rob thijssen
93641f27c4
oolon is a shared edge proxy. blackbeard.observer and others already grant gitea_ci `/usr/bin/rsync` into their own webroots, so checking for the bare command path passed on somebody else's grant — and the deploy would then fail at the rsync, halfway, having already been told everything was fine. The grants are destination-qualified in script/infra-setup.sh for exactly this reason; the check now matches them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
qapi console
A fork of the papi console, pointed at the Quantus chains and patched to accept their post-quantum signature type.
Deployed at https://qapi.blackbeard.observer.
Why this fork exists
The console is built on polkadot-api,
which shares no code with the polkadot-js stack the Quantus browser extension forks
(quantus/extension, quantus/common, quantus/ui, quantus/wasm). That makes it an
independent implementation of the same wire format — and the only way to find out
whether our stack is right about Quantus or merely self-consistent.
It already is: for the same call, nonce and signature, createV4Tx here produces bytes
identical to quantus/extension's tier-1 harness.
The one patch
getSignerType in @polkadot-api/signers-common reads the extrinsic's Address and
Signature types out of the metadata — the right thing, and better than polkadot-js,
which hardcodes ExtrinsicSignature: 'MultiSignature' in a type definition file. It then
threw that answer away and required the enum to carry Ecdsa, Ed25519 and Sr25519.
Quantus's DilithiumSignatureScheme carries Dilithium87 and Dilithium65, so every
signing attempt raised Unkown signer before reaching code that would have worked —
createV4Tx is entirely length-agnostic, and a 7 219-byte ML-DSA-87 signature drops
straight in.
patches/@polkadot-api__signers-common.patch drops the names and keeps the structural
check. See quantus/papi-console#1.
Develop
pnpm install
pnpm dev
Deploy
Pushes to main deploy to oolon via .gitea/workflows/deploy.yaml. One-time host
provisioning — DNS, certificate, nginx vhost, webroot — is
script/infra-setup.sh, run by an operator:
./script/infra-setup.sh --pubkey ~/.ssh/id_gitea_ci.pub
Conventions: architecture/ —
deployment-gitea-actions.md, reverse-proxies.md, external-tls.md, public-dns.md.
Upstream's own README, and the licence, are unchanged: this is a fork, not a rewrite.