mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c94193c51c
PDS 0.4.0 (@atproto/pds 0.4.0-beta.7) signs the service-auth JWT it
attaches to proxied app.bsky.* calls with iss, aud and exp only
(createServiceJwt in dist/index.js of the image). The AppView requires
the lxm claim and rejects every such call with 401
BadJwtLexiconMethod, so social-app shows errorMessageView on Following
and Notifications. 0.4.66 passes the called method as lxm into every
service JWT it signs and sends every proxied call through the
SSRF-guarded proxy agent.
0.4.66 also replaces the whole-handle limit of 0.4.0 (30 characters
for the entire handle) with a limit of 18 on the part in front of the
service domain, so kc-administrator.<domain> passes for any domain
length, including kc-administrator.infinito.nexus (31).
- meta/services.yml: pin ghcr.io/bluesky-social/pds to 0.4.66.
- vars/main.yml: the public AppView URL is always https. Onion-primary
deployments took the protocol from the local TLS setting and sent the
service JWT to api.bsky.app over plain http. services.view.enabled is
evaluated as a bool.
- templates/env.j2: drop PDS_ADMIN_EMAIL, which neither 0.4.0 nor
0.4.66 reads. PDS_CONTACT_EMAIL_ADDRESS stays unset on purpose:
describeServer would publish the administrator's address.
- Administration.md: the account database only migrates forward; a
rollback restores the bluesky_pds_data backup together with the old
pin.
- Playwright: the broker login moves into _shared.js and waits for a
landing outside /oauth2/, because the bare base URL also matches the
intermediate /oauth2/callback hop. New scenarios check that the PDS
proxies getTimeline and listNotifications to the AppView with a JWT
it accepts, for the broker session (OIDC) and for a native session
(oauth2 disabled), and that social-app renders Following and
Notifications without errorMessageView or lxm page errors. The
rendering scenario is clearnet only: social-app boots only after
loading its age-assurance config from public.api.bsky.app.
Merge note for feature/store-i18n: 19b491b014 raises the pin to 0.4.21
and renames the contact-mail line to PDS_CONTACT_EMAIL_ADDRESS. Resolve
the pin to 0.4.66 (0.4.21 still signs without lxm, and the account
database cannot migrate back) and keep the line deleted. Take the union
of both sides in _shared.js and playwright.spec.js.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
32 lines
1.1 KiB
Django/Jinja
32 lines
1.1 KiB
Django/Jinja
{% include 'roles/sys-svc-container/templates/env.j2' %}
|
|
|
|
PDS_HOSTNAME={{ BLUESKY_API_DOMAIN }}
|
|
PDS_CRAWLERS=https://bsky.network
|
|
LOG_ENABLED={{ MODE_DEBUG | string | lower }}
|
|
PDS_BLOBSTORE_DISK_LOCATION={{ BLUESKY_PDS_BLOBSTORE_LOCATION }}
|
|
PDS_DATA_DIRECTORY={{ BLUESKY_PDS_DATA_DIR }}
|
|
PDS_BLOB_UPLOAD_LIMIT=52428800
|
|
PDS_DID_PLC_URL=https://plc.directory
|
|
|
|
PDS_INVITE_REQUIRED=false
|
|
|
|
PDS_SERVICE_HANDLE_DOMAINS=.{{ BLUESKY_PDS_HANDLE_DOMAIN }}
|
|
PDS_SERVICE_DID=did:web:{{ BLUESKY_API_DOMAIN }}
|
|
|
|
{% set email = lookup('email', application_id) %}
|
|
{% if email.enabled | bool %}
|
|
PDS_EMAIL_SMTP_URL=smtps://{{ email.username }}:{{ email.password }}@{{ email.host }}:{{ email.port }}/
|
|
PDS_EMAIL_FROM_ADDRESS={{ email['from'] }}
|
|
{% endif %}
|
|
|
|
PDS_JWT_SECRET={{ BLUESKY_JWT_SECRET }}
|
|
PDS_ADMIN_PASSWORD={{ BLUESKY_ADMIN_PASSWORD | dotenv_quote }}
|
|
PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX={{ BLUESKY_ROTATION_KEY }}
|
|
|
|
PDS_BSKY_APP_VIEW_URL={{ BLUESKY_VIEW_URL }}
|
|
PDS_BSKY_APP_VIEW_DID={{ BLUESKY_VIEW_DID }}
|
|
|
|
# nocheck: url
|
|
PDS_REPORT_SERVICE_URL=https://mod.bsky.app
|
|
PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac
|