wtclaude
adff20be7b
Core's half of the slice that closes phase 3. Two things: the request-time
fragment merge core has owed since phase 1, and the last of core's UO copy.
**The merge (MODULE_API.md §6.1a).** `swagger-output.json` is core's own routes
and cannot be anything else — it is generated on a developer's machine and
committed, so it must come out the same regardless of what they had checked out,
and a module arrives on a volume long after the image was built. Module routes
therefore reach the document at request time, from the `swagger-fragment.json`
each module ships: `swagger/docsSpec.js` merges the fragments of STARTED modules
over the committed spec, cached on a new loader state version and rebuilt when a
module's state moves.
Until now neither half existed. `swagger/mergeSpec.js` named the request-time
caller in its header and that caller was never written, so the 72 routes
module-uo serves were in no OpenAPI spec at all — core's standing rule ("never
ship a route that isn't in the spec") broken by the extraction rather than by a
route.
Core wins every key collision, `swagger-output.json` is never mutated (it is a
require()d JSON module — one in-place merge would be permanent AND cumulative),
and a fragment that is missing or unreadable costs that module its paths and
nothing else. The Swagger UI is now built per request for the same reason the
JSON is: bound once at require time it would show core's routes for the life of
the process while /api/docs.json showed the merged set.
**The last of core's UO copy** (slice 4 deferred it; §5.2's check reads code, not
prose, so none of this was caught):
- 31 UO schemas and 4 UO tags in `swagger/swagger.js`, describing routes core has
not served since slice 1 — 578 lines. They moved to module-uo, namespaced
`Uo…`, and arrive back through the merge on an instance that installs it.
- `info.description` said "a private Ultima Online shard".
- README.md's 48 UO mentions, including the architecture diagram and the whole
`## Shard integration (uo-link)` section, now `## Modules`.
- `TOWNCRIER_DURATION_SEC` and `UOLINK_*` in the two `.env.example`s: read by the
module, not by core, and documented in the module's README instead.
**Two dropped annotations, and the reason nobody knew.** swagger-autogen reports
an annotation it cannot parse and then prints Success in green, having skipped
it. `npm run swagger` now captures its diagnostics and fails — which immediately
found `POST /api/v1/admin/invites` and `POST /api/v1/auth/invite/:token/accept`
documented with an EMPTY request body, both since the day they were written.
Fixing the tag list also cleared five tags used by routes but never declared
(`Admin · Email`, `Admin · Invites`, `Admin · Moderation`, `Admin · Pages`,
`Auth · Me`) — the same defect class, in the other direction.
- 646 server tests (+9), 157 client tests unchanged
- routes.manifest.json unchanged (158 public + 2 internal); check:modules clean
- swagger-output.json: 128 paths, 69 schemas, 0 orphan tags, 0 orphan schemas
- verified against a real boot with module-uo installed: 197 merged paths
(128 core + 69 module), all four module tags, 31 Uo schemas, no dangling $refs,
/api/docs renders the module's operations with zero console errors
Refs: docs/website/MODULE_API.md §2.8, §6.1a; MODULE_SYSTEM.md §2.7.1
Co-Authored-By: Claude <noreply@anthropic.com>
144 lines
7.5 KiB
Plaintext
144 lines
7.5 KiB
Plaintext
# ─── Runic Gateway — root environment (used by docker-compose) ───
|
|
# Copy to .env and fill in. NEVER commit the real .env.
|
|
# To run this as an existing branded instance (e.g. UOMysticmoon), see
|
|
# .env.uomysticmoon.example for the exact BRAND_*/DB pinning to copy in.
|
|
|
|
# Container image tag pulled by docker-compose (app + bot). Published by the
|
|
# Gitea Actions workflow on every merge to main as `latest` and `sha-<7>`.
|
|
# Leave as `latest` for routine deploys; pin to a specific build for a
|
|
# reproducible deploy or rollback, e.g. IMAGE_TAG=sha-042a151.
|
|
# Deploy: `docker compose pull && docker compose up -d`.
|
|
IMAGE_TAG=latest
|
|
|
|
# App
|
|
NODE_ENV=production
|
|
PORT=3000
|
|
# Separate, UNPUBLISHED port for server<->bot internal traffic (the decrypted
|
|
# bot-token route). Must match the port in the bot's SITE_INTERNAL_URL
|
|
# (docker-compose.yml) and must NEVER be published/proxied. See issue #33.
|
|
INTERNAL_PORT=3001
|
|
UPLOAD_DIR=/app/uploads
|
|
# Logging — written to BOTH the console and a log file.
|
|
LOG_LEVEL=info # console verbosity: error | warn | info | debug
|
|
FILE_LOG_LEVEL=debug # file verbosity (keep a full record on disk)
|
|
LOG_TO_FILE=true # set false for console-only
|
|
LOG_DIR=/app/logs # log directory inside the container (bind-mounted to ./logs)
|
|
LOG_FILE=app.log
|
|
|
|
# ─── Branding (BRAND_*) ───────────────────────────────────────────────────
|
|
# Instance identity. Defaults render as "Runic Gateway"; set these to rebrand
|
|
# without a rebuild. Text + colors reach the SPA through the settings API at
|
|
# runtime; the server templates index.html <title>/meta/OG/favicon at boot. The
|
|
# admin-editable "site title" and "contact email" settings, if set, override
|
|
# BRAND_NAME / BRAND_CONTACT_EMAIL.
|
|
BRAND_NAME=Runic Gateway
|
|
BRAND_SHORT_NAME=Runic Gateway
|
|
BRAND_TAGLINE=an independent game community
|
|
BRAND_DESCRIPTION=Runic Gateway — an independent game community. News, screenshots, guides, and community notes.
|
|
BRAND_CONTACT_EMAIL=
|
|
BRAND_URL=
|
|
# Accent color — drives the web theme's --accent and the Discord embed color.
|
|
BRAND_ACCENT_COLOR=#7f99bd
|
|
# Image assets: paths under the /brand mount (see docker-compose.yml) or absolute
|
|
# URLs. Blank = built-in defaults (hero falls back to a neutral built-in image).
|
|
BRAND_LOGO=
|
|
BRAND_HERO=
|
|
BRAND_FAVICON=
|
|
|
|
# Database (the values here are shared by the `db`, `app`, and `bot` containers —
|
|
# the bot only ever touches its own tables: guild_config, mod_actions, warnings)
|
|
DB_HOST=db
|
|
DB_PORT=3306
|
|
DB_NAME=runic_gateway
|
|
DB_USER=runic
|
|
DB_PASSWORD=change-me-db-password
|
|
DB_ROOT_PASSWORD=change-me-root-password
|
|
|
|
# Auth
|
|
JWT_SECRET=change-me-to-a-long-random-string
|
|
JWT_EXPIRES_IN=1d
|
|
# auto = Secure cookie only when the request arrives over HTTPS (Pangolin).
|
|
# Leave as auto so login works both via the LAN IP (HTTP) and the proxy (HTTPS).
|
|
COOKIE_SECURE=auto
|
|
# Changing this on a live instance invalidates existing sessions (users re-login).
|
|
COOKIE_NAME=rg_token
|
|
|
|
# Reverse-proxy trust (req.ip / req.secure for rate limiting, backoff, bot-ban).
|
|
# Path: client -> Pangolin -> newt agent "ptero" (separate VM) -> app. Pin this
|
|
# to ptero's LAN IP (e.g. 10.0.0.42) so XFF is only trusted from ptero. Requires
|
|
# a static DHCP reservation for ptero in Omada, else a lease change breaks it.
|
|
# Integer hop count or "false" also accepted; a blanket "true" is rejected
|
|
# (coerced to 1) to prevent X-Forwarded-For spoofing.
|
|
TRUST_PROXY=1
|
|
# Set to 1 to log raw peer address + X-Forwarded-For + resolved req.ip per
|
|
# request (to verify/refresh ptero's IP without redeploying). Noisy; keep off.
|
|
DEBUG_TRUST_PROXY=0
|
|
|
|
# Optional TOTP two-factor (opt-in per user). Defaults to BRAND_NAME when unset.
|
|
# TOTP_ISSUER=Runic Gateway
|
|
TOTP_CHALLENGE_TTL=5m
|
|
|
|
# First admin bootstrap — created only if no users exist yet.
|
|
# Set, run once, then you can blank these out.
|
|
ADMIN_USERNAME=
|
|
ADMIN_PASSWORD=
|
|
|
|
# Email is configured in Admin → Settings → Email (Gmail over OAuth2), not via
|
|
# env. It reuses the Google auth provider's OAuth client and stores an encrypted
|
|
# refresh token in the DB. Until it's connected, the contact form falls back to
|
|
# a mailto: link (recipient = the `contact_email` site setting).
|
|
|
|
# CORS — only needed for local dev when the Vite dev server is a different origin.
|
|
CLIENT_ORIGIN=http://localhost:5173
|
|
|
|
# Discord bot — internal API (server <-> bot/, see docker-compose.yml's `bot`
|
|
# service). BOT_INTERNAL_KEY MUST be byte-for-byte identical to the same
|
|
# variable in bot/.env.example — it is the only auth on both sides' /internal/*
|
|
# routes, so a mismatch silently breaks every server<->bot call with 401s.
|
|
# It also guards the server's /internal/bot-config route, which returns the
|
|
# DECRYPTED Discord token; with NODE_ENV=production the app REFUSES TO START if
|
|
# this is left blank, at this placeholder, or shorter than 16 chars. Generate a
|
|
# long random string. The Discord bot TOKEN itself is not an env var — it's
|
|
# entered in the admin panel (Discord Bot page) and stored encrypted in the DB.
|
|
#
|
|
# Defense in depth: even with a strong key, configure Pangolin/your reverse
|
|
# proxy to DENY /api/v1/internal (and never forward INTERNAL_PORT). The route no
|
|
# longer rides the public listener, but an explicit deny rule is belt-and-braces.
|
|
BOT_INTERNAL_URL=http://bot:4100
|
|
BOT_INTERNAL_KEY=change-me-to-a-long-random-string
|
|
|
|
# ─── Installed modules ───
|
|
# A module is a directory on the modules volume (see MODULES_DIR in
|
|
# server/.env.example); everything about a specific game lives in one, and core
|
|
# knows nothing about any of them. A module may read its own env vars, and they
|
|
# belong here because Compose passes this file to the container.
|
|
#
|
|
# RunicGateway/Module-uo, for example, reads UOLINK_BASE_URL / UOLINK_WS_URL /
|
|
# UOLINK_PROTOCOL as the defaults for its connection to a uo-link sidecar, and
|
|
# TOWNCRIER_DURATION_SEC for its news leg. Its README documents them; they are
|
|
# left out here rather than half-copied, because a copy of another repo's
|
|
# settings is a copy that goes stale silently. With no module installed, none of
|
|
# this applies and the site runs as core.
|
|
|
|
# ─── Push notifications (M7) — self-hosted ntfy UnifiedPush relay ───
|
|
# The `ntfy` compose service and the backend's push fan-out (opt-in notifications
|
|
# for the Android app; docs/android/PLAN.md §11).
|
|
# NTFY_BASE_URL Public URL devices reach the relay at (behind the
|
|
# reverse proxy). Used BOTH to configure the ntfy service
|
|
# AND as the backend's SSRF allow-set — a device may only
|
|
# register an endpoint whose origin matches this.
|
|
# NTFY_ALLOWED_ORIGINS Optional, comma-separated extra allowed endpoint origins
|
|
# (defaults to NTFY_BASE_URL's origin). Set only if devices
|
|
# register endpoints on a different host than NTFY_BASE_URL.
|
|
# NTFY_PUBLISH_TOKEN Optional. The content-free-tickle design needs NO token;
|
|
# set one only to require auth on backend→ntfy publishes.
|
|
# NTFY_HOST_PORT Host port the ntfy container publishes :80 on (default
|
|
# 2586). The public reverse proxy forwards the notification
|
|
# subdomain to host:NTFY_HOST_PORT — required because the
|
|
# proxy lives outside the compose network and cannot reach
|
|
# ntfy any other way. Change only on a host-port conflict.
|
|
NTFY_BASE_URL=https://ntfy.example.com
|
|
# NTFY_ALLOWED_ORIGINS=https://ntfy.example.com
|
|
# NTFY_PUBLISH_TOKEN=
|
|
# NTFY_HOST_PORT=2586
|