thepraandClaude Opus 5.5
075c22228a
The tree had not compiled since its first commit: Group, DmGroup and
IGroupUsersService were referenced and never written, an IDE rename had
turned the user-settings DTO into the ViewAvatarServer enum, and the settings
were saved as an entity they no longer were.
Built now:
- Group (an ActivityPub Group actor with its own keys, members, invitation
code and optional password) and DmGroup (a conversation), with
/clientapi/group/{list,insert,update,join,leave,approve}.
- Posts and DMs: /clientapi/post/{list,insert,delete}, /clientapi/dm/{list,insert};
DM recipients are local usernames or user@host handles resolved by WebFinger.
- Invitation sign-up and login against the group's invitation code, checking
the password before any account is created.
- Federation: WebFinger, NodeInfo 2.0, actors at /peasants/{name} (Person,
Group, and an Application instance actor) with SPKI keys, draft-cavage
RSA-SHA256 HTTP signatures both ways, an inbox handling Follow (+Accept),
Undo, Create, Delete and Update, an outbox, notes at /posts/{id}, and a
persisted, retried, signed delivery queue. A post to a group is announced
by the group to its followers (FEP-1b12).
- The unused, broken typed ActivityPub models are replaced by a renderer;
NSign's HMAC setup, which could not federate, is gone.
Upgrade: net10.0, MongoDB.Entities 25.1 (instance DB API, Standard GUIDs),
Swashbuckle 10 / OpenApi 2, Serilog.AspNetCore 10, MailKit 4.18,
PasswordGenerator 3. The JWT keys are 64 bytes (IdentityModel 8 refuses
shorter for HS512). Production runs its own mongod on 127.0.0.1:27022, as
Sintopia's apps do, and deploys to privapub.thepra.dev from the build runner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
89 lines
3.7 KiB
YAML
89 lines
3.7 KiB
YAML
name: Deploy
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
env:
|
|
UNIT: privapub
|
|
WEB_ROOT: /var/www/privapub.thepra.dev
|
|
BACKUPS: /var/backups/privapub.thepra.dev
|
|
LOCAL_URL: http://127.0.0.1:6970
|
|
PUBLIC_URL: https://privapub.thepra.dev
|
|
|
|
jobs:
|
|
site:
|
|
name: privapub.thepra.dev
|
|
runs-on: build
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Resolve the build identity
|
|
run: |
|
|
echo "BUILD_COMMIT=$(echo "$GITHUB_SHA" | cut -c1-8)" >> "$GITHUB_ENV"
|
|
echo "BUILD_REF=${GITHUB_REF_NAME:-master}" >> "$GITHUB_ENV"
|
|
echo "BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
|
|
|
|
- name: Publish
|
|
run: |
|
|
rm -rf "$GITHUB_WORKSPACE/publish"
|
|
dotnet publish PrivaPub/PrivaPub.csproj -c Release -r linux-x64 --self-contained true \
|
|
-o "$GITHUB_WORKSPACE/publish" \
|
|
-p:BuildCommit="$BUILD_COMMIT" -p:BuildRef="$BUILD_REF" -p:BuildTimeUtc="$BUILD_TIME"
|
|
|
|
- name: Assert the publish actually produced a build
|
|
run: |
|
|
P="$GITHUB_WORKSPACE/publish"
|
|
for f in PrivaPub PrivaPub.dll PrivaPub.ClientModels.dll appsettings.Production.json Data/languagesNative.json; do
|
|
[ -e "$P/$f" ] || { echo "::error::publish output is missing $f"; exit 1; }
|
|
done
|
|
grep -q '"includedFrameworks"' "$P/PrivaPub.runtimeconfig.json" \
|
|
|| { echo "::error::publish is not self-contained"; exit 1; }
|
|
age=$(( $(date +%s) - $(stat -c %Y "$P/PrivaPub.dll") ))
|
|
[ "$age" -lt 3600 ] || { echo "::error::PrivaPub.dll is ${age}s old - the publish reused a stale artifact"; exit 1; }
|
|
echo "publish OK, $(du -sh "$P" | cut -f1)"
|
|
|
|
- name: Snapshot the live directory
|
|
run: |
|
|
STAMP=$(date +%Y%m%d-%H%M%S)
|
|
rsync -a "$WEB_ROOT/" "$BACKUPS/site-$STAMP/"
|
|
echo "SNAPSHOT=$BACKUPS/site-$STAMP" >> "$GITHUB_ENV"
|
|
ls -1dt "$BACKUPS"/site-* 2>/dev/null | tail -n +4 | xargs -r rm -rf || true
|
|
|
|
- name: Stop, sync, start
|
|
run: |
|
|
sudo systemctl stop "$UNIT"
|
|
rsync -a --delete --exclude 'appsettings.Development.json' "$GITHUB_WORKSPACE/publish/" "$WEB_ROOT/"
|
|
chgrp www-data "$WEB_ROOT/appsettings.Production.json"
|
|
chmod 640 "$WEB_ROOT/appsettings.Production.json"
|
|
chmod +x "$WEB_ROOT/PrivaPub"
|
|
sudo systemctl start "$UNIT"
|
|
|
|
- name: Health check, roll back on failure
|
|
run: |
|
|
ok=0
|
|
for i in $(seq 1 40); do
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' "$LOCAL_URL/build.json" || true)
|
|
if [ "$code" = "200" ]; then ok=1; break; fi
|
|
sleep 3
|
|
done
|
|
if [ "$ok" != "1" ]; then
|
|
echo "::error::the site did not come back healthy - rolling back to $SNAPSHOT"
|
|
sudo systemctl stop "$UNIT"
|
|
rsync -a --delete "$SNAPSHOT/" "$WEB_ROOT/"
|
|
sudo systemctl start "$UNIT" || true
|
|
exit 1
|
|
fi
|
|
|
|
- name: Verify what is being served
|
|
run: |
|
|
served=$(curl -fsS "$PUBLIC_URL/build.json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('commit',''))")
|
|
[ "$served" = "$BUILD_COMMIT" ] || { echo "::error::served build is '$served', expected '$BUILD_COMMIT'"; exit 1; }
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/activity+json' "$PUBLIC_URL/peasants/privapub")
|
|
[ "$code" = "200" ] || { echo "::error::the instance actor answered $code"; exit 1; }
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' "$PUBLIC_URL/.well-known/nodeinfo")
|
|
[ "$code" = "200" ] || { echo "::error::nodeinfo answered $code"; exit 1; }
|
|
echo "::notice::serving $served"
|