3 Commits

Author	SHA1	Message	Date
rob thijssen	81fe5f7d4d	fix: move newsfeed-api off 8081 to 22672 (conflict-unlikely port) ... 8081 is the alt-HTTP port — one of the crowded defaults every proxy/dev server grabs — so it's collision-prone on a shared host. Move to 22672, a registered- range port in the sparse 20000s band, derived deterministically from the service name and recorded in architecture port-allocations.md. Updated everywhere the number appears: api bind config + default, firewalld service XML, nginx upstream, vite dev proxy, deploy workflow API_PORT, infra-setup (SELinux semanage label), and docs. Operator note: re-run script/infra-setup.sh on slartibartfast to relabel the SELinux port (22672) and ship the updated firewalld XML before the next deploy restarts the api on the new port. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP	2026-07-08 12:25:26 +03:00
rob thijssen	19dfe793e0	feat(infra): provision the public rob.fyi vhost + LE cert in infra-setup ... infra-setup only handled the internal (newsfeed.internal) cert and vhost and just printed a generic "set it up yourself" note for the WAN name. Now it also, on the web host: - issues the Let's Encrypt cert for rob.fyi idempotently (certbot, Cloudflare DNS-01, ECDSA, --keep-until-expiring), skipping cleanly if the CF token or certbot is absent; - installs the certbot renew deploy-hook (reload nginx); - installs the public vhost, gated on the cert existing so a missing cert can't break `nginx -t` for all of nginx (external-tls.md §4). PUBLIC_FQDN/CERT_EMAIL/CF_CREDS are infra-truth vars at the top; set PUBLIC_FQDN empty to skip. Cloudflare A record + OPNsense :443 forward remain manual and are called out in the closing output. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP	2026-07-08 12:19:31 +03:00
rob thijssen	5ce52fff4d	feat: scaffold newsfeed — user-controlled news feed ... A self-hosted feed where the user owns the ranking: per-source and signed per-interest weights, decayed by recency, via a transparent deterministic scorer. Content is sourced algorithmically (worker RSS/Atom polling) and agentically (per-user API tokens POSTing candidates to the ingest endpoint). Single-user today, multi-user by construction (every row keyed on user_id). Rust cargo workspace + Vite/React/SWC/TS SPA: - newsfeed-entities: DTOs (ts-rs bindings -> web/src/api/bindings) - newsfeed-core: ranking, auth primitives, ingest, data-access ports - newsfeed-data: SQLite adapters (sqlx, runtime queries) - newsfeed-api: axum REST/JSON daemon - newsfeed-worker: RSS polling + rescoring loop - web: responsive, mobile-first SPA (React Query, generated types) Deploy (Gitea Actions, build static musl + SPA, rsync as gitea_ci): api+worker -> slartibartfast, SPA -> oolon (nginx serves + proxies /v1). Deliberate deviations from house conventions (documented in CLAUDE.md/readme): - SQLite instead of Postgres; api+worker co-locate sharing one DB file. - Runtime sqlx queries instead of query! macros (SQLite dynamic typing; keeps CI database-free). Verified end-to-end: auth, token ingest, interest-weighted ranking, signals, pagination (curl + browser); cargo fmt/clippy -D/test and pnpm build/lint pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP	2026-07-08 11:55:49 +03:00