vinted-bot 2.1.0__tar.gz

vinted_bot-2.1.0/.dockerignore

@@ -0,0 +1,14 @@
+.venv/
+.git/
+.github/
+data/
+docs/
+tests/
+*.md
+!README.md
+.env
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+__pycache__/
+*.db

vinted_bot-2.1.0/.env.example

@@ -0,0 +1,126 @@
+# You don't have to change anything in this file to get started.
+# Searches and Discord webhooks are set up in the dashboard at http://localhost:8000
+# (or with the CLI) — not here. Every line below is optional and shows its default.
+# Full reference: docs/configuration.md
+
+# --- Telegram (only if you want alerts there) ----------------------------------------
+# Talk to @BotFather on Telegram to create a bot; it gives you a token like
+# 123456:AAxxxx. Setting this turns on Telegram delivery and the pairing bot.
+# VINTED_BOT_TELEGRAM_BOT_TOKEN=
+
+# --- Web dashboard -------------------------------------------------------------------
+# On by default at http://localhost:8000, no password. That is safe because only your
+# own machine can reach it. Set a token before exposing it any further: anyone who can
+# open the dashboard can add, remove and reroute your alerts.
+# Generate one with: openssl rand -hex 32
+# VINTED_BOT_WEB_AUTH_TOKEN=
+
+# Set to false if you only use the CLI.
+# VINTED_BOT_WEB_ENABLED=true
+
+# Localhost only. The container sets 0.0.0.0 internally; the compose file is what limits
+# who can reach the published port.
+# VINTED_BOT_WEB_HOST=127.0.0.1
+# VINTED_BOT_WEB_PORT=8000
+
+# The address the dashboard is reachable at from wherever you read your alerts — set it
+# when the dashboard sits behind a reverse proxy or a tunnel. It becomes the Dashboard
+# link in Discord messages; unset, that link points at http://<host>:<port> above.
+# VINTED_BOT_WEB_PUBLIC_URL=
+
+# Extra host names the dashboard answers to, comma-separated (e.g. nas.local). It always
+# answers to localhost, any IP address and the host of WEB_PUBLIC_URL; other names get a
+# 400, which stops other websites using it through your browser (DNS rebinding).
+# VINTED_BOT_WEB_ALLOWED_HOSTS=
+
+
+# ======================================================================================
+# Everything below is tuning. The defaults are deliberate; skip this on a first read.
+# ======================================================================================
+
+# --- How often to check --------------------------------------------------------------
+# Seconds between checks for a new search. Per-search overrides live in the app itself.
+# Below 10 is ignored: Vinted's own catalog lags further behind than that, so checking
+# faster finds nothing sooner and does get you blocked.
+# VINTED_BOT_POLL_DEFAULT_INTERVAL_S=60
+
+# How old a listing may be and still count as new, in minutes. Listings the app can tell
+# were already on Vinted longer ago are skipped, and after a gap in checking longer than
+# this (the app off, the computer asleep) the first check records what it missed without
+# announcing it, so a restart never replays yesterday's catalog.
+# VINTED_BOT_FRESHNESS_WINDOW_MIN=20
+
+# What a brand-new search does on its first check:
+#   silent  notify nothing, just remember what is already there (default)
+#   newest  send exactly one listing, so you can confirm delivery works
+# VINTED_BOT_FIRST_RUN_MODE=silent
+
+
+# --- Staying unblocked ---------------------------------------------------------------
+# Start a fresh session after this many minutes. Blocks track how long a session has been
+# alive more than how fast it is used, so replacing them on a timer helps.
+# VINTED_BOT_SESSION_ROTATE_MINUTES=60
+
+# Present a real browser's TLS fingerprint instead of Python's. Only worth turning on if
+# you are getting blocked while the same search loads fine in your browser. Needs the
+# image built with the 'impersonate' extra.
+# VINTED_BOT_HTTP_IMPERSONATE=false
+
+# A text file of proxy URLs, one per line. Off by default and rarely needed.
+# VINTED_BOT_PROXY_FILE=
+
+# How long to wait for Vinted before giving up on a single request.
+# VINTED_BOT_REQUEST_TIMEOUT_S=15
+
+
+# --- Noticing when something is wrong -------------------------------------------------
+# How many checks with no new listing before a search is treated as stuck. It is only
+# treated as stuck if other searches on the same site are still finding things.
+# VINTED_BOT_WATCHDOG_STALE_CYCLES=10
+
+# What to do about it: warn, or also start a fresh session (default).
+# VINTED_BOT_WATCHDOG_ACTION=rotate
+
+# Give up on an undelivered notification after this long. An alert about a listing from
+# two hours ago is not worth sending.
+# VINTED_BOT_OUTBOX_EXPIRY_MINUTES=60
+
+
+# --- Where things are stored ----------------------------------------------------------
+# Inside Docker this is already /data/app.db; leave it alone unless you know why.
+# Unset outside Docker: ./data/app.db if that file already exists (so upgrades keep your
+# searches), otherwise your user data folder, e.g. ~/.local/share/vinted-bot/app.db.
+# VINTED_BOT_DB_PATH=./data/app.db
+
+# Delete stored listings after this many days. Does not cause anything to be re-sent.
+# VINTED_BOT_ITEM_RETENTION_DAYS=30
+
+# Keep each listing's raw API payload. Useful when debugging, but it stores more seller
+# data than notifications need, so it is off by default.
+# VINTED_BOT_KEEP_RAW_JSON=false
+
+
+# --- Time ------------------------------------------------------------------------------
+# The time zone quiet hours and the stats page use. TZ is used if this is unset; the
+# dashboard's settings page can change it later.
+# VINTED_BOT_TIMEZONE=UTC
+
+
+# --- Updating --------------------------------------------------------------------------
+# Set by the installers' start-at-login entries (launchd, systemd or windows-launcher) to
+# say something restarts the app after it exits, so updating from the dashboard can
+# restart it too. Only set it for your own service if that service restarts after any exit.
+# VINTED_BOT_SUPERVISED=
+
+
+# --- Logging ---------------------------------------------------------------------------
+# VINTED_BOT_LOG_LEVEL=INFO
+# console while you are watching, json when something else is collecting it.
+# VINTED_BOT_LOG_FORMAT=console
+
+
+# --- Working on the code ----------------------------------------------------------------
+# 'mock' replays recorded responses from disk instead of calling Vinted, so you can
+# develop and demo offline. Requires a scenario directory.
+# VINTED_BOT_FETCH_MODE=live
+# VINTED_BOT_MOCK_SCENARIO_DIR=

vinted_bot-2.1.0/.gitignore

@@ -0,0 +1,23 @@
+.venv/
+__pycache__/
+*.py[cod]
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.coverage
+htmlcov/
+dist/
+build/
+*.egg-info/
+
+# Runtime data and secrets — never commit these.
+.env
+data/
+*.db
+*.db-wal
+*.db-shm
+
+.DS_Store
+
+# Landing site build output (python3 site/build.py)
+site/dist/

vinted_bot-2.1.0/.python-version

@@ -0,0 +1 @@
+3.13

vinted_bot-2.1.0/CHANGELOG.md

@@ -0,0 +1,182 @@
+# Changelog
+
+Every release, newest first. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+and versions follow [Semantic Versioning](https://semver.org/). Each version's section here
+becomes the text of its GitHub release, so write it for the people running the app.
+
+## [Unreleased]
+
+## [2.1.0] - 2026-10-30
+
+### Changed
+
+- **Renamed to vinted-bot** (from vinted-sniper), the name people search for. Everything
+  uses it now: the `vinted-bot` command, the PyPI package `vinted-bot`, the Docker image
+  `ghcr.io/jasp-nerd/vinted-bot`, the repository github.com/jasp-nerd/vinted-bot (old links
+  redirect), the website vinted-bot.jaspnerd.dev, settings (`VINTED_BOT_...`), the data folder
+  (`vinted-bot`), the installers' start-at-login entries, the Docker volume
+  (`vinted-bot-data`), the default Discord name and the webhook headers
+  (`X-Vinted-Bot-Signature`, `X-Vinted-Bot-Timestamp`). The old names are not read any more,
+  so this is a fresh install: install vinted-bot with the commands in the README, uninstall
+  the old copy, and rename any settings in your `.env`. To keep your searches, copy the old
+  data folder's `app.db` into the new one before the first start.
+- The installers' start-at-login entries now tell the app they restart it
+  (`VINTED_BOT_SUPERVISED`), and the Windows launcher stays running in the background so it
+  can install an update while the app is closed.
+
+### Added
+
+- **Update from the dashboard.** Where the installer set vinted-bot up to start by itself,
+  "Update now" installs the new version and restarts into it, and "Install updates by
+  itself" (off unless you turn it on) does that between 4 and 5 at night, never while an
+  alert is on its way out, then says so in your status alerts. Installed with uv or pipx but
+  started by hand, the button installs it and tells you how to restart. Docker and source
+  installs are shown the command to run. Updates only ever come from PyPI through uv or
+  pipx, and only when GitHub has a newer release; a failed update leaves the running version
+  alone and says what went wrong.
+
+### Removed
+
+- The empty `web` extra, kept in 2.0 only so 1.x install commands still worked. The
+  dashboard is part of every install.
+
+## [2.0.0] - 2026-10-30
+
+Vinted moved its search to a new address in September 2026, and every earlier version stopped
+finding listings. This release works again, and comes with a rebuilt dashboard, many more
+filters, new-look alerts and one-line installers for Windows, macOS and Linux. Your searches
+and destinations carry over: the database upgrades itself on the first start.
+
+### Fixed
+
+- Searches work again after Vinted's September 2026 move to a new search address
+  ([#9](https://github.com/jasp-nerd/vinted-bot/issues/9),
+  [#12](https://github.com/jasp-nerd/vinted-bot/issues/12),
+  [#14](https://github.com/jasp-nerd/vinted-bot/issues/14)). Filters saved before the move
+  keep working, and brand, size and condition show up in alerts again.
+- The search builder's filter options load again.
+- A listing that turns up in the results after a newer one was announced is no longer
+  skipped forever. New listings are now recognised by their id, since Vinted's search stopped
+  saying when a photo was taken.
+- Excluding a word only matches whole words, ignoring accents and capitals: excluding "art"
+  no longer drops "smartphone".
+- ntfy alerts with accents or a euro sign in the title no longer fail to send.
+- A listing title containing brackets or HTML can no longer turn into a link in ntfy, or load
+  an image in an Apprise email.
+- Prices read back as "15.00" instead of "15.0", and "12,50" means the same thing in the
+  dashboard, the command line and the Telegram bot.
+- A database upgrade that fails part-way no longer leaves the database half changed.
+- A locked database no longer stops the whole app from its heartbeat.
+- A search that has failed since it was added shows as failing, not as starting.
+- Restarting no longer fires every search in the same second.
+- Starting again after the app was off, the computer asleep or Vinted refusing for a while no
+  longer announces a whole page of old listings as new. The first check back records what it
+  missed quietly. The same goes for the first check after upgrading from 1.x, which now
+  carries on from the newest listing 1.x had seen.
+- "Ignore listings older than" (and `watch --max-age`, and `FRESHNESS_WINDOW_MIN`) works
+  again: it skips listings the app can tell were already on Vinted that long ago, such as an
+  old listing whose price was just cut into range.
+- Changing a search's link or sites starts it over quietly, instead of announcing everything
+  above where the old search had got to, and its typical price starts again too.
+- A listing still for sale after the retention period (30 days) is no longer announced again,
+  by a search or by a seller watch.
+- A listing two searches match is judged by each search's own typical price, so a narrow
+  search's steal is no longer reported as overpriced because a broader search found it
+  first.
+- When Vinted refuses the homepage itself, a search backs off like for any other refusal
+  instead of retrying every 15 seconds. A search that crashes is restarted with growing
+  pauses, and tokens that keep being rejected are no longer retried every five seconds.
+- When Vinted refuses or rate-limits seller lookups, the app stops asking for a while
+  (honouring `Retry-After`), and the listings waiting on one are listed in "Not sent" as
+  "seller unknown".
+- Alerts a destination did not want (for example a normal listing for a steals-only
+  channel) no longer count as failed deliveries on the alerts and stats pages.
+- An open dashboard tab no longer misses finds after a quiet month emptied the stored
+  listings.
+- Watch alerts sent to a webhook are posted one watch at a time, so `search` names the right
+  watch.
+- **Security:** the dashboard only answers to localhost, IP addresses, the `WEB_PUBLIC_URL`
+  host and the new `WEB_ALLOWED_HOSTS`, however it is bound. Before, the Docker image's
+  `0.0.0.0` bind switched that check off, which let a web page use a password-less
+  dashboard through your browser (DNS rebinding). If you reach the dashboard by a name, add
+  it to `VINTED_SNIPER_WEB_ALLOWED_HOSTS`; the error page says so too.
+- **Security:** a search name can no longer run script in the stats page's chart tooltips.
+- **Security:** in a CSV export, a cell that would start a spreadsheet formula (a title such
+  as `=HYPERLINK(...)`) is prefixed with an apostrophe so it shows as text.
+- **Security:** signing in to the dashboard gives each browser its own random session, which
+  signing out revokes, and changing the password signs everyone out. After five wrong
+  passwords from one address, sign-in waits 15 minutes.
+
+### Added
+
+- **A rebuilt dashboard**: a guided setup on first run that ends with a test alert, a live
+  feed of finds laid out like Vinted's own grid (save, hide, block the seller), a plain-words
+  status for every search, a "Not sent" list showing why each skipped listing was skipped, a
+  watchlist, stats, settings, dark mode and a phone layout.
+- **More filters**: words the title must contain (with alternatives such as `501|505`), a title
+  pattern, a minimum price, seller rating, number of reviews and country, and a seller
+  blocklist.
+- **Deals**: each search learns its typical price, alerts show how far under it a listing is,
+  and a search or a destination can be set to deals only.
+- **Quiet hours** per search, in your time zone: hold alerts until the end, drop them, or send
+  them without a sound.
+- One search can cover several country sites.
+- **Watches**: hear when a listing's price drops or it is reserved, sold or removed, and when
+  a seller uploads something new.
+- **Discord alerts** as cards with a photo gallery, the total price, a deal badge and Buy,
+  Message and Open buttons, in the search's colour. Up to three share a message, and bigger bursts become a
+  compact digest. Mentions are opt-in.
+- **Telegram alerts** as photo cards with buttons, an optional gallery style, and a digest in
+  busy groups. A paired chat can `/list`, `/pause`, `/resume`, `/add` and `/remove` searches
+  and ask for `/status`.
+- Alerts are written in the language of the listing's site (English, French, German, Dutch,
+  Spanish, Italian, Polish, Lithuanian and Czech) with prices formatted to match.
+- ntfy alerts gain the photo, action buttons and a higher priority for deals.
+- **Apprise**, an optional extra, for email, Slack, Pushover, Gotify, Matrix and many more.
+- Webhook payloads can be signed with a shared secret (HMAC-SHA256).
+- A test button for every destination, and a preview of what its alerts will look like.
+- Export found listings as CSV or JSON, from the dashboard or `vinted-sniper export`.
+- A notice in the dashboard when a newer version is out (one request to GitHub a day, can be
+  turned off), and an optional uptime ping to a service such as healthchecks.io.
+- `vinted-sniper run --open` opens the dashboard once it is ready.
+- One-line installers for Windows (`install.ps1`) and macOS and Linux (`install.sh`), with
+  optional start at login, no Docker and no admin rights.
+- Docker: `PUID` and `PGID` to choose who owns the data folder, so NAS shares and cloud
+  volumes owned by root work without manual fixes, a `TZ` setting, and an opt-in automatic
+  updater.
+- Templates for Unraid, Umbrel, CasaOS, Render and Coolify in `deploy/`.
+- `llms.txt`, a setup guide an AI assistant can follow to walk someone through installing,
+  and a ready-made prompt in the README.
+- Issue forms that ask for the version, the status output and the log.
+
+### Changed
+
+- The `latest` image tag now means the newest release. Builds of the main branch are tagged
+  `edge`.
+- The dashboard is part of every install. `vinted-sniper[web]` still works but is no longer
+  needed.
+- Outside a container, the database lives in your user data folder (unless `./data/app.db`
+  already exists, which keeps being used).
+- A search you haven't routed anywhere goes to every active destination, including ones added
+  later.
+- The same Vinted link can be added twice with different filters, for example to send a
+  stricter copy somewhere else.
+- The webhook payload is version 2: every version 1 field is still there, with the alert
+  kind, deal, photos and seller details added beside them. Each POST holds one search's
+  listings, or one watch's. The fields and the signature headers are documented in
+  docs/configuration.md.
+- **RSS feeds of a password-protected dashboard need the new feed key** instead of the
+  password: `?key=<your password>` no longer works, because feed addresses end up in reader
+  settings and proxy logs. Copy the new address from the "RSS feed of this search" link on
+  the search's page.
+
+## [0.1.0] - 2026-08-16
+
+First version, never tagged as a release: polling with a stale-catalog watchdog, filters on
+the total price including buyer protection, Discord, Telegram, ntfy, RSS and webhook
+delivery through a reliable outbox, and a web dashboard.
+
+[Unreleased]: https://github.com/jasp-nerd/vinted-bot/compare/v2.1.0...HEAD
+[2.1.0]: https://github.com/jasp-nerd/vinted-bot/compare/v2.0.0...v2.1.0
+[2.0.0]: https://github.com/jasp-nerd/vinted-bot/compare/v0.1.0...v2.0.0
+[0.1.0]: https://github.com/jasp-nerd/vinted-bot/commits/v0.1.0

vinted_bot-2.1.0/CONTRIBUTING.md

@@ -0,0 +1,148 @@
+# Contributing
+
+Bug reports with logs attached are the most useful thing anyone can send. For code, read on.
+
+## Setting up
+
+You need [uv](https://docs.astral.sh/uv/). It installs the right Python by itself.
+
+```bash
+git clone https://github.com/jasp-nerd/vinted-bot && cd vinted-bot
+uv sync --all-extras
+uv run vinted-bot run --open
+```
+
+The test suite never contacts Vinted, so it runs anywhere.
+[docs/architecture.md](docs/architecture.md) explains how the pieces fit together.
+
+### A dashboard with something in it
+
+For screenshots, the public demo or working on the dashboard, `scripts/seed_demo.py` fills
+a fresh database with invented searches, a month of finds, destinations and delivery
+history. Its photos are the AI-generated ones hosted with the project site
+(`scripts/demo/catalog.json` lists them), so nothing points at a real listing.
+
+```bash
+uv run python scripts/seed_demo.py /tmp/demo.db
+VINTED_BOT_DB_PATH=/tmp/demo.db VINTED_BOT_FETCH_MODE=mock \
+  VINTED_BOT_MOCK_SCENARIO_DIR=scripts/demo/mock uv run vinted-bot run --open
+```
+
+The mock scenario answers every search with an empty page, so this never talks to Vinted
+and never sends an alert. Leave out the two mock variables and the demo searches check
+Vinted for real, adding real finds next to the invented ones. Even then nothing already
+on Vinted is announced, and the demo's places for alerts reach nobody (a random ntfy
+name, a switched-off Discord webhook, a Telegram chat that doesn't exist). Run it from a
+folder without your own `.env`, or it picks up your real bot token and settings.
+
+The dashboard's templates live in `src/vinted_bot/web/templates` and its CSS and
+script in `web/static`; they need no build step. Static files are served with a content
+hash in the URL, so a reload always picks up a change.
+
+## Before you push
+
+CI runs exactly these, and a pull request needs all of them green:
+
+```bash
+uv run pytest
+uv run ruff check .
+uv run ruff format --check .
+uv run mypy
+uv run deptry src
+uv run vulture
+uv run --with zizmor zizmor .github/workflows   # only if you touched a workflow
+```
+
+If you changed `install.sh` or `docker/entrypoint.sh`, also run
+`uvx --from shellcheck-py shellcheck -s sh install.sh docker/entrypoint.sh`. If you changed
+the Dockerfile, `docker build .` and start the result once.
+
+## What a change is held to
+
+[docs/REVIEW.md](docs/REVIEW.md) is the checklist every change is reviewed against, yours and
+the maintainer's alike. The short version:
+
+- Every new behaviour gets a test that would fail without it. Don't loosen a test to make it
+  pass.
+- Match the code around you: docstrings that explain *why*, plain asyncio, SQL only in
+  `db/repo.py`, structlog events named like `poller.started`.
+- No retry or fallback whose only job is to make a symptom go away.
+- The README and docs never claim something the code doesn't do.
+- Never log in to Vinted, and no features that need a Vinted account (buying, messaging,
+  offers). That is a deliberate line, not a missing feature.
+
+## Commit messages
+
+One plain sentence in the imperative, saying what the change does for someone using or
+reading the code:
+
+```
+Retry Telegram sends that hit a rate limit after the delay Telegram asks for
+```
+
+No prefixes (`feat:`, `fix(web):`), no ticket numbers in the subject, no trailers crediting
+tools. Add a body when the *why* isn't obvious from the subject.
+
+## Pull requests
+
+Keep each one about one thing. Say what changed and how you checked it. A new abstraction
+(a base class, a registry, a new layer) needs one line explaining why the simpler version
+wasn't enough.
+
+User-facing changes get a line in `CHANGELOG.md` under `[Unreleased]`, written for the
+people running the app.
+
+## Cutting a release
+
+For the maintainer. A release is one button; the workflows do the rest.
+
+1. In a pull request: in `CHANGELOG.md`, rename `## [Unreleased]` to `## [X.Y.Z] - YYYY-MM-DD`,
+   add a fresh empty `## [Unreleased]` above it, and update the compare links at the bottom.
+   Set `version = "X.Y.Z"` in `pyproject.toml` and `__version__` in
+   `src/vinted_bot/__init__.py`, run `uv lock`, and merge it to main.
+2. On GitHub, open **Actions**, choose **Release** on the left, click **Run workflow**, leave
+   the branch on `main`, and click the green **Run workflow** button. There is nothing to
+   fill in.
+
+The Release workflow then:
+
+- reads the version from `pyproject.toml`, and stops without changing anything if
+  `CHANGELOG.md` has no `## [X.Y.Z]` section, if the tag `vX.Y.Z` already exists, or if it
+  was started on a branch other than main;
+- creates the tag `vX.Y.Z` on that commit;
+- builds the package and publishes it to PyPI;
+- builds the Docker image for amd64 and arm64 and tags it `X.Y.Z`, `X.Y`, `X` and `latest`
+  (by calling **Publish image**);
+- last, creates the GitHub release with this version's changelog section as its text and the
+  package files attached. The dashboard's update notice reads that release, so it only
+  appears once the package and the image are out.
+
+If a check fails before the tag is made, fix it and click Run workflow again. If a later job
+fails (PyPI or the registry having a bad moment), open that run and use **Re-run failed
+jobs**: a new run would refuse, because the tag exists by then. If the fix needs a code
+change, release it as the next version instead.
+
+Pushing a tag by hand (`git tag -a vX.Y.Z -m vX.Y.Z && git push origin vX.Y.Z`) still works
+and does the same, with the image built by **Publish image** on that push. Builds of main
+keep going out as the `edge` image in between.
+
+### One-time PyPI setup
+
+The Release workflow publishes with PyPI trusted publishing, so no token is stored anywhere.
+Before the first release:
+
+1. On pypi.org, open Your account, **Publishing**, and under "Add a new pending publisher"
+   choose GitHub and fill in:
+
+   | Field | Value |
+   |---|---|
+   | PyPI Project Name | `vinted-bot` |
+   | Owner | `jasp-nerd` |
+   | Repository name | `vinted-bot` |
+   | Workflow name | `release.yml` |
+   | Environment name | `pypi` |
+
+   The first release creates the project and turns the pending publisher into a normal one.
+2. In the GitHub repository's **Settings**, **Environments**, create an environment named
+   `pypi`. Adding yourself as a required reviewer there means each PyPI upload waits for a
+   click.

vinted_bot-2.1.0/Dockerfile

@@ -0,0 +1,76 @@
+# Build stage: resolve and install dependencies into a self-contained virtualenv.
+# Both base images are pinned by digest so a rebuild of the same commit gets the same bytes;
+# Dependabot moves the digests forward weekly.
+FROM ghcr.io/astral-sh/uv:python3.13-trixie-slim@sha256:e586c1c65b7071aec78f02c5587c76c5011159cd76b3d6f1255f40e48e850abc AS build
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+# Dependencies change far less often than the code, so they get their own layer and their
+# own cache mount. Editing a source file then costs a rebuild of the last layer only.
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=README.md,target=README.md \
+    uv sync --locked --no-install-project --no-dev
+
+COPY . /app
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --locked --no-editable --no-dev
+
+
+# Runtime stage: the virtualenv and the code, nothing else.
+FROM python:3.13-slim-trixie@sha256:2d44738ebf4ce5f63b9d9ea871e9c7cfdc0426f7b0c97cac915fd88ded1d86bb
+
+# Static so a local build carries them too; the publish workflow adds version and revision.
+LABEL org.opencontainers.image.title="vinted-bot" \
+      org.opencontainers.image.description="Watch Vinted searches and get a message when a new listing matches." \
+      org.opencontainers.image.source="https://github.com/jasp-nerd/vinted-bot" \
+      org.opencontainers.image.url="https://github.com/jasp-nerd/vinted-bot" \
+      org.opencontainers.image.documentation="https://github.com/jasp-nerd/vinted-bot/blob/main/docs/self-hosting.md" \
+      org.opencontainers.image.licenses="MIT"
+
+# curl is here for the health check and for the connection test in the troubleshooting
+# guide, which is the first thing anyone reaches for when listings stop arriving.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system --gid 10001 vinted \
+    && useradd --system --create-home --uid 10001 --gid 10001 vinted
+
+WORKDIR /app
+COPY --from=build --chown=vinted:vinted /app/.venv /app/.venv
+COPY --from=build --chown=vinted:vinted /app/src /app/src
+
+# The privilege-dropping wrapper from docker/entrypoint.sh. It sits ahead of the real
+# command on PATH, so the health check and `docker compose exec ... vinted-bot status`
+# also run as the app's user rather than as root.
+COPY --chmod=755 docker/entrypoint.sh /app/bin/vinted-bot
+
+# The web host is 0.0.0.0 *inside the container* so the published port can reach it;
+# docker-compose.yml maps it to the host's localhost only.
+ENV PATH="/app/bin:/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    VINTED_BOT_DB_PATH=/data/app.db \
+    VINTED_BOT_LOG_FORMAT=json \
+    VINTED_BOT_WEB_HOST=0.0.0.0
+
+RUN mkdir -p /data && chown vinted:vinted /data
+VOLUME ["/data"]
+
+# No USER line on purpose: the container starts as root only long enough for the wrapper
+# to hand /data to PUID:PGID (default 10001, the `vinted` user), then the app runs as that
+# user. Anyone who wants no root at all can set `user: "10001:10001"` instead.
+
+EXPOSE 8000
+
+# Checks that the app came round the loop recently, not merely that a process exists —
+# a poller can be alive and stuck, which is the failure worth catching.
+HEALTHCHECK --interval=60s --timeout=10s --start-period=45s --retries=3 \
+    CMD ["vinted-bot", "heartbeat"]
+
+ENTRYPOINT ["vinted-bot"]
+CMD ["run"]

vinted_bot-2.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vinted-bot contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.