).slice(0, -6);
|
||||
let acc = 0, bits = 0; const out = [];
|
||||
for (const v of d) { acc = (acc << 5) | v; bits += 5; while (bits >= 8) { bits -= 8; out.push((acc >> bits) & 255); } }
|
||||
return Buffer.from(out).toString('hex');
|
||||
}
|
||||
const sk = nsecToHex(process.env.NSEC);
|
||||
const pk = Buffer.from(schnorr.getPublicKey(sk)).toString('hex');
|
||||
console.log('signer', pk);
|
||||
let i = 0;
|
||||
for (const name of process.env.NAMES.split(',').map((s) => s.trim()).filter(Boolean)) {
|
||||
const ev = { pubkey: pk, created_at: Math.floor(Date.now() / 1000), kind: 27235, content: String(i++),
|
||||
tags: [['u', 'https://well-known.online/house'], ['method', 'POST'], ['name', name]] };
|
||||
ev.id = createHash('sha256').update(JSON.stringify([0, ev.pubkey, ev.created_at, ev.kind, ev.tags, ev.content])).digest('hex');
|
||||
ev.sig = Buffer.from(schnorr.sign(ev.id, sk)).toString('hex');
|
||||
const body = { event: ev, og: process.env.OG === 'true', ...(process.env.OWNER ? { pubkey: process.env.OWNER } : {}) };
|
||||
const r = await fetch('https://well-known.online/house', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
|
||||
console.log(name, r.status, await r.text());
|
||||
if (r.status >= 300) process.exitCode = 1;
|
||||
}
|
||||
EOF
|
||||
node h.mjs
|
||||
+1
-1
@@ -6,7 +6,7 @@ primary_region = "iad"
|
||||
|
||||
[env]
|
||||
GITEA_URL = "https://teahub.xyz"
|
||||
PAGES_SITES = '{"persimmons.app":"persimmons/app","phly.cloud":"phly/site","supertestnet.lol":"supertestnet/app#pages","yolopreneur.lol":"teahubxyz/time#gh-pages/ventures","gandora.lol":"gandora/site","www.gandora.lol":"gandora/site","gandora.yolopreneur.lol":"gandora/site","dev.gandora.lol":"gandora/site#dev","asmr.gandora.lol":"gandora/site#main/asmr","maths.teahub.xyz":"maths/site"}'
|
||||
PAGES_SITES = '{"persimmons.app":"persimmons/app","phly.cloud":"phly/site","supertestnet.lol":"supertestnet/app#pages","yolopreneur.lol":"teahubxyz/time#gh-pages/ventures","gandora.lol":"gandora/site","www.gandora.lol":"gandora/site","gandora.yolopreneur.lol":"gandora/site","dev.gandora.lol":"gandora/site#dev","asmr.gandora.lol":"gandora/site#main/asmr"}'
|
||||
PAGES_WILDCARDS = '{"yolopreneur.lol":"teahubxyz/time#gh-pages/ventures"}'
|
||||
PAGES_PULL_SECONDS = "300"
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
// teahub plugin: webamp — a Winamp-style player docked on every Teahub page.
|
||||
// Loads Webamp from the CDN on first click, so pages stay fast for everyone else.
|
||||
// Loads the self-hosted Webamp bundle on first click, so pages stay fast for everyone else.
|
||||
|
||||
// Module scripts have no document.currentScript, so find our tag by its data attribute.
|
||||
// Module scripts have no document.currentScript, so find our tag by its src.
|
||||
const script = document.querySelector('script[src*="plugins/webamp/webamp-mod.js"]');
|
||||
const PLAYLIST_URL = script?.dataset.playlist;
|
||||
const KEY = 'teahub-webamp-open';
|
||||
@@ -56,12 +56,7 @@ function loadWebamp() {
|
||||
}
|
||||
|
||||
async function open() {
|
||||
if (webamp) {
|
||||
// Already open (maybe off-screen or hidden): close and reopen so it lands centered in view.
|
||||
webamp.dispose();
|
||||
webamp = null;
|
||||
document.getElementById('teahub-webamp')?.remove();
|
||||
}
|
||||
if (webamp) return;
|
||||
btn.textContent = '… webamp';
|
||||
try {
|
||||
const Webamp = await loadWebamp();
|
||||
@@ -74,8 +69,6 @@ async function open() {
|
||||
});
|
||||
const host = document.createElement('div');
|
||||
host.id = 'teahub-webamp';
|
||||
// Webamp centers itself in this node, so make it exactly the visible viewport.
|
||||
host.style.cssText = 'position:fixed;left:0;top:0;width:100vw;height:100vh;pointer-events:none';
|
||||
document.body.appendChild(host);
|
||||
await webamp.renderWhenReady(host);
|
||||
try { localStorage.setItem(KEY, '1'); } catch {}
|
||||
@@ -88,17 +81,12 @@ async function open() {
|
||||
}
|
||||
}
|
||||
|
||||
// Keep Webamp pinned to the viewport and above Gitea's own layers.
|
||||
const style = document.createElement('style');
|
||||
style.textContent = '#webamp{position:fixed!important;z-index:99990!important}';
|
||||
document.head.appendChild(style);
|
||||
|
||||
// Small launcher in the corner: the "sound system" button.
|
||||
const btn = document.createElement('button');
|
||||
btn.textContent = '▶ webamp';
|
||||
btn.title = 'Open Webamp';
|
||||
btn.style.cssText = [
|
||||
'position:fixed', 'right:12px', 'bottom:12px', 'z-index:99999',
|
||||
'position:fixed', 'right:12px', 'bottom:12px', 'z-index:9999',
|
||||
'font:12px/1 monospace', 'padding:6px 10px', 'border-radius:4px',
|
||||
'border:1px solid #1d3', 'background:#000', 'color:#1d3', 'cursor:pointer',
|
||||
].join(';');
|
||||
|
||||
@@ -1,2 +1,2 @@
|
||||
{{/* teahub plugin: webamp */}}
|
||||
<script type="module" nonce="{{ctx.CspScriptNonce}}" src="{{AssetUrlPrefix}}/plugins/webamp/webamp-mod.js?v=015"></script>
|
||||
<script type="module" nonce="{{ctx.CspScriptNonce}}" src="{{AssetUrlPrefix}}/plugins/webamp/webamp-mod.js?v=012" data-playlist="https://gandora.yolopreneur.lol/playlist.json"></script>
|
||||
@@ -1,20 +0,0 @@
|
||||
# gitea-runner (act_runner 5.0.0) config for Fly app green-tea-runner.
|
||||
# Mounted at /etc/gitea-runner/config.yaml via fly.toml [[files]]; CONFIG_FILE points at it.
|
||||
log:
|
||||
level: info
|
||||
runner:
|
||||
file: /data/.runner # registration state lives on the volume
|
||||
capacity: 1
|
||||
# Root cause of "job taken, container never starts" (Oct 25 2026): FetchTask to teahub.xyz
|
||||
# sometimes takes >5s; the default 5s fetch_timeout made the runner abandon a task the
|
||||
# server had already assigned, leaving it in_progress with no logs until Gitea's zombie
|
||||
# sweep failed it (~15 min). Give the call room.
|
||||
fetch_timeout: 30s
|
||||
fetch_interval: 2s
|
||||
fetch_interval_max: 10s
|
||||
# Fail a hung job in 1h instead of the 3h default.
|
||||
timeout: 1h
|
||||
shutdown_timeout: 60s
|
||||
report_close_timeout: 10s
|
||||
container:
|
||||
force_pull: false
|
||||
@@ -1,30 +0,0 @@
|
||||
# Fly app green-tea-runner: Gitea Actions runner (act_runner 5.0.0-dind), instance-wide as fly-iad-1.
|
||||
# Deploy: fly deploy -c runner/fly.toml (from repo root). Registration token is a Fly secret.
|
||||
app = "green-tea-runner"
|
||||
primary_region = "iad"
|
||||
|
||||
[build]
|
||||
image = "docker.gitea.com/act_runner:5.0.0-dind"
|
||||
|
||||
[experimental]
|
||||
# Fly's rootfs is overlay, so Docker's data root must live on the volume.
|
||||
entrypoint = ["sh", "-c", "mkdir -p /data/docker && rm -rf /var/lib/docker && ln -sfn /data/docker /var/lib/docker && exec s6-svscan /etc/s6"]
|
||||
|
||||
[env]
|
||||
DOCKER_HOST = "unix:///var/run/docker.sock"
|
||||
GITEA_INSTANCE_URL = "https://teahub.xyz"
|
||||
GITEA_RUNNER_LABELS = "ubuntu-latest:docker://node:22-bookworm,ubuntu-22.04:docker://node:22-bookworm"
|
||||
GITEA_RUNNER_NAME = "fly-iad-1"
|
||||
CONFIG_FILE = "/etc/gitea-runner/config.yaml"
|
||||
|
||||
[[files]]
|
||||
guest_path = "/etc/gitea-runner/config.yaml"
|
||||
local_path = "config.yaml"
|
||||
|
||||
[mounts]
|
||||
source = "runner_data"
|
||||
destination = "/data"
|
||||
|
||||
[[vm]]
|
||||
size = "shared-cpu-2x"
|
||||
memory = "4gb"
|
||||
Reference in new issue
Block a user