hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
64 commits 3 branches 0 tags 12 MiB
Commit graph

10 commits

Author SHA1 Message Date
glass beadian
3463b0a4f4 edge: strip Accept-Encoding on the oCIS signin restyle location 
oCIS compresses the idp sign-in HTML, and sub_filter cannot rewrite
compressed bodies. Works on the grey/failover path where the edge serves
files; in tunnel mode files bypasses the edge entirely (tunnel ingress
points straight at oCIS), so the permanent brand fix remains the Hub OIDC
issuer (docs/design/2026-10-13-files-oidc-sso.md).
 2026-10-13 17:07:50 +00:00
glass beadian
9d42d61f6b edge: restyle the oCIS idp sign-in wall into the Hub palette 
The sign-in page is served by oCIS's idp service, which the web theme.json
cannot touch. Inject hub-signin.css via sub_filter on /signin/ until oCIS
sits behind the Hub OIDC issuer (see docs/design/2026-10-13-files-oidc-sso.md).
 2026-10-13 16:57:38 +00:00
glass beadian
fe5f2403d6 feat: in-app Chat (Matrix JWT SSO) + Drive (embedded oCIS) 
- api: matrix-sso module (tuwunel jwt -> login/get_token), POST /matrix/session, GET /matrix/identity, drive controller
- web: /chat full-height Element view, /files Library+Drive tabs, embedded-app frame component
- edge: /hub-sso.html handshake route (origin-pinned CSP), X-Frame-Options strip on files
- oCIS: csp.yaml frame-ancestors app.occupymedia.cc
- server config still required: tuwunel [global.jwt], MATRIX_SSO_JWT_SECRET, oCIS restart
 2026-10-13 14:57:07 +00:00
glass beadian
a2aa70c961 edge: social.occupymedia.cc vhost — Mastodon web :3030 + streaming :4040 (CT-host LAN bind, websocket upgrade, 80m uploads) 2026-10-13 14:34:06 +00:00
glass beadian
e3a6e9da97 Share with collective: fix union narrowing in open-room result handling 2026-10-12 22:35:32 +00:00
glass beadian
6ea605c87e Edge: hub-branded oCIS theme + assets for files.occupymedia.cc, both ingress paths; brand assets mount 2026-10-12 18:22:05 +00:00
glass beadian
ac969f05c9 Chat client hosted at chat.occupymedia.cc: Element + API on one host, hub welcome page 2026-10-12 13:16:45 +00:00
glass beadian
39dcf7a8b8 Edge: chat root redirects to branded client, serve matrix well-known; onboarding hero full-bleed on black 2026-10-12 12:55:05 +00:00
glass beadian
7cea73dc0d Edge: tailscale0 relay exemption, CT320 transit hop, files/office/intake host parity 2026-10-11 21:36:20 +00:00
glass beadian
9365b561b2 Add edge stack: second ingress path + dual-path DNS failover 
Cloudflare's tunnel edge-pool assignment can blackhole the site for whole
regions (2026-10-10: tunnel hostnames served from an unreachable anycast
range for hours). This adds an independent path and the automation that
keeps occupymedia.cc reachable when either path is sick:

- nginx edge mirroring the tunnel ingress (app/api/tube/chat/ping), LE
  wildcard via dns-01, twice-daily renewal
- DOCKER-USER firewall: 80/443 restricted to Cloudflare ranges (CF mode)
  or OPEN for grey-cloud mode via firewall.mode
- edge-watcher (60s systemd timer): dynamic public-IP sync, dual-path
  health checks, DNS failover TUNNEL<->ORIGIN/GREY with hysteresis,
  gated by EDGE_ENABLED
- ping.occupymedia.cc sacrificial probe host for activation
- deployment runbook in README.md; credential files shipped as .example
 2026-10-10 21:22:15 +00:00