feat: scaffold newsfeed — user-controlled news feed

A self-hosted feed where the user owns the ranking: per-source and signed per-interest weights, decayed by recency, via a transparent deterministic scorer. Content is sourced algorithmically (worker RSS/Atom polling) and agentically (per-user API tokens POSTing candidates to the ingest endpoint). Single-user today, multi-user by construction (every row keyed on user_id). Rust cargo workspace + Vite/React/SWC/TS SPA: - newsfeed-entities: DTOs (ts-rs bindings -> web/src/api/bindings) - newsfeed-core: ranking, auth primitives, ingest, data-access ports - newsfeed-data: SQLite adapters (sqlx, runtime queries) - newsfeed-api: axum REST/JSON daemon - newsfeed-worker: RSS polling + rescoring loop - web: responsive, mobile-first SPA (React Query, generated types) Deploy (Gitea Actions, build static musl + SPA, rsync as gitea_ci): api+worker -> slartibartfast, SPA -> oolon (nginx serves + proxies /v1). Deliberate deviations from house conventions (documented in CLAUDE.md/readme): - SQLite instead of Postgres; api+worker co-locate sharing one DB file. - Runtime sqlx queries instead of query! macros (SQLite dynamic typing; keeps CI database-free). Verified end-to-end: auth, token ingest, interest-weighted ranking, signals, pagination (curl + browser); cargo fmt/clippy -D/test and pnpm build/lint pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP
2026-07-08 11:36:57 +03:00
commit 5ce52fff4d
104 changed files with 10963 additions and 0 deletions
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,159 @@
+# CI-driven deploy for newsfeed (architecture deployment-gitea-actions.md).
+#
+# The workflow is the source of infra truth — hosts/ports/paths live here, not in a
+# manifest. Build-and-rsync model: build static musl binaries + the SPA bundle, then
+# rsync straight to the targets as the scoped `gitea_ci` user.
+#
+#   api + worker  -> slartibartfast.kosherinata.internal  (share one SQLite file)
+#   web (SPA)     -> oolon.kosherinata.internal           (nginx serves + proxies /v1)
+#
+# One-time host prep (gitea_ci user, sudoers, service account, dirs, cert, vhost) is done
+# by script/infra-setup.sh. Only secret required here: RSYNC_SSH_KEY (the runner's private
+# key). newsfeed has no app secrets — SQLite has no password and tokens are hashed at rest.
+
+name: deploy
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy
+  cancel-in-progress: false
+
+env:
+  API_HOST: slartibartfast.kosherinata.internal
+  WEB_HOST: oolon.kosherinata.internal
+  API_PORT: "8081"
+  TARGET: x86_64-unknown-linux-musl
+  SSH_OPTS: -o StrictHostKeyChecking=accept-new
+
+jobs:
+  build:
+    # Toolchain runner: rustup with the musl target + musl-gcc, node+pnpm baked into the
+    # image (deployment-gitea-actions.md §5). Adjust the label to a registered runner.
+    runs-on: fedora-43
+    steps:
+      - uses: actions/checkout@v4
+
+      # --- lint/test gate: a broken commit never deploys ---
+      - name: fmt
+        run: cargo fmt --all --check
+      - name: clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: test
+        run: cargo test --workspace
+
+      # --- build static binaries ---
+      - name: build binaries
+        run: |
+          rustup target add "$TARGET"
+          cargo build --release --target "$TARGET" -p newsfeed-api -p newsfeed-worker
+          mkdir -p dist/bin
+          cp "target/$TARGET/release/newsfeed-api" dist/bin/
+          cp "target/$TARGET/release/newsfeed-worker" dist/bin/
+
+      # --- build SPA bundle ---
+      - name: build web
+        working-directory: web
+        run: |
+          corepack enable
+          pnpm install --frozen-lockfile
+          pnpm build
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: binaries
+          path: dist/bin/
+      - uses: actions/upload-artifact@v3
+        with:
+          name: web
+          path: web/dist/
+
+  deploy-api:
+    needs: build
+    runs-on: fedora-43
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v3
+        with:
+          name: binaries
+          path: bin
+      - name: write ssh key
+        run: |
+          install -d -m 0700 ~/.ssh
+          echo "${{ secrets.RSYNC_SSH_KEY }}" > ~/.ssh/id_deploy
+          chmod 0600 ~/.ssh/id_deploy
+      - name: reachability check
+        run: ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$API_HOST" hostname -f
+
+      - name: rsync binaries
+        run: |
+          chmod +x bin/*
+          for b in newsfeed-api newsfeed-worker; do
+            rsync -az -e "ssh $SSH_OPTS -i ~/.ssh/id_deploy" \
+              --rsync-path='sudo rsync' --chown=root:root --chmod=0755 --mkpath \
+              "bin/$b" gitea_ci@"$API_HOST":/usr/local/bin/"$b"
+          done
+
+      - name: rsync config
+        run: |
+          rsync -az -e "ssh $SSH_OPTS -i ~/.ssh/id_deploy" \
+            --rsync-path='sudo rsync' --chown=root:newsfeed --chmod=0640 --mkpath \
+            asset/config/config.toml.tmpl gitea_ci@"$API_HOST":/etc/newsfeed/config.toml
+          rsync -az -e "ssh $SSH_OPTS -i ~/.ssh/id_deploy" \
+            --rsync-path='sudo rsync' --chown=root:newsfeed --chmod=0640 --mkpath \
+            asset/config/worker.toml.tmpl gitea_ci@"$API_HOST":/etc/newsfeed/worker.toml
+
+      - name: apply system state
+        run: |
+          ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$API_HOST" '
+            sudo restorecon -R /usr/local/bin/newsfeed-api /usr/local/bin/newsfeed-worker /etc/newsfeed /var/lib/newsfeed
+            sudo systemctl daemon-reload
+            sudo systemctl restart newsfeed-api.service
+            sudo systemctl restart newsfeed-worker.service
+          '
+
+      - name: health probe
+        run: |
+          for i in $(seq 1 10); do
+            code=$(curl -fsS -o /dev/null -w '%{http_code}' "http://$API_HOST:$API_PORT/health") && [ "$code" = 200 ] && exit 0
+            sleep 2
+          done
+          echo "api did not become healthy" >&2; exit 1
+
+      - name: capture journal
+        if: always()
+        run: |
+          ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$API_HOST" \
+            'journalctl -u newsfeed-api.service -u newsfeed-worker.service -n 80 --no-pager' || true
+
+  deploy-web:
+    needs: build
+    runs-on: fedora-43
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: web
+          path: dist
+      - name: write ssh key
+        run: |
+          install -d -m 0700 ~/.ssh
+          echo "${{ secrets.RSYNC_SSH_KEY }}" > ~/.ssh/id_deploy
+          chmod 0600 ~/.ssh/id_deploy
+      - name: reachability check
+        run: ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$WEB_HOST" hostname -f
+
+      - name: rsync SPA
+        run: |
+          rsync -az --delete -e "ssh $SSH_OPTS -i ~/.ssh/id_deploy" \
+            --rsync-path='sudo rsync' --chown=nginx:nginx --mkpath \
+            dist/ gitea_ci@"$WEB_HOST":/var/www/newsfeed/
+
+      - name: relabel + reload nginx
+        run: |
+          ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$WEB_HOST" '
+            sudo restorecon -R /var/www/newsfeed
+            sudo nginx -t
+            sudo systemctl reload nginx.service
+          '