@crvouga/atlas 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog: @crvouga/atlas
 
+## 0.8.0 (2026-10-15)
+
+### Features
+
+- add anonymous Atlas server image (#12) ([269d62d](https://github.com/crvouga/atlas/commit/269d62d74e08efd2ba473dd3629bddfd13670265))
+
 ## 0.7.0 (2026-10-15)
 
 ### Features

package/README.md

@@ -68,6 +68,48 @@ live step logs and a Running status filter. Producers send heartbeats every
 configure `ATLAS_RUN_TIMEOUT_SECONDS` and `ATLAS_RUN_STALL_SECONDS` (0 disables the progress timeout),
 or edit these settings in the client. An interruption never turns missing outcomes into passes.
 
+## Deploy to Railway without code
+
+Copy this image URI into **Railway → New service → Docker image**:
+
+```text
+ghcr.io/crvouga/atlas:latest
+```
+
+The image includes the Atlas server and viewer; hosting it needs no repository, Dockerfile, build command
+or package installation. [`latest` on GHCR](https://github.com/users/crvouga/packages/container/atlas) follows
+the newest checked `main` image, independently of npm releases.
+
+1. Leave the start command unset. Add a long random secret as `ATLAS_TOKEN` (at least 12 characters;
+   use 48 or more) and set `RAILWAY_RUN_UID=0` for [Railway volume permissions](https://docs.railway.com/volumes#permissions).
+2. Attach a persistent volume at `/data` and keep one replica so reports and server settings survive updates.
+3. Set the healthcheck path to `/readyz` and generate a public domain. Railway supplies `PORT`;
+   leave `ATLAS_PORT` unset. Open the domain and sign in with the token as the password (any username).
+4. Enable **Settings → Source → Configure Auto Updates → Anytime** to follow `latest`.
+   [Railway checks for image updates periodically](https://docs.railway.com/deployments/image-auto-updates);
+   detection can take a few hours.
+
+For the exact image from a run, open **[CI](https://github.com/crvouga/atlas/actions/workflows/ci.yml) →
+run → Summary → Atlas CI**. The summary includes a copyable full commit tag, the immutable registry digest,
+whether that run updated `latest`, all job results, npm release details and artifact links. Use the commit
+tag to pin or roll back a deployment. The [deployment guide](docs/deploying.md#run-it) covers optional reader
+and publisher tokens, bucket storage and sending results from your projects.
+
+### Deploy without authentication
+
+For anonymous access, use this image in Railway instead:
+
+```text
+ghcr.io/crvouga/atlas-insecure:latest
+```
+
+It contains the same server and viewer, with anonymous reading, uploads and administration enabled.
+Follow the Railway steps above, leaving `ATLAS_TOKEN`, `ATLAS_PUBLISH_TOKEN`, `ATLAS_READ_TOKEN` and
+configuration-file auth tokens unset. Open the generated domain directly; no sign-in is required.
+Anyone who discovers the URL can read reports, upload results and change settings. An unlisted URL
+is not access control. See the [anonymous deployment guide](docs/deploying.md#deploy-without-authentication)
+for a token-free project configuration and verification commands.
+
 ## For AI agents
 
 Atlas is built to be integrated and operated by agents, with nothing to click and nothing to guess.
@@ -187,9 +229,8 @@ unless you choose a bucket. `atlas dev` runs the same server with the client's d
 development is one host too. See [the server](docs/server.md) and
 [running Atlas for a project](docs/deploying.md).
 
-On Railway, deploy the image `ghcr.io/crvouga/atlas:latest` directly, with no project checkout or
-custom Dockerfile. Every green merge to `main` publishes it; enable Railway's image auto updates to follow it.
-The [deployment guide](docs/deploying.md#run-it) covers the token, persistent volume and healthcheck.
+Deploy the server using the [Railway setup above](#deploy-to-railway-without-code), or follow the
+[deployment guide](docs/deploying.md#run-it) for other hosts.
 
 ```sh
 atlas serve                                          # the project's server, at :8080 (ATLAS_TOKEN says who may upload)

package/docs/deploying.md

@@ -214,7 +214,15 @@ use a named `--store project=s3://… --write project` to put uploads in a share
 ### Run it
 
 **Railway (deploy an image, no repository or code changes).** Create a service from the Docker image
-`ghcr.io/crvouga/atlas:latest`.
+`ghcr.io/crvouga/atlas:latest`. Copy the URI below into Railway's image field:
+
+```text
+ghcr.io/crvouga/atlas:latest
+```
+
+For a specific revision, open a [CI run](https://github.com/crvouga/atlas/actions/workflows/ci.yml)'s
+**Summary → Atlas CI**: it includes the published commit image URI, immutable digest and whether that run
+updated `latest`. Pull request builds and failed publications are labelled accordingly.
 
 1. In Railway choose **New service → Docker image** and enter `ghcr.io/crvouga/atlas:latest`.
    Leave the start command unset: the image includes the server and the prebuilt viewer.
@@ -239,7 +247,56 @@ your project's test results still needs the integration described there.
 For bucket storage instead, set `ATLAS_STORE=project=s3://my-bucket/atlas/my-project`, `ATLAS_WRITE=project`,
 and the bucket credentials. Keep the `/data` volume for server settings and local state.
 
-**Docker.** The same published image works anywhere Docker runs. It already contains the client (the same
+### Deploy without authentication
+
+Use `ghcr.io/crvouga/atlas-insecure:latest` for a server that requires no sign-in or API token. It is built
+from the same commit, server and viewer as `ghcr.io/crvouga/atlas:latest`, with `ATLAS_INSECURE=true`
+to allow listening on the network without tokens. Anonymous callers have full read, publish and admin access.
+Anyone who discovers an unlisted URL can read reports, upload results and change settings; the URL is
+not access control.
+
+In Railway, create a **Docker image** service with:
+
+```text
+ghcr.io/crvouga/atlas-insecure:latest
+```
+
+Leave the start command unset. Attach a persistent volume at `/data`, set `RAILWAY_RUN_UID=0`, keep one
+replica, set the healthcheck to `/readyz` and generate a public domain. Leave `ATLAS_PORT` unset so Railway's
+`PORT` is used. Enable **Settings → Source → Configure Auto Updates → Anytime** to follow `latest`.
+Do not set `ATLAS_TOKEN`, `ATLAS_PUBLISH_TOKEN` or `ATLAS_READ_TOKEN`, or add `auth.tokens` to
+`/data/atlas.server.json`: configured tokens still enable authentication. When reusing a volume from an
+authenticated deployment, remove its saved auth tokens first. Open the domain directly, including `/admin`
+for settings (leave the token field blank and choose **Load settings**).
+
+Verify anonymous reads and uploads without an Authorization header:
+
+```sh
+curl --fail https://YOUR-DOMAIN/readyz
+curl --fail https://YOUR-DOMAIN/api/server
+curl --fail 'https://YOUR-DOMAIN/api/checks?project=my-project' \
+  -H 'content-type: application/json' \
+  -d '{"producer":"smoke","checks":[{"id":"deployed","title":"Deployed","status":"passed"}]}'
+```
+
+Readiness returns HTTP 200, `/api/server` reports `"open":true` and `"role":"admin"`, and the upload returns
+HTTP 201. Configure a project with `ATLAS_STORE=https://YOUR-DOMAIN` and `ATLAS_PROJECT=my-project`;
+leave its `ATLAS_TOKEN` unset. Use the same publishing commands described in
+[sending results](#3-send-results-from-ci-and-from-laptops), omitting credentials.
+
+For local Docker:
+
+```sh
+docker run --pull always -p 8080:8080 -v atlas-data:/data ghcr.io/crvouga/atlas-insecure:latest
+```
+
+Both images publish full commit tags for pinning or rollback. A new GHCR package must be made Public
+once before Railway can pull without registry credentials; see
+[image publication](https://github.com/crvouga/atlas/blob/main/docs/releasing.md#server-image).
+
+### Docker
+
+The same published image works anywhere Docker runs. It already contains the client (the same
 for every project: the server tells the page where its data is), and keeps results on the volume at `/data`:
 
 ```sh

package/docs/server.md

@@ -56,6 +56,8 @@ ATLAS_STORE=http://127.0.0.1:5180 bunx atlas report publish --producer unit --ju
 For Railway, deploy `ghcr.io/crvouga/atlas:latest` directly: the image contains the server and
 viewer, and every green `main` push updates it. See [running Atlas for a project](deploying.md#run-it) for
 Railway's volume, tokens, healthcheck and image auto updates, or for Docker, Kubernetes and CI.
+For anonymous reading, uploads and administration, use `ghcr.io/crvouga/atlas-insecure:latest` with no tokens
+configured; see [deploying without authentication](deploying.md#deploy-without-authentication).
 
 ## Configuration
 

package/llms-full.txt

@@ -1008,6 +1008,8 @@ ATLAS_STORE=http://127.0.0.1:5180 bunx atlas report publish --producer unit --ju
 For Railway, deploy `ghcr.io/crvouga/atlas:latest` directly: the image contains the server and
 viewer, and every green `main` push updates it. See [running Atlas for a project](deploying.md#run-it) for
 Railway's volume, tokens, healthcheck and image auto updates, or for Docker, Kubernetes and CI.
+For anonymous reading, uploads and administration, use `ghcr.io/crvouga/atlas-insecure:latest` with no tokens
+configured; see [deploying without authentication](deploying.md#deploy-without-authentication).
 
 ## Configuration
 
@@ -1586,7 +1588,15 @@ use a named `--store project=s3://… --write project` to put uploads in a share
 ### Run it
 
 **Railway (deploy an image, no repository or code changes).** Create a service from the Docker image
-`ghcr.io/crvouga/atlas:latest`.
+`ghcr.io/crvouga/atlas:latest`. Copy the URI below into Railway's image field:
+
+```text
+ghcr.io/crvouga/atlas:latest
+```
+
+For a specific revision, open a [CI run](https://github.com/crvouga/atlas/actions/workflows/ci.yml)'s
+**Summary → Atlas CI**: it includes the published commit image URI, immutable digest and whether that run
+updated `latest`. Pull request builds and failed publications are labelled accordingly.
 
 1. In Railway choose **New service → Docker image** and enter `ghcr.io/crvouga/atlas:latest`.
    Leave the start command unset: the image includes the server and the prebuilt viewer.
@@ -1611,7 +1621,56 @@ your project's test results still needs the integration described there.
 For bucket storage instead, set `ATLAS_STORE=project=s3://my-bucket/atlas/my-project`, `ATLAS_WRITE=project`,
 and the bucket credentials. Keep the `/data` volume for server settings and local state.
 
-**Docker.** The same published image works anywhere Docker runs. It already contains the client (the same
+### Deploy without authentication
+
+Use `ghcr.io/crvouga/atlas-insecure:latest` for a server that requires no sign-in or API token. It is built
+from the same commit, server and viewer as `ghcr.io/crvouga/atlas:latest`, with `ATLAS_INSECURE=true`
+to allow listening on the network without tokens. Anonymous callers have full read, publish and admin access.
+Anyone who discovers an unlisted URL can read reports, upload results and change settings; the URL is
+not access control.
+
+In Railway, create a **Docker image** service with:
+
+```text
+ghcr.io/crvouga/atlas-insecure:latest
+```
+
+Leave the start command unset. Attach a persistent volume at `/data`, set `RAILWAY_RUN_UID=0`, keep one
+replica, set the healthcheck to `/readyz` and generate a public domain. Leave `ATLAS_PORT` unset so Railway's
+`PORT` is used. Enable **Settings → Source → Configure Auto Updates → Anytime** to follow `latest`.
+Do not set `ATLAS_TOKEN`, `ATLAS_PUBLISH_TOKEN` or `ATLAS_READ_TOKEN`, or add `auth.tokens` to
+`/data/atlas.server.json`: configured tokens still enable authentication. When reusing a volume from an
+authenticated deployment, remove its saved auth tokens first. Open the domain directly, including `/admin`
+for settings (leave the token field blank and choose **Load settings**).
+
+Verify anonymous reads and uploads without an Authorization header:
+
+```sh
+curl --fail https://YOUR-DOMAIN/readyz
+curl --fail https://YOUR-DOMAIN/api/server
+curl --fail 'https://YOUR-DOMAIN/api/checks?project=my-project' \
+  -H 'content-type: application/json' \
+  -d '{"producer":"smoke","checks":[{"id":"deployed","title":"Deployed","status":"passed"}]}'
+```
+
+Readiness returns HTTP 200, `/api/server` reports `"open":true` and `"role":"admin"`, and the upload returns
+HTTP 201. Configure a project with `ATLAS_STORE=https://YOUR-DOMAIN` and `ATLAS_PROJECT=my-project`;
+leave its `ATLAS_TOKEN` unset. Use the same publishing commands described in
+[sending results](#3-send-results-from-ci-and-from-laptops), omitting credentials.
+
+For local Docker:
+
+```sh
+docker run --pull always -p 8080:8080 -v atlas-data:/data ghcr.io/crvouga/atlas-insecure:latest
+```
+
+Both images publish full commit tags for pinning or rollback. A new GHCR package must be made Public
+once before Railway can pull without registry credentials; see
+[image publication](https://github.com/crvouga/atlas/blob/main/docs/releasing.md#server-image).
+
+### Docker
+
+The same published image works anywhere Docker runs. It already contains the client (the same
 for every project: the server tells the page where its data is), and keeps results on the volume at `/data`:
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/atlas",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Atlas: specs of any kind, reported as layered evidence. Publish checks from any runner (JUnit, CTRF, a script), combine them across nodes, branches, environments and backends, gate CI on the result, and run statecharts against the real app.",
   "license": "MIT",
   "type": "module",