Three things review caught, and one shape correction.
**No credential has a default any more.** The compose file shipped
`ADMIN_SHARED_SECRET` falling back to a value written in this repository —
and that header bypasses token verification entirely, so anyone reading
the file could act as an operator against any deployment that had not
overridden it. A default is worth less than it looks here: the deployment
that never set the variable is exactly the one where the default is public.
Every credential now comes from `.env`, and compose refuses to start naming
the variable it wanted. That also takes the last literal password out of a
tracked file.
**The origin ports are on loopback.** Both services speak plain HTTP and
mark no cookie `Secure`, because both expect to sit behind something that
terminates TLS. Published on every interface they were a way to reach the
issuer around that proxy, with sign-in codes and tokens in clear text.
**Mail settings are passed through rather than fixed.** The issuer was
pinned to printing sign-in codes to its log, and the three delivery
settings never reached it — so the documented way to configure mail could
not work, and every code and recipient went to the container log instead.
Printing codes is now asked for in `.env` like everything else, and with
nothing configured the issuer refuses to send rather than logging.
**Sandbox becomes a domain rather than a prefix.** `api.sandbox.nestri.io`
and `auth.sandbox.nestri.io`, because sandbox holds whatever is not
production and that set grows. One certificate for `*.sandbox.nestri.io`
then covers all of it, including unpredictable per-pull-request names,
and cannot be presented for production's own domain — which the zone-wide
wildcard the previous shape leaned on could.
Also drops `STEAM_API_KEY`. It was declared in two type definitions and
read by nothing: linking an account makes no outbound call that needs it.
Moving the issuer's state into Postgres removed the last thing that tied
either app to one hosting provider. What was left was a deployment tool
describing resources that no longer existed — so this replaces it with
`wrangler`, which is what actually deploys a Worker, and adds a second way
to run each app that involves no provider at all.
Each app now has a `wrangler.jsonc` with an environment per stage, and a
`Dockerfile` beside it. The handler is the same one in both cases; what
differs is only where its settings come from. Two of them gained a second
spelling so that nothing has to branch on the runtime: Postgres arrives as
a pooled binding or as `DATABASE_URL`, and the route to the issuer is a
service binding or `AUTH_INTERNAL_URL`.
That last one is new, and it is a split the binding was already making
without saying so. `AUTH_ISSUER_URL` has to be the issuer's public name,
because it is compared literally against every token's `iss` claim — but
the public name is often not routable from inside a deployment. So the
name and the route are two settings now rather than one that cannot be
both.
DNS moves out of code and into `docs/dns.md`, which lists every hostname
and what it is for. Six records that change roughly never did not need a
tool, and the table outlives whatever is answering the names — which is
the point, since some of them will stop being Workers. The sandbox
hostnames are hyphenated rather than nested for the same reason: a
certificate covering `*.nestri.io` covers one label and not two, so
`api-sandbox.nestri.io` can become an ordinary origin later without a
certificate having to be ordered for it first.
Also drops `EMAIL_DEV_LOG` from committed configuration into `.dev.vars`,
which `wrangler deploy` cannot upload. Printing a live sign-in code to a
log should not be one forgotten override away from production.
The README opens by saying the repository is mid-rewrite, nothing is stable,
and the documentation is behind the code -- all true, and it leaves a visitor
with nothing to do. There is now one thing here that is finished and runs on
its own machine, so it goes immediately after that note rather than buried in a
component table.
The section leads with the two install commands and the number worth having:
added latency under load, which decides whether a stream feels right and which
almost nobody has ever seen for their own connection. Then the display probe,
because "it tells you what your monitor can actually accept" is a better hook
for this audience than anything else in the file.
It also says plainly that this does not stream a game and that most machines
come back CLIENT, "a real answer, not a failure". A README that oversells the
one runnable thing would undo the reason it is worth running.
Three smaller corrections that follow:
`nesdoctor` gets its own heading rather than a row under the guest components.
It is neither control plane nor guest -- it runs on the reader's own machine,
which is the whole point of it.
Getting started said the Rust components "are not much use on their own yet".
That was true of every one of them yesterday and is now wrong; scoped to the
guest half, with `cargo run --release -p nesdoctor` called out as the exception.
And Contributing now asks for the thing we actually need. "Tell us where the
documentation failed you" was the most useful contribution when nothing could
be run; running nesdoctor and sending the result is worth more, because we have
almost no idea what the machines on the other end look like.
Checked: every relative link in the file resolves, and the scripts
doctor.nestri.io serves are byte-identical to the files the README points at --
which is the claim the section makes about them.
The payload-independence rule is the one thing about this repo that is
easy to violate by being helpful. Stating it where it will be read before
the first edit is cheaper than catching it in review.
CLAUDE.md was 1,324 lines and all of it was about the TypeScript half, written
before there was another half. Every line of it loaded on every turn regardless
of what was being worked on, which is a real cost paid constantly for context
that is usually irrelevant.
Split by where it applies, so each guide loads when you are in the directory it
describes:
packages/core/CLAUDE.md 694 domain modules, fn(), actor, errors, auth
apps/api/CLAUDE.md 284 routes, registration, error flow
docs/alchemy.md 345 stages, bindings, secrets, the CLI
CLAUDE.md 72 the repo, both toolchains, two hard rules
Nothing was rewritten or dropped — the three files are the original text,
verified identical after the split. What the root file now carries is only what
is true repo-wide: the layout, the commands, where the detail lives, and the two
rules that are not style preferences. One of those is that nothing closed may
enter this repo, which is here because it has already been caught once.
The README described a streaming platform in four bullets and did not mention
that half the repository is Rust that runs inside a virtual machine. It now says
what each component does, why a micro-VM rather than a container, what is
deliberately absent, and what decides whether a thing is open — data is, capacity
is not.
It also says plainly that this is mid-rewrite and the docs are behind. Someone
arriving at a repo whose documentation does not match its tree should be told
that by the README rather than discover it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Description
Update the readme file
## Related Issues
none
## Type of Change
- [ ] Bug fix (non-breaking change)
- [ ] New feature (non-breaking change)
- [ ] Breaking change (fix or feature that changes existing
functionality)
- [x] Documentation update
- [ ] Other (please describe):
## Checklist
- [x] I have updated relevant documentation
- [x] My code follows the project's coding style
- [x] My changes generate no new warnings/errors
## Notes for Reviewers
none
## Screenshots/Demo
none
## Additional Context
none
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Documentation**
- Major overhaul of documentation structure and content for improved
clarity, modern presentation, and ease of navigation.
- Updated and expanded guides for installation, setup, architecture, and
command-line interfaces.
- Enhanced FAQ and troubleshooting sections with more comprehensive
answers and technical details.
- Added new guides for self-hosting with reverse proxy examples (Caddy,
Traefik) and developer notes.
- Improved theming, styling, and home page layout for the documentation
site.
- Simplified main README to a minimalistic project header and tagline.
- Added new documentation files for Nestri Relay introduction and
container CLI parameters.
- Removed outdated or redundant documentation files and components to
streamline content.
- **Chores**
- Updated, reorganized, or removed configuration files for dependencies,
linting, and environment setup.
- Switched to a new documentation theme and updated related project
dependencies.
- Removed Renovate configuration and ESLint config specific to docs app.
- Adjusted TypeScript and package configurations for better
compatibility.
- **Style**
- Improved dark mode support and visual consistency across documentation
and components.
- Introduced new Tailwind CSS theming and animation support for the
documentation site.
- **New Features**
- Added example configuration files for deploying Nestri Relay with
Caddy and Traefik reverse proxies.
- Introduced new Tailwind CSS theming and animation support for the
documentation site.
- Added a new logo component supporting light/dark mode and optional
title display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Victor Pahuus Petersen <49293748+victorpahuus@users.noreply.github.com>
Co-authored-by: Wanjohi <elviswanjohi47@gmail.com>
Co-authored-by: DatCaptainHorse <DatCaptainHorse@users.noreply.github.com>
## Description
**What issue are you solving (or what feature are you adding) and how
are you doing it?**
1. Netris has been renamed and rebranded to Nestri.
2. New Logo and colors, plus a new Philosophy and mission(more on that
later)
3. We are moving all different repos into this one - which means API,
Docker, Website, Docs etc will be moved here
## Description
**What issue are you solving (or what feature are you adding) and how
are you doing it?**
This PR is the first in a series of PRs trying to solve the issue #48 by
renaming `Netris` to `Nestri` to avoid Trademark legal issues.
## Description
**What issue are you solving (or what feature are you adding) and how
are you doing it?**
Update the README to show how to how to run Netris.
## Description
**What issue are you solving (or what feature are you adding) and how
are you doing it?**
So, we need a README.md at the root of the project, to at least welcome
anyone who might be interested in the project.
It should have:
- [ ] link to the `/play` endpoint to get a `session_id` for starting up
the server.
- [ ] (basic) info about how it works
- [ ] features
- [ ] images and/or gifs showcasing the project
