mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c94193c51c
PDS 0.4.0 (@atproto/pds 0.4.0-beta.7) signs the service-auth JWT it
attaches to proxied app.bsky.* calls with iss, aud and exp only
(createServiceJwt in dist/index.js of the image). The AppView requires
the lxm claim and rejects every such call with 401
BadJwtLexiconMethod, so social-app shows errorMessageView on Following
and Notifications. 0.4.66 passes the called method as lxm into every
service JWT it signs and sends every proxied call through the
SSRF-guarded proxy agent.
0.4.66 also replaces the whole-handle limit of 0.4.0 (30 characters
for the entire handle) with a limit of 18 on the part in front of the
service domain, so kc-administrator.<domain> passes for any domain
length, including kc-administrator.infinito.nexus (31).
- meta/services.yml: pin ghcr.io/bluesky-social/pds to 0.4.66.
- vars/main.yml: the public AppView URL is always https. Onion-primary
deployments took the protocol from the local TLS setting and sent the
service JWT to api.bsky.app over plain http. services.view.enabled is
evaluated as a bool.
- templates/env.j2: drop PDS_ADMIN_EMAIL, which neither 0.4.0 nor
0.4.66 reads. PDS_CONTACT_EMAIL_ADDRESS stays unset on purpose:
describeServer would publish the administrator's address.
- Administration.md: the account database only migrates forward; a
rollback restores the bluesky_pds_data backup together with the old
pin.
- Playwright: the broker login moves into _shared.js and waits for a
landing outside /oauth2/, because the bare base URL also matches the
intermediate /oauth2/callback hop. New scenarios check that the PDS
proxies getTimeline and listNotifications to the AppView with a JWT
it accepts, for the broker session (OIDC) and for a native session
(oauth2 disabled), and that social-app renders Following and
Notifications without errorMessageView or lxm page errors. The
rendering scenario is clearnet only: social-app boots only after
loading its age-assurance config from public.api.bsky.app.
Merge note for feature/store-i18n: 19b491b014 raises the pin to 0.4.21
and renames the contact-mail line to PDS_CONTACT_EMAIL_ADDRESS. Resolve
the pin to 0.4.66 (0.4.21 still signs without lxm, and the account
database cannot migrate back) and keep the line deleted. Take the union
of both sides in _shared.js and playwright.spec.js.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
62 lines
4.1 KiB
YAML
62 lines
4.1 KiB
YAML
---
|
|
application_id: "web-app-bluesky"
|
|
|
|
BLUESKY_SOCIAL_APP_DIR: "{{ [ lookup('container', application_id, 'directories.services'), 'social-app' ] | path_join }}"
|
|
BLUESKY_SOCIAL_APP_REPOSITORY: "{{ lookup('config', application_id, 'services.view.repository') }}"
|
|
BLUESKY_SOCIAL_APP_REF: "{{ lookup('config', application_id, 'services.view.ref') }}"
|
|
BLUESKY_GEOLOCATION_PATH: "{{ [ BLUESKY_SOCIAL_APP_DIR,'src/geolocation/index.tsx' ] | path_join }}"
|
|
|
|
BLUESKY_PDSADMIN_DIR: "{{ [ lookup('container', application_id, 'directories.volumes'), 'pdsadmin' ] | path_join }}"
|
|
BLUESKY_PDSADMIN_FILE: "{{ [ BLUESKY_PDSADMIN_DIR, 'pdsadmin' ] | path_join }}"
|
|
BLUESKY_PDSADMIN_TMP_TAR: "/tmp/pdsadmin.tar.gz"
|
|
BLUESKY_PDS_DATA_DIR: "{{ lookup('volume', 'web-app-bluesky', 'pds_data').target }}"
|
|
BLUESKY_PDS_BLOBSTORE_LOCATION: "{{ [ BLUESKY_PDS_DATA_DIR, 'blocks' ] | path_join }}"
|
|
|
|
BLUESKY_WEB_ENABLED: "{{ lookup('config', application_id, 'services.web.enabled') }}"
|
|
BLUESKY_WEB_DOMAIN: "{{ lookup('domains', application_id).web }}"
|
|
BLUESKY_WEB_PORT: "{{ lookup('config', 'web-app-bluesky', 'services.web.ports.local.http') }}"
|
|
BLUESKY_WEB_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.web.ports.internal.http') }}"
|
|
BLUESKY_WEB_IMAGE_CUSTOM: "bluesky_web_custom"
|
|
|
|
BLUESKY_VIEW_ENABLED: "{{ lookup('config', application_id, 'services.view.enabled') }}"
|
|
BLUESKY_VIEW_DOMAIN_LOCAL: "{{ lookup('domains', application_id).view }}"
|
|
BLUESKY_VIEW_DOMAIN_FINAL: "{{ BLUESKY_VIEW_DOMAIN_LOCAL if BLUESKY_VIEW_ENABLED | bool else 'api.bsky.app' }}"
|
|
BLUESKY_VIEW_URL: "{{ lookup('tls', application_id, 'protocols.web') if BLUESKY_VIEW_ENABLED | bool else 'https' }}://{{ BLUESKY_VIEW_DOMAIN_FINAL }}"
|
|
BLUESKY_VIEW_DID: "did:web:{{ BLUESKY_VIEW_DOMAIN_FINAL }}"
|
|
BLUESKY_VIEW_PORT: "{{ lookup('config', 'web-app-bluesky', 'services.view.ports.local.http') }}"
|
|
|
|
BLUESKY_API_DOMAIN: "{{ lookup('domains', application_id).api }}"
|
|
BLUESKY_API_PORT: "{{ lookup('config', 'web-app-bluesky', 'services.api.ports.local.http') }}"
|
|
BLUESKY_PDS_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.api.ports.internal.http') }}"
|
|
|
|
BLUESKY_PDS_HANDLE_DOMAIN: "{{ DOMAIN_PRIMARY | regex_replace('\\.test$', '.app') }}"
|
|
|
|
BLUESKY_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
|
|
|
|
BLUESKY_JWT_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.jwt_secret') }}"
|
|
BLUESKY_ROTATION_KEY: "{{ lookup('config', application_id, 'secrets.credentials.plc_rotation_key_k256_private_key_hex') }}"
|
|
|
|
BLUESKY_ADMIN_EMAIL: "{{ lookup('users', 'administrator').email }}"
|
|
BLUESKY_ADMIN_PASSWORD: "{{ lookup('users', 'administrator').password }}"
|
|
BLUESKY_ADMIN_HANDLE: "kc-{{ lookup('users', 'administrator').username }}.{{ BLUESKY_PDS_HANDLE_DOMAIN }}"
|
|
BLUESKY_PDS_INTERNAL_URL: "http://127.0.0.1:{{ BLUESKY_API_PORT }}"
|
|
|
|
BLUESKY_FRONT_PROXY_CONTENT: "{{ lookup('template', 'extra_locations.conf.j2') }}"
|
|
BLUESKY_CONFIG_UPSTREAM_URL: "{{ lookup('config', application_id, 'server.config_upstream_url') }}"
|
|
|
|
BLUESKY_BROKER_BUILD_CONTEXT: "{{ [ lookup('container', application_id, 'directories.services'), 'login-broker' ] | path_join }}"
|
|
BLUESKY_BROKER_SRC_DIR: "{{ role_path }}/files/login-broker"
|
|
BLUESKY_BROKER_IMAGE: "bluesky_broker_custom"
|
|
BLUESKY_BROKER_BASE_IMAGE: "{{ lookup('config', application_id, 'services.broker.image') }}"
|
|
BLUESKY_BROKER_BASE_VERSION: "{{ lookup('config', application_id, 'services.broker.version') }}"
|
|
BLUESKY_BROKER_SERVICE: "broker"
|
|
BLUESKY_BROKER_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ BLUESKY_BROKER_SERVICE ~ '.name') }}"
|
|
BLUESKY_BROKER_PORT: "{{ lookup('config', application_id, 'services.broker.ports.local.http') }}"
|
|
BLUESKY_BROKER_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.broker.ports.internal.http') }}"
|
|
|
|
BLUESKY_BRIDGE_ENCRYPTION_KEY: "{{ lookup('config', application_id, 'secrets.credentials.bridge_encryption_key') }}"
|
|
|
|
BLUESKY_SSO_PROXY_CONTAINER: "{{ lookup('config', application_id, 'services.sso-proxy.name') }}"
|
|
BLUESKY_SSO_PROXY_CFG_PATH: "{{ [ lookup('container', application_id, 'directories.volumes'), lookup('config', 'web-app-keycloak', 'services.sso_proxy.configuration_file')
|
|
] | path_join }}"
|