@openmeet/snowglobe 0.0.0-stage → 0.3.0-rc.1

package/stack/https/proxy/server.mjs

@@ -0,0 +1,213 @@
+// A way into the https snowglobe for a browser on another computer, with no launch flags and no
+// hosts file: a proxy and the PAC file that points a browser at it, on one port. The browser asks the
+// PAC which names go through the proxy; for those it hands the proxy the name itself, and the proxy
+// connects every one of them to nginx. So every handle works the moment its account exists, and
+// nothing the browser looks up anywhere else changes.
+//
+// The PAC names an HTTP proxy (CONNECT), the kind every PAC reader understands, Windows' own
+// included. SOCKS5 is answered on the same port too, for a client set to it directly.
+//
+// The proxy reaches nginx and nothing else: a name outside the snowglobe, an IP address, a port other
+// than 443, or anything but a CONNECT is refused. On the one port:
+//
+//   GET /proxy.pac           the snowglobe's names: <domain>, *.<domain>
+//   GET /proxy-with-plc.pac  the same plus plc.directory, for a browser used only for the snowglobe:
+//                            plc.directory then means this snowglobe's PLC for every page in it
+//   GET /_health             200, for the container's healthcheck (not logged)
+//   CONNECT <name>:443       an HTTP proxy tunnel
+//   anything starting 0x05   SOCKS5
+//
+// The PAC names the proxy by the Host its request came in on, so it is right whatever port the
+// browser's machine forwards. Settings:
+//
+//   PROXY_DOMAIN    the snowglobe's domain (SG_DOMAIN)
+//   PROXY_UPSTREAM  host:port every allowed name goes to (default nginx:443)
+//   PROXY_BIND      host:port to listen on (default 0.0.0.0:1080)
+import http from 'node:http'
+import net from 'node:net'
+
+const DOMAIN = (process.env.PROXY_DOMAIN ?? '').toLowerCase()
+const [UP_HOST, UP_PORT] = (process.env.PROXY_UPSTREAM ?? 'nginx:443').split(':')
+const [BIND_HOST, BIND_PORT] = (process.env.PROXY_BIND ?? '0.0.0.0:1080').split(':')
+const HANDSHAKE_MS = 10_000
+
+/** Whether a CONNECT to `name`:`port` goes to nginx. */
+export function allowed(name, port, domain = DOMAIN) {
+  const n = String(name).toLowerCase().replace(/\.$/, '')
+  if (port !== 443 || !domain) return false
+  return n === domain || n.endsWith(`.${domain}`) || n === 'plc.directory'
+}
+
+/** The PAC file: the snowglobe's names go to the proxy at `proxy` (host:port), the rest direct. */
+export function pac(proxy, domain = DOMAIN, withPlc = false) {
+  const names = [`host == ${JSON.stringify(domain)}`, `dnsDomainIs(host, ${JSON.stringify(`.${domain}`)})`]
+  if (withPlc) names.push('host == "plc.directory"')
+  return `// The https snowglobe at ${domain}: its names through its proxy, which resolves them; the rest direct.
+function FindProxyForURL(url, host) {
+  host = host.toLowerCase();
+  if (${names.join(' ||\n      ')}) {
+    return "PROXY ${proxy}";
+  }
+  return "DIRECT";
+}
+`
+}
+
+/** The Host a PAC request came in on, when it is a plain host:port; else null. */
+export function proxyAddress(hostHeader) {
+  const h = String(hostHeader ?? '')
+  return /^[A-Za-z0-9.-]+:[0-9]{1,5}$/.test(h) || /^\[[0-9a-fA-F:]+\]:[0-9]{1,5}$/.test(h) ? h : null
+}
+
+// SOCKS5 replies (RFC 1928): succeeded, general failure, not allowed, host unreachable, refused,
+// command not supported, address type not supported.
+const REP = { ok: 0, fail: 1, notAllowed: 2, unreachable: 4, refused: 5, badCommand: 7, badAddress: 8 }
+const reply = (sock, rep) => sock.write(Buffer.from([5, rep, 0, 1, 0, 0, 0, 0, 0, 0]))
+
+/**
+ * Read a SOCKS5 greeting and CONNECT from `sock`, whose first bytes are `first`. Resolves to
+ * { name, port } with the socket ready for the reply, or null once it has refused and closed it.
+ */
+export function readConnect(sock, first) {
+  return new Promise((resolve) => {
+    let buf = first
+    let stage = 'greeting'
+    const done = (v) => {
+      // Paused, so nothing the browser sends before the reply is dropped; pipe() resumes it.
+      sock.pause()
+      sock.off('data', onData)
+      clearTimeout(timer)
+      resolve(v)
+    }
+    const refuse = (rep) => {
+      if (rep !== undefined) reply(sock, rep)
+      sock.end()
+      done(null)
+    }
+    const timer = setTimeout(() => refuse(), HANDSHAKE_MS)
+    const step = () => {
+      if (stage === 'greeting') {
+        if (buf.length < 2) return
+        const n = buf[1]
+        if (buf.length < 2 + n) return
+        const methods = buf.subarray(2, 2 + n)
+        buf = buf.subarray(2 + n)
+        if (!methods.includes(0)) {
+          sock.write(Buffer.from([5, 0xff]))
+          return refuse()
+        }
+        sock.write(Buffer.from([5, 0]))
+        stage = 'request'
+      }
+      if (buf.length < 4) return
+      const [ver, cmd, , atyp] = buf
+      if (ver !== 5) return refuse(REP.fail)
+      if (cmd !== 1) return refuse(REP.badCommand)
+      // Only a name: an address would skip the check on what the browser meant to reach.
+      if (atyp !== 3) return refuse(atyp === 1 || atyp === 4 ? REP.notAllowed : REP.badAddress)
+      if (buf.length < 5) return
+      const len = buf[4]
+      if (buf.length < 5 + len + 2) return
+      const name = buf.subarray(5, 5 + len).toString('latin1')
+      const port = buf.readUInt16BE(5 + len)
+      const rest = buf.subarray(5 + len + 2)
+      if (rest.length) sock.unshift(rest)
+      done({ name, port })
+    }
+    const onData = (chunk) => {
+      buf = Buffer.concat([buf, chunk])
+      step()
+    }
+    sock.on('data', onData)
+    step()
+  })
+}
+
+/**
+ * Splice `sock` to nginx for `name`:`port`, or refuse it. `answer` writes the protocol's reply:
+ * answer('ok'), answer('notAllowed'), answer('refused') or answer('unreachable'). `head` is anything
+ * the client sent after its request.
+ */
+function tunnel(how, sock, name, port, answer, head) {
+  if (!allowed(name, port)) {
+    console.log(`proxy: ${how} refused ${name}:${port}`)
+    answer('notAllowed')
+    return sock.end()
+  }
+  console.log(`proxy: ${how} ${name}:${port}`)
+  const up = net.connect(Number(UP_PORT), UP_HOST)
+  up.once('connect', () => {
+    answer('ok')
+    if (head?.length) up.write(head)
+    sock.pipe(up).pipe(sock)
+  })
+  up.on('error', (err) => {
+    console.error(`proxy: ${name}: ${err.message}`)
+    if (!sock.destroyed) {
+      answer(err.code === 'ECONNREFUSED' ? 'refused' : 'unreachable')
+      sock.end()
+    }
+  })
+  sock.on('error', () => up.destroy())
+  sock.once('close', () => up.destroy())
+}
+
+async function socks(sock, first) {
+  const req = await readConnect(sock, first)
+  if (!req) return
+  tunnel('socks', sock, req.name, req.port, (r) => reply(sock, REP[r]))
+}
+
+/** The name and port a CONNECT names (`name:port`), or null for an address or anything else. */
+export function connectTarget(target) {
+  const m = /^([A-Za-z0-9.-]+):([0-9]{1,5})$/.exec(String(target))
+  if (!m || /^[0-9.]+$/.test(m[1])) return null
+  return { name: m[1], port: Number(m[2]) }
+}
+
+const STATUS = { ok: '200 Connection Established', notAllowed: '403 Forbidden', refused: '502 Bad Gateway', unreachable: '504 Gateway Timeout' }
+
+const pacServer = http.createServer((req, res) => {
+  // Node passes on a target URL can't parse (`GET //[`); thrown here, it would end the proxy.
+  let path
+  try {
+    path = new URL(req.url ?? '/', 'http://x').pathname
+  } catch {
+    return res.writeHead(400).end()
+  }
+  if (path === '/_health') return res.writeHead(200).end('ok\n')
+  const proxy = proxyAddress(req.headers.host)
+  // Who fetched the PAC is the first thing to know when a browser seems to ignore it.
+  console.log(`pac: ${req.method} ${path} host=${req.headers.host ?? '-'} agent=${req.headers['user-agent'] ?? '-'}`)
+  if (req.method !== 'GET' && req.method !== 'HEAD') return res.writeHead(405).end()
+  if ((path !== '/proxy.pac' && path !== '/proxy-with-plc.pac') || !proxy) return res.writeHead(404).end('not here\n')
+  const body = pac(proxy, DOMAIN, path === '/proxy-with-plc.pac')
+  res.writeHead(200, { 'content-type': 'application/x-ns-proxy-autoconfig', 'cache-control': 'no-cache' })
+  res.end(req.method === 'HEAD' ? undefined : body)
+})
+
+pacServer.on('connect', (req, sock, head) => {
+  sock.on('error', () => {})
+  const t = connectTarget(req.url)
+  const answer = (r) => sock.write(`HTTP/1.1 ${STATUS[r]}\r\n\r\n`)
+  if (!t) {
+    console.log(`proxy: http refused ${req.url}`)
+    answer('notAllowed')
+    return sock.end()
+  }
+  tunnel('http', sock, t.name, t.port, answer, head)
+})
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  if (!DOMAIN) throw new Error('set PROXY_DOMAIN')
+  net
+    .createServer((sock) => {
+      sock.on('error', () => {})
+      sock.once('data', (first) => {
+        if (first[0] === 5) return void socks(sock, first)
+        sock.unshift(first)
+        pacServer.emit('connection', sock)
+      })
+    })
+    .listen(Number(BIND_PORT), BIND_HOST, () => console.log(`proxy: listening on ${BIND_HOST}:${BIND_PORT} for ${DOMAIN}, to ${UP_HOST}:${UP_PORT}`))
+}

package/stack/init/init.sh

@@ -0,0 +1,118 @@
+#!/bin/sh
+set -eu
+
+# atproto-devnet init: create invite code, seed accounts, write credentials
+# Runs as a one-shot container after PDS + PLC are healthy.
+
+PDS_URL="http://pds:3000"
+DATA_DIR="/devnet-data"
+
+log() { echo "[init] $*"; }
+
+# Install curl + jq (alpine base image)
+apk add --no-cache curl jq >/dev/null 2>&1
+
+# Wait for PDS to be truly ready (healthcheck may pass before XRPC is ready)
+log "Waiting for PDS XRPC..."
+for i in $(seq 1 30); do
+  if curl -sf "${PDS_URL}/xrpc/_health" >/dev/null 2>&1; then
+    break
+  fi
+  sleep 1
+done
+
+# ── Create invite code ────────────────────────────────────────────
+log "Creating invite code..."
+INVITE_RESPONSE=$(curl -sf -X POST "${PDS_URL}/xrpc/com.atproto.server.createInviteCode" \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Basic $(echo -n "admin:${PDS_ADMIN_PASSWORD}" | base64)" \
+  -d '{"useCount": 100}')
+
+INVITE_CODE=$(echo "$INVITE_RESPONSE" | jq -r '.code')
+log "Invite code: ${INVITE_CODE}"
+
+# ── Seed accounts ─────────────────────────────────────────────────
+if [ "${SEED_ACCOUNTS}" = "true" ]; then
+  # Skip if accounts were already seeded on THIS PDS (idempotent re-runs). data/ is a
+  # host directory that outlives `down -v`, so after a fresh volume (or a different
+  # PDS image) accounts.json can name accounts the running PDS has never seen.
+  SEEDED_DID=$(jq -r '[.. | objects | select(has("did")) | .did][0] // empty' "${DATA_DIR}/accounts.json" 2>/dev/null || true)
+  # getRepoStatus answers from the PDS's own store, with no DID resolution.
+  if [ -n "${SEEDED_DID}" ] && curl -sf "${PDS_URL}/xrpc/com.atproto.sync.getRepoStatus?did=${SEEDED_DID}" >/dev/null 2>&1; then
+    log "Accounts already seeded, skipping."
+  else
+  log "Seeding accounts..."
+
+  # Initialize output files
+  echo "{}" > "${DATA_DIR}/accounts.json"
+  : > "${DATA_DIR}/accounts.env"
+  echo "SG_INVITE_CODE=${INVITE_CODE}" >> "${DATA_DIR}/accounts.env"
+
+  create_account() {
+    local handle="$1"
+    local email="$2"
+    local password="$3"
+    local var_prefix="$4"
+
+    log "Creating account: ${handle}"
+    RESULT=$(curl -sf -X POST "${PDS_URL}/xrpc/com.atproto.server.createAccount" \
+      -H "Content-Type: application/json" \
+      -d "{
+        \"handle\": \"${handle}\",
+        \"email\": \"${email}\",
+        \"password\": \"${password}\",
+        \"inviteCode\": \"${INVITE_CODE}\"
+      }")
+
+    DID=$(echo "$RESULT" | jq -r '.did')
+    ACCESS_JWT=$(echo "$RESULT" | jq -r '.accessJwt')
+
+    if [ "$DID" = "null" ] || [ -z "$DID" ]; then
+      log "WARNING: Failed to create ${handle}: $(echo "$RESULT" | jq -r '.message // "unknown error"')"
+      return 1
+    fi
+
+    log "Created ${handle} → ${DID}"
+
+    # Append to accounts.env
+    echo "${var_prefix}_HANDLE=${handle}" >> "${DATA_DIR}/accounts.env"
+    echo "${var_prefix}_DID=${DID}" >> "${DATA_DIR}/accounts.env"
+    echo "${var_prefix}_PASSWORD=${password}" >> "${DATA_DIR}/accounts.env"
+    echo "${var_prefix}_EMAIL=${email}" >> "${DATA_DIR}/accounts.env"
+
+    # Append to accounts.json
+    ACCOUNTS=$(cat "${DATA_DIR}/accounts.json")
+    echo "$ACCOUNTS" | jq \
+      --arg handle "$handle" \
+      --arg did "$DID" \
+      --arg password "$password" \
+      --arg email "$email" \
+      ". + {\"${var_prefix}\": {\"handle\": \$handle, \"did\": \$did, \"password\": \$password, \"email\": \$email}}" \
+      > "${DATA_DIR}/accounts.json"
+
+    return 0
+  }
+
+  create_account \
+    "alice${HANDLE_DOMAIN}" \
+    "alice@${SG_DOMAIN:-${DEVNET_DOMAIN:-devnet.test}}" \
+    "alice-devnet-pass" \
+    "ALICE"
+
+  create_account \
+    "bob${HANDLE_DOMAIN}" \
+    "bob@${SG_DOMAIN:-${DEVNET_DOMAIN:-devnet.test}}" \
+    "bob-devnet-pass" \
+    "BOB"
+
+  log "Accounts seeded. Credentials in ${DATA_DIR}/accounts.env"
+  fi
+else
+  log "Skipping account seeding (SEED_ACCOUNTS=${SEED_ACCOUNTS})"
+  echo "SG_INVITE_CODE=${INVITE_CODE}" > "${DATA_DIR}/accounts.env"
+fi
+
+# Make output files world-readable/writable so host user can read them
+chmod 666 "${DATA_DIR}/accounts.env" "${DATA_DIR}/accounts.json" 2>/dev/null || true
+
+log "Init complete."

package/stack/page/fonts/OFL-jetbrains-mono.txt

@@ -0,0 +1,93 @@
+Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/stack/page/fonts/OFL-schibsted-grotesk.txt

@@ -0,0 +1,93 @@
+Copyright 2023 The Schibsted-Grotesk Project Authors (https://github.com/schibsted/schibsted-grotesk)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.