@openmeet/snowglobe 0.0.0-stage → 0.3.0-rc.0

package/stack/pdsls/network.patch

@@ -0,0 +1,294 @@
+From c6cdd20285d5d8cc029b2c7178f4c2e1d8ac12b8 Mon Sep 17 00:00:00 2001
+From: Tom Scanlan <tompscanlan@gmail.com>
+Date: Mon, 19 Oct 2026 15:43:08 -0400
+Subject: [PATCH] network: a host page can point PDSls at another atproto
+ network
+
+globalThis.PDSLS_NETWORK, set before the app loads, gives the PLC directory,
+DNS-over-HTTPS resolver, a fixed lexicon authority, the Bluesky API, Constellation,
+the stream instances, and whether to sign in with client metadata at the page's
+own origin. Unset, every address is the public network's, as before. null turns a
+feature off, so a private network falls back to no public service.
+---
+ src/auth/oauth-config.ts    |  8 ++++--
+ src/auth/session-manager.ts |  4 ++-
+ src/components/search.tsx   |  8 +++---
+ src/lib/api.ts              | 49 +++++++++++++++++++++++++------------
+ src/lib/network.ts          | 37 ++++++++++++++++++++++++++++
+ src/views/settings.tsx      |  3 ++-
+ src/views/stream/config.ts  |  7 +++---
+ 7 files changed, 91 insertions(+), 25 deletions(-)
+ create mode 100644 src/lib/network.ts
+
+diff --git a/src/auth/oauth-config.ts b/src/auth/oauth-config.ts
+index 95afb85..30188cd 100644
+--- a/src/auth/oauth-config.ts
++++ b/src/auth/oauth-config.ts
+@@ -2,6 +2,7 @@ import { LocalActorResolver } from "@atcute/identity-resolver";
+ import { configureOAuth } from "@atcute/oauth-browser-client";
+ 
+ import { didDocumentResolver, handleResolver } from "../lib/api";
++import { network } from "../lib/network";
+ 
+ const reactiveDidDocumentResolver = {
+   resolve: async (did: string) => didDocumentResolver().resolve(did as any),
+@@ -9,8 +10,11 @@ const reactiveDidDocumentResolver = {
+ 
+ configureOAuth({
+   metadata: {
+-    client_id: import.meta.env.VITE_OAUTH_CLIENT_ID,
+-    redirect_uri: import.meta.env.VITE_OAUTH_REDIRECT_URL,
++    // A host that serves its own client metadata signs in as itself, wherever it is served.
++    client_id: network.oauthAtOrigin
++      ? `${location.origin}/oauth-client-metadata.json`
++      : import.meta.env.VITE_OAUTH_CLIENT_ID,
++    redirect_uri: network.oauthAtOrigin ? `${location.origin}/` : import.meta.env.VITE_OAUTH_REDIRECT_URL,
+   },
+   identityResolver: new LocalActorResolver({
+     handleResolver: handleResolver,
+diff --git a/src/auth/session-manager.ts b/src/auth/session-manager.ts
+index 4e65228..3ea2115 100644
+--- a/src/auth/session-manager.ts
++++ b/src/auth/session-manager.ts
+@@ -8,6 +8,7 @@ import {
+ } from "@atcute/oauth-browser-client";
+ 
+ import { resolveDidDoc } from "../lib/api";
++import { network } from "../lib/network";
+ import { oauthScopeStringToIds, scopeIdsToString } from "./scope-utils";
+ import { Sessions, setAgent, setSessions } from "./state";
+ 
+@@ -21,8 +22,9 @@ export const loadSessionsFromStorage = (): Sessions | null => {
+ };
+ 
+ export const getAvatar = async (did: Did): Promise<string | undefined> => {
++  if (!network.appviewUrl) return undefined;
+   const rpc = new Client({
+-    handler: simpleFetchHandler({ service: "https://public.api.bsky.app" }),
++    handler: simpleFetchHandler({ service: network.appviewUrl }),
+   });
+   const res = await rpc.get("app.bsky.actor.getProfile", { params: { actor: did } });
+   if (res.ok) {
+diff --git a/src/components/search.tsx b/src/components/search.tsx
+index 16039aa..b049d21 100644
+--- a/src/components/search.tsx
++++ b/src/components/search.tsx
+@@ -16,6 +16,7 @@ import { agent, avatars, sessions } from "../auth/state.js";
+ import { resolveLexiconAuthority, resolveLexiconAuthorityDirect } from "../lib/api";
+ import { appHandleLink, appList, AppUrl } from "../lib/app-urls";
+ import { createDebouncedValue } from "../lib/debounced";
++import { network } from "../lib/network";
+ import { carFileAccept, createFileChangeHandler } from "../views/car/file-handlers.js";
+ import { queueCarFile } from "../views/car/state.js";
+ 
+@@ -92,9 +93,9 @@ const recentIcon = (type: RecentSearch["type"]) => {
+ 
+ export const Search = () => {
+   const navigate = useNavigate();
+-  const rpc = new Client({
+-    handler: simpleFetchHandler({ service: "https://public.api.bsky.app" }),
+-  });
++  const rpc = network.appviewUrl
++    ? new Client({ handler: simpleFetchHandler({ service: network.appviewUrl }) })
++    : null;
+ 
+   let searchRoot!: HTMLDivElement;
+   let searchPanel!: HTMLDivElement;
+@@ -116,6 +117,7 @@ export const Search = () => {
+     const actorQuery = prefix === "@" ? query : value;
+     if (!actorQuery.length || actorQuery.includes("/") || /^https?:/i.test(actorQuery)) return [];
+ 
++    if (!rpc) return [];
+     const response = await rpc.get("app.bsky.actor.searchActorsTypeahead", {
+       params: { q: actorQuery, limit: 5 },
+     });
+diff --git a/src/lib/api.ts b/src/lib/api.ts
+index a706ebc..8ca2c95 100644
+--- a/src/lib/api.ts
++++ b/src/lib/api.ts
+@@ -23,6 +23,7 @@ import { createMemo } from "solid-js";
+ import { createStore } from "solid-js/store";
+ 
+ import { plcDirectory } from "../views/settings";
++import { network } from "./network";
+ 
+ const proxyFetch = (rewrite: (url: URL) => string): typeof fetch => {
+   return async (input, init) => {
+@@ -61,17 +62,26 @@ export const didDocumentResolver = createMemo(
+     }),
+ );
+ 
+-export const handleResolver = new CompositeHandleResolver({
+-  strategy: "dns-first",
+-  methods: {
+-    dns: new DohJsonHandleResolver({ dohUrl: "https://dns.google/resolve?", fetch: dnsProxyFetch }),
+-    http: new WellKnownHandleResolver({ fetch: handleHttpProxyFetch }),
+-  },
+-});
+-
+-const authorityResolver = new DohJsonLexiconAuthorityResolver({
+-  dohUrl: "https://dns.google/resolve?",
+-});
++// With no DNS on the network, a handle is resolved over HTTP only.
++export const handleResolver = network.dohUrl
++  ? new CompositeHandleResolver({
++      strategy: "dns-first",
++      methods: {
++        dns: new DohJsonHandleResolver({ dohUrl: network.dohUrl, fetch: dnsProxyFetch }),
++        http: new WellKnownHandleResolver({ fetch: handleHttpProxyFetch }),
++      },
++    })
++  : new WellKnownHandleResolver({ fetch: handleHttpProxyFetch });
++
++const authorityResolver = network.lexiconAuthority
++  ? { resolve: async (_nsid: Nsid) => network.lexiconAuthority as AtprotoDid }
++  : network.dohUrl
++    ? new DohJsonLexiconAuthorityResolver({ dohUrl: network.dohUrl })
++    : {
++        resolve: async (_nsid: Nsid): Promise<AtprotoDid> => {
++          throw new Error("No lexicon authority lookups on this network");
++        },
++      };
+ 
+ const schemaResolver = createMemo(
+   () =>
+@@ -153,7 +163,9 @@ const resolveLexiconAuthority = async (nsid: Nsid) => {
+ };
+ 
+ const resolveLexiconAuthorityDirect = async (authority: string) => {
+-  const dohUrl = "https://dns.google/resolve?";
++  if (network.lexiconAuthority) return network.lexiconAuthority;
++  const dohUrl = network.dohUrl;
++  if (!dohUrl) throw new Error("No lexicon authority lookups on this network");
+   const reversedAuthority = authority.split(".").reverse().join(".");
+   const domain = `_lexicon.${reversedAuthority}`;
+   const url = new URL(dohUrl);
+@@ -263,7 +275,8 @@ const getConstellation = async (
+   cursor?: string,
+   limit?: number,
+ ) => {
+-  const url = new URL("https://constellation.microcosm.blue");
++  if (!network.constellationUrl) throw new Error("Backlinks are not available on this network");
++  const url = new URL(network.constellationUrl);
+   url.pathname = endpoint;
+   url.searchParams.set("target", target);
+   if (collection) {
+@@ -299,11 +312,17 @@ export interface HandleResolveResult {
+ }
+ 
+ export const resolveHandleDetailed = async (handle: Handle) => {
+-  const dnsResolver = new DohJsonHandleResolver({ dohUrl: "https://dns.google/resolve?" });
++  const dnsResolver = network.dohUrl
++    ? new DohJsonHandleResolver({ dohUrl: network.dohUrl })
++    : {
++        resolve: async (_handle: Handle): Promise<AtprotoDid> => {
++          throw new Error("No DNS lookups on this network");
++        },
++      };
+   const httpResolver = new WellKnownHandleResolver({ fetch: handleHttpProxyFetch });
+ 
+   const tryResolve = async (
+-    resolver: DohJsonHandleResolver | WellKnownHandleResolver,
++    resolver: { resolve: (handle: Handle) => Promise<string> },
+     timeoutMs: number = 5000,
+   ): Promise<HandleResolveResult> => {
+     try {
+diff --git a/src/lib/network.ts b/src/lib/network.ts
+new file mode 100644
+index 0000000..cc75ea4
+--- /dev/null
++++ b/src/lib/network.ts
+@@ -0,0 +1,37 @@
++// The atproto network PDSls looks at. A host page can point it at a private network (a snowglobe, a
++// sandbox) by setting globalThis.PDSLS_NETWORK before the app loads; unset, every address is the
++// public network's, as before. A setting given as null turns its feature off, for a network that
++// has no such service, so nothing falls back to a public one.
++type NetworkSettings = {
++  /** Default PLC directory (a visitor can still change it in settings). */
++  plcDirectory?: string;
++  /** DNS-over-HTTPS resolver for handles and lexicon authorities; null: no DNS lookups. */
++  dohUrl?: string | null;
++  /** A DID that answers for every NSID, for a network whose lexicons have no DNS. */
++  lexiconAuthority?: string;
++  /** Bluesky API for actor search and avatars; null: off. */
++  appviewUrl?: string | null;
++  /** Constellation, for backlinks; null: off. */
++  constellationUrl?: string | null;
++  /** Default stream instances; null: that stream is off. */
++  jetstreamUrl?: string | null;
++  firehoseUrl?: string | null;
++  spacedustUrl?: string | null;
++  /** Sign in with a client whose metadata is at this page's own origin. */
++  oauthAtOrigin?: boolean;
++};
++
++const given: NetworkSettings = (globalThis as { PDSLS_NETWORK?: NetworkSettings }).PDSLS_NETWORK ?? {};
++const pick = <T>(value: T | undefined, fallback: T): T => (value === undefined ? fallback : value);
++
++export const network = {
++  plcDirectory: given.plcDirectory ?? "https://plc.directory",
++  dohUrl: pick(given.dohUrl, "https://dns.google/resolve?"),
++  lexiconAuthority: given.lexiconAuthority,
++  appviewUrl: pick(given.appviewUrl, "https://public.api.bsky.app"),
++  constellationUrl: pick(given.constellationUrl, "https://constellation.microcosm.blue"),
++  jetstreamUrl: pick(given.jetstreamUrl, "wss://jetstream1.us-east.bsky.network/subscribe"),
++  firehoseUrl: pick(given.firehoseUrl, "wss://bsky.network"),
++  spacedustUrl: pick(given.spacedustUrl, "wss://spacedust.microcosm.blue/subscribe"),
++  oauthAtOrigin: given.oauthAtOrigin === true,
++};
+diff --git a/src/views/settings.tsx b/src/views/settings.tsx
+index bed49ff..787a60e 100644
+--- a/src/views/settings.tsx
++++ b/src/views/settings.tsx
+@@ -2,10 +2,11 @@ import { createSignal } from "solid-js";
+ 
+ import { TextInput } from "../components/text-input.jsx";
+ import { ThemeSelection } from "../components/theme.jsx";
++import { network } from "../lib/network";
+ 
+ export const [hideMedia, setHideMedia] = createSignal(localStorage.hideMedia === "true");
+ const [plcDirectory, setPlcDirectory] = createSignal(
+-  localStorage.plcDirectory || "https://plc.directory",
++  localStorage.plcDirectory || network.plcDirectory,
+ );
+ export { plcDirectory };
+ 
+diff --git a/src/views/stream/config.ts b/src/views/stream/config.ts
+index a56c540..b68bd81 100644
+--- a/src/views/stream/config.ts
++++ b/src/views/stream/config.ts
+@@ -1,3 +1,4 @@
++import { network } from "../../lib/network";
+ import { localDateFromTimestamp } from "../../utils/format";
+ 
+ export type StreamType = "jetstream" | "firehose" | "spacedust";
+@@ -37,7 +38,7 @@ export const STREAM_CONFIGS: Record<StreamType, StreamConfig> = {
+     label: "Jetstream",
+     description: "A simplified event stream with support for collection and DID filtering.",
+     icon: "lucide--radio-tower",
+-    defaultInstance: "wss://jetstream1.us-east.bsky.network/subscribe",
++    defaultInstance: network.jetstreamUrl ?? "",
+     useFirehoseLib: false,
+     collectionsLabel: "Top Collections",
+     fields: [
+@@ -101,7 +102,7 @@ export const STREAM_CONFIGS: Record<StreamType, StreamConfig> = {
+     label: "Firehose",
+     description: "The raw event stream from a relay or PDS.",
+     icon: "lucide--rss",
+-    defaultInstance: "wss://bsky.network",
++    defaultInstance: network.firehoseUrl ?? "",
+     useFirehoseLib: true,
+     collectionsLabel: "Top Collections",
+     fields: [
+@@ -136,7 +137,7 @@ export const STREAM_CONFIGS: Record<StreamType, StreamConfig> = {
+     label: "Spacedust",
+     description: "A stream of links showing interactions across the network.",
+     icon: "lucide--sparkles",
+-    defaultInstance: "wss://spacedust.microcosm.blue/subscribe",
++    defaultInstance: network.spacedustUrl ?? "",
+     useFirehoseLib: false,
+     collectionsLabel: "Top Sources",
+     fields: [
+-- 
+2.56.0
+

package/stack/pdsls/server.mjs

@@ -0,0 +1,192 @@
+// PDSls (pds.ls) for this network: the record browser apps link to, built from a pinned upstream
+// commit with network.patch, which lets a host page give it the network's addresses. This serves
+// the built app with those addresses injected, its own OAuth client metadata, and the three
+// lookups the app falls back to when a browser fetch fails, answered from inside the network only.
+// pds.ls's own Worker also renders link previews and favicons from the public network; this does
+// not.
+//
+//   GET /resolve-handle-http?handle=<h>   https://<h>/.well-known/atproto-did, <h> under the domain
+//   GET /resolve-did-web?host=<h>         https://<h>/.well-known/did.json, <h> under the domain
+//   GET /oauth-client-metadata.json       a public client at PDSLS_PUBLIC_URL
+//   GET /_health                          200
+//   anything else                         a file of the app, else the app itself (it routes in the page)
+//
+// Settings:
+//   PDSLS_PUBLIC_URL        where browsers reach this, e.g. https://pdsls.local.snowglobe.at
+//   PDSLS_DOMAIN            the network's domain; lookups outside it are refused
+//   PDSLS_PLC_URL           the network's PLC directory
+//   PDSLS_JETSTREAM_URL     the stream page's default Jetstream (wss://.../subscribe)
+//   PDSLS_FIREHOSE_URL      the stream page's default relay or PDS (wss://...)
+//   PDSLS_LEXICON_AUTHORITY the DID that holds every lexicon on the network (optional)
+//   PDSLS_UPSTREAM          host:port to send every lookup to, ignoring DNS (the snowglobe's nginx);
+//                           unset, names resolve as usual (a globe's public names)
+//   PDSLS_DIST              the built app (default ./dist)
+//   PDSLS_BIND              host:port to listen on (default 0.0.0.0:8080)
+// A lookup verifies TLS against the system's CAs plus NODE_EXTRA_CA_CERTS (the snowglobe's CA).
+import dns from 'node:dns'
+import { readFileSync, statSync } from 'node:fs'
+import http from 'node:http'
+import https from 'node:https'
+import { extname, join, resolve, sep } from 'node:path'
+
+const env = process.env
+const PUBLIC_URL = (env.PDSLS_PUBLIC_URL ?? '').replace(/\/+$/, '')
+const DOMAIN = (env.PDSLS_DOMAIN ?? '').toLowerCase()
+const DIST = env.PDSLS_DIST ?? new URL('./dist', import.meta.url).pathname
+const [BIND_HOST, BIND_PORT] = (env.PDSLS_BIND ?? '0.0.0.0:8080').split(':')
+const [UP_HOST, UP_PORT] = (env.PDSLS_UPSTREAM ?? '').split(':')
+const LOOKUP_MS = 5_000
+const MAX_BYTES = 64 * 1024
+
+/** Whether `host` is the network's domain or a name under it. */
+export const inNetwork = (host, domain = DOMAIN) => {
+  const h = String(host).toLowerCase()
+  return Boolean(domain) && /^[a-z0-9.-]+$/.test(h) && (h === domain || h.endsWith(`.${domain}`))
+}
+
+/** The settings the app reads as globalThis.PDSLS_NETWORK. Services the network lacks are null. */
+export function networkSettings(e = env) {
+  return {
+    plcDirectory: e.PDSLS_PLC_URL,
+    dohUrl: null,
+    lexiconAuthority: e.PDSLS_LEXICON_AUTHORITY || undefined,
+    appviewUrl: null,
+    constellationUrl: null,
+    jetstreamUrl: e.PDSLS_JETSTREAM_URL || null,
+    firehoseUrl: e.PDSLS_FIREHOSE_URL || null,
+    spacedustUrl: null,
+    oauthAtOrigin: true,
+  }
+}
+
+/**
+ * The app's index.html with the network's settings set before any of its scripts run, and the
+ * public font host dropped (the text falls back to the browser's monospace font).
+ */
+export function injectSettings(html, settings) {
+  // JSON in a script element: escape what could end it.
+  const json = JSON.stringify(settings).replace(/</g, '\\u003c')
+  const tag = `<script>globalThis.PDSLS_NETWORK = ${json};</script>`
+  return html
+    .replace(/\s*<link[^>]+fonts\.bunny\.net[^>]*>/g, '')
+    .replace(/<head>/, `<head>\n    ${tag}`)
+}
+
+/** OAuth client metadata for a public browser client at `base`, with the scope pds.ls asks for. */
+export function clientMetadata(base) {
+  return {
+    client_id: `${base}/oauth-client-metadata.json`,
+    client_name: 'PDSls',
+    client_uri: base,
+    logo_uri: `${base}/favicon.ico`,
+    redirect_uris: [`${base}/`],
+    scope:
+      'atproto repo:*?action=create repo:*?action=update repo:*?action=delete blob:*/* space:*?authority=*&action=read space:*?authority=*&collection=*&action=create&action=update&action=delete space:*?manage=create&manage=update&manage=delete',
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+    token_endpoint_auth_method: 'none',
+    application_type: 'web',
+    dpop_bound_access_tokens: true,
+  }
+}
+
+/** GET https://<host><path>; with PDSLS_UPSTREAM, connected there whatever the name resolves to. */
+function lookup(host, path, accept) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(
+      {
+        host,
+        servername: host,
+        path,
+        headers: { accept, 'user-agent': 'pdsls-network/1' },
+        timeout: LOOKUP_MS,
+        ...(UP_HOST ? { lookup: (_name, opts, cb) => dns.lookup(UP_HOST, opts, cb), port: Number(UP_PORT) } : {}),
+      },
+      (res) => {
+        let size = 0
+        const chunks = []
+        res.on('data', (c) => {
+          size += c.length
+          if (size > MAX_BYTES) req.destroy(new Error('too large'))
+          else chunks.push(c)
+        })
+        res.on('end', () => resolve({ status: res.statusCode, type: res.headers['content-type'], body: Buffer.concat(chunks) }))
+      },
+    )
+    req.on('timeout', () => req.destroy(new Error('timed out')))
+    req.on('error', reject)
+  })
+}
+
+const TYPES = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript', '.css': 'text/css', '.json': 'application/json', '.svg': 'image/svg+xml', '.webp': 'image/webp', '.png': 'image/png', '.ico': 'image/x-icon', '.woff2': 'font/woff2', '.wasm': 'application/wasm', '.xml': 'application/xml', '.cur': 'image/x-icon' }
+
+/** The file of the app at URL path `path` (still percent-encoded), or null. */
+function file(path) {
+  try {
+    // Inside the folder, not merely starting with its name: /..%2fdist-backup/x is /app/dist-backup/x.
+    const root = resolve(DIST)
+    const full = join(root, decodeURIComponent(path))
+    if (!full.startsWith(root + sep) || !statSync(full).isFile()) return null
+    return full
+  } catch {
+    return null
+  }
+}
+
+let indexHtml = null
+const index = () => (indexHtml ??= injectSettings(readFileSync(join(DIST, 'index.html'), 'utf8'), networkSettings()))
+
+async function serve(req, res) {
+  const url = new URL(req.url ?? '/', 'http://x')
+  if (req.method !== 'GET' && req.method !== 'HEAD') return res.writeHead(405).end()
+  const send = (status, type, body, extra = {}) => {
+    res.writeHead(status, { 'content-type': type, 'x-content-type-options': 'nosniff', ...extra })
+    res.end(req.method === 'HEAD' ? undefined : body)
+  }
+
+  if (url.pathname === '/_health') return send(200, 'text/plain', 'ok\n')
+  if (url.pathname === '/oauth-client-metadata.json') {
+    return send(200, 'application/json', JSON.stringify(clientMetadata(PUBLIC_URL), null, 2) + '\n', { 'cache-control': 'no-cache' })
+  }
+  const lookups = {
+    '/resolve-handle-http': ['handle', '/.well-known/atproto-did', 'text/plain'],
+    '/resolve-did-web': ['host', '/.well-known/did.json', 'application/did+ld+json,application/json'],
+  }
+  if (url.pathname in lookups) {
+    const [param, path, accept] = lookups[url.pathname]
+    const host = url.searchParams.get(param) ?? ''
+    if (!inNetwork(host)) return send(400, 'text/plain', `${param} is not on this network\n`)
+    try {
+      const r = await lookup(host, path, accept)
+      return send(r.status, r.type ?? 'application/octet-stream', r.body)
+    } catch (err) {
+      return send(502, 'text/plain', `lookup failed: ${err.message}\n`)
+    }
+  }
+  if (url.pathname === '/resolve-handle-dns' || url.pathname === '/og-image' || url.pathname === '/favicon') {
+    return send(404, 'text/plain', 'not on this network\n')
+  }
+
+  const path = file(url.pathname)
+  if (path && !path.endsWith('index.html')) {
+    const immutable = url.pathname.startsWith('/assets/')
+    return send(200, TYPES[extname(path)] ?? 'application/octet-stream', readFileSync(path), {
+      'cache-control': immutable ? 'public, max-age=31536000, immutable' : 'no-cache',
+    })
+  }
+  // Every other path is a page of the app.
+  return send(200, TYPES['.html'], index(), { 'cache-control': 'no-cache' })
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  for (const v of ['PDSLS_PUBLIC_URL', 'PDSLS_DOMAIN', 'PDSLS_PLC_URL']) if (!env[v]) throw new Error(`set ${v}`)
+  index()
+  http
+    .createServer((req, res) =>
+      serve(req, res).catch((err) => {
+        console.error('pdsls:', req.url, err.message)
+        if (!res.headersSent) res.writeHead(500).end()
+      }),
+    )
+    .listen(Number(BIND_PORT), BIND_HOST, () => console.log(`pdsls: listening on ${BIND_HOST}:${BIND_PORT} for ${DOMAIN} at ${PUBLIC_URL}`))
+}

package/stack/relay/Dockerfile

@@ -0,0 +1,30 @@
+# The upstream relay, rebuilt with allow-private-hosts.patch.
+#
+# Upstream's relay refuses loopback and private addresses in two places, with no
+# setting to turn either off: the host check (an SSRF-safe transport) and the
+# firehose dialer for wss:// hosts (an SSRF-safe dialer). Its admin requestCrawl
+# accepts localhost:<port>, but the host check then fails, so a stock relay image can
+# never crawl a snowglobe PDS; and a PDS at an https name behind a local TLS proxy
+# resolves to a private address, which the dialer refuses. The patch makes both honor
+# RELAY_ALLOW_PRIVATE_HOSTS=true (host_checker.go and slurper.go); nothing else changes.
+#
+# The binary is built from the same commit as the published image, which supplies
+# everything else (admin UI, runtime layout).
+
+ARG INDIGO_COMMIT=b2619d864df00a66455bd9f5f0c83c1ac13ad73d
+
+FROM golang:1.26-alpine3.22 AS build
+ARG INDIGO_COMMIT
+RUN apk add --no-cache build-base git
+WORKDIR /src
+RUN git init -q \
+ && git remote add origin https://github.com/bluesky-social/indigo.git \
+ && git fetch -q --depth 1 origin "${INDIGO_COMMIT}" \
+ && git checkout -q FETCH_HEAD
+COPY allow-private-hosts.patch /tmp/
+RUN git apply /tmp/allow-private-hosts.patch
+ENV GOEXPERIMENT=loopvar
+RUN go build -tags timetzdata -o /relay ./cmd/relay
+
+FROM ghcr.io/bluesky-social/indigo:relay-${INDIGO_COMMIT}
+COPY --from=build /relay /relay

package/stack/relay/allow-private-hosts.patch

@@ -0,0 +1,55 @@
+diff --git a/cmd/relay/relay/host_checker.go b/cmd/relay/relay/host_checker.go
+index 251ff2c..1142778 100644
+--- a/cmd/relay/relay/host_checker.go
++++ b/cmd/relay/relay/host_checker.go
+@@ -4,6 +4,7 @@ import (
+ 	"context"
+ 	"fmt"
+ 	"net/http"
++	"os"
+ 	"time"
+ 
+ 	comatproto "github.com/bluesky-social/indigo/api/atproto"
+@@ -33,9 +34,16 @@ func NewHostClient(userAgent string) *HostClient {
+ 	if userAgent == "" {
+ 		userAgent = "indigo-relay (atproto-relay)"
+ 	}
++	// RELAY_ALLOW_PRIVATE_HOSTS=true lets a local network's relay check hosts on
++	// localhost and private addresses. Without it, an admin requestCrawl that names
++	// localhost:<port> is accepted and then fails the host check.
++	transport := ssrf.PublicOnlyTransport()
++	if os.Getenv("RELAY_ALLOW_PRIVATE_HOSTS") == "true" {
++		transport = http.DefaultTransport.(*http.Transport).Clone()
++	}
+ 	c := http.Client{
+ 		Timeout:   5 * time.Second,
+-		Transport: ssrf.PublicOnlyTransport(),
++		Transport: transport,
+ 	}
+ 	return &HostClient{
+ 		Client:    &c,
+diff --git a/cmd/relay/relay/slurper.go b/cmd/relay/relay/slurper.go
+index 67bc2cb..0b28733 100644
+--- a/cmd/relay/relay/slurper.go
++++ b/cmd/relay/relay/slurper.go
+@@ -7,6 +7,7 @@ import (
+ 	"log/slog"
+ 	"math/rand"
+ 	"net/http"
++	"os"
+ 	"strings"
+ 	"sync"
+ 	"sync/atomic"
+@@ -297,8 +298,10 @@ func (s *Slurper) subscribeWithRedialer(ctx context.Context, host *models.Host,
+ 		HandshakeTimeout: time.Second * 5,
+ 	}
+ 
+-	// if this isn't a localhost / private connection, then we should enable SSRF protections
+-	if !host.NoSSL {
++	// if this isn't a localhost / private connection, then we should enable SSRF protections.
++	// RELAY_ALLOW_PRIVATE_HOSTS=true skips them, so a local network's relay can dial wss://
++	// hosts whose names resolve to private addresses (a snowglobe's PDSes behind a TLS proxy).
++	if !host.NoSSL && os.Getenv("RELAY_ALLOW_PRIVATE_HOSTS") != "true" {
+ 		netDialer := ssrf.PublicOnlyDialer()
+ 		d.NetDialContext = netDialer.DialContext
+ 	}

package/stack/slingshot/Dockerfile

@@ -0,0 +1,36 @@
+# Slingshot (microcosm-rs), built from a pinned commit. Upstream publishes no image.
+#
+# Slingshot is the handle and record cache apps ask for a handle's DID and PDS
+# (com.bad-example.identity.resolveMiniDoc). It takes its directory and its feed as
+# settings (SLINGSHOT_PLC_DIRECTORY, SLINGSHOT_JETSTREAM), which is what lets it serve
+# this network instead of the public one.
+#
+# The build follows microcosm-rs's own slingshot/Dockerfile, except that the source comes
+# from the pinned commit rather than a build context.
+
+ARG MICROCOSM_COMMIT=3137b07d5268812d2de0f3177664be92196994d8
+
+FROM rust:1.96-bookworm AS build
+ARG MICROCOSM_COMMIT
+# aws-lc-sys builds a C library with cmake and bindgen (clang); reqwest's native-tls
+# and the jetstream client need the OpenSSL headers.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        clang libclang-dev build-essential cmake libssl-dev pkg-config git \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+RUN git init -q \
+ && git remote add origin https://tangled.org/jola.dev/microcosm-rs \
+ && git fetch -q --depth 1 origin "${MICROCOSM_COMMIT}" \
+ && git checkout -q FETCH_HEAD
+RUN cargo build --release -p slingshot
+
+FROM debian:12.14-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=build /src/target/release/slingshot /usr/local/bin/slingshot
+# slingshot serves ./static/index.html relative to its working directory.
+WORKDIR /app
+COPY --from=build /src/slingshot/static ./static
+RUN mkdir -p /data
+VOLUME ["/data"]
+ENTRYPOINT ["slingshot"]