mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 09:15:19 +03:00
f30a1432f8
Three things review caught, and one shape correction. **No credential has a default any more.** The compose file shipped `ADMIN_SHARED_SECRET` falling back to a value written in this repository — and that header bypasses token verification entirely, so anyone reading the file could act as an operator against any deployment that had not overridden it. A default is worth less than it looks here: the deployment that never set the variable is exactly the one where the default is public. Every credential now comes from `.env`, and compose refuses to start naming the variable it wanted. That also takes the last literal password out of a tracked file. **The origin ports are on loopback.** Both services speak plain HTTP and mark no cookie `Secure`, because both expect to sit behind something that terminates TLS. Published on every interface they were a way to reach the issuer around that proxy, with sign-in codes and tokens in clear text. **Mail settings are passed through rather than fixed.** The issuer was pinned to printing sign-in codes to its log, and the three delivery settings never reached it — so the documented way to configure mail could not work, and every code and recipient went to the container log instead. Printing codes is now asked for in `.env` like everything else, and with nothing configured the issuer refuses to send rather than logging. **Sandbox becomes a domain rather than a prefix.** `api.sandbox.nestri.io` and `auth.sandbox.nestri.io`, because sandbox holds whatever is not production and that set grows. One certificate for `*.sandbox.nestri.io` then covers all of it, including unpredictable per-pull-request names, and cannot be presented for production's own domain — which the zone-wide wildcard the previous shape leaned on could. Also drops `STEAM_API_KEY`. It was declared in two type definitions and read by nothing: linking an account makes no outbound call that needs it.
64 lines
2.4 KiB
JSON
64 lines
2.4 KiB
JSON
// The public API, deployed as a Cloudflare Worker.
|
|
//
|
|
// The same `app/index.ts` also runs as an ordinary HTTP server — see
|
|
// `app/server.ts` and the `Dockerfile` beside it.
|
|
//
|
|
// Hostnames and the reasoning behind their shape: `docs/dns.md`.
|
|
// Secrets, the Hyperdrive id, and how to deploy: `docs/deploy.md`.
|
|
{
|
|
"$schema": "node_modules/wrangler/config-schema.json",
|
|
"name": "nestri-api",
|
|
"main": "app/index.ts",
|
|
"compatibility_date": "2026-09-05",
|
|
"compatibility_flags": ["nodejs_compat"],
|
|
"workers_dev": false,
|
|
"dev": {
|
|
"port": 3000
|
|
},
|
|
|
|
// `AUTH` routes by binding rather than by hostname, so it is one hop
|
|
// shorter than a request over the internet and needs no public address.
|
|
// It is an optimisation and not a requirement: with no such binding the
|
|
// middleware reaches the issuer over plain HTTP at `AUTH_ISSUER_URL`,
|
|
// which is what the container path does.
|
|
//
|
|
// `wrangler dev` discovers a sibling session serving the same script name,
|
|
// so running both dev servers wires this up locally.
|
|
"services": [{ "binding": "AUTH", "service": "nestri-auth" }],
|
|
"hyperdrive": [
|
|
{
|
|
"binding": "HYPERDRIVE",
|
|
"id": "0000000000000000000000000000dev0",
|
|
"localConnectionString": "postgres://postgres:postgres@localhost:5432/nestri"
|
|
}
|
|
],
|
|
"vars": {
|
|
// The issuer's **public** URL, always. A token's `iss` claim carries
|
|
// the address it was minted through, and verification compares the two
|
|
// literally — so naming the binding here instead would reject every
|
|
// real token, and report it as an ordinary 401.
|
|
"AUTH_ISSUER_URL": "http://localhost:1337"
|
|
},
|
|
|
|
"env": {
|
|
"sandbox": {
|
|
"name": "nestri-api-sandbox",
|
|
"workers_dev": false,
|
|
"routes": [{ "pattern": "api.sandbox.nestri.io", "custom_domain": true }],
|
|
"observability": { "enabled": true },
|
|
"services": [{ "binding": "AUTH", "service": "nestri-auth-sandbox" }],
|
|
"hyperdrive": [{ "binding": "HYPERDRIVE", "id": "<sandbox-hyperdrive-id>" }],
|
|
"vars": { "AUTH_ISSUER_URL": "https://auth.sandbox.nestri.io" }
|
|
},
|
|
"production": {
|
|
"name": "nestri-api",
|
|
"workers_dev": false,
|
|
"routes": [{ "pattern": "api.nestri.io", "custom_domain": true }],
|
|
"observability": { "enabled": true },
|
|
"services": [{ "binding": "AUTH", "service": "nestri-auth" }],
|
|
"hyperdrive": [{ "binding": "HYPERDRIVE", "id": "<production-hyperdrive-id>" }],
|
|
"vars": { "AUTH_ISSUER_URL": "https://auth.nestri.io" }
|
|
}
|
|
}
|
|
}
|