docs(quick-260729-gjd): demo IndeeHub iframe + signer + preinstall — summary + state
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago
parent
d00ca6242c
commit
d8903ad5f3
@ -84,6 +84,7 @@ None yet.
|
||||
| # | Description | Date | Commit | Directory |
|
||||
|---|-------------|------|--------|-----------|
|
||||
| 260729-fw7 | improve mesh message hop graphic/animation: balanced desktop sizing, vertical mobile layout, archipelago branding | 2026-07-29 | ac09fc5d | [260729-fw7-improve-mesh-message-hop-graphic-animati](./quick/260729-fw7-improve-mesh-message-hop-graphic-animati/) |
|
||||
| 260729-gjd | demo: indee.tx1138.com in app iframe (:2101 whole-origin proxy), auto nostr signer sign-in, IndeeHub pre-installed on fresh session | 2026-07-29 | d00ca624 | [260729-gjd-demo-make-indee-tx1138-com-work-in-the-a](./quick/260729-gjd-demo-make-indee-tx1138-com-work-in-the-a/) |
|
||||
|
||||
## Deferred Items
|
||||
|
||||
|
||||
@ -0,0 +1,107 @@
|
||||
---
|
||||
phase: quick-260729-gjd
|
||||
plan: 01
|
||||
subsystem: public-demo
|
||||
tags: [demo, indeedhub, nginx, reverse-proxy, nostr, mock-backend]
|
||||
requires: []
|
||||
provides:
|
||||
- "IndeeHub whole-origin demo proxy on :2101 (framing headers stripped, sign-in seeded)"
|
||||
- "Demo iframe launch of indeedhub via demoAppUrl → <host>:2101/"
|
||||
- "IndeeHub pre-installed/running on every fresh demo session"
|
||||
affects: [demo-deploy, neode-ui demo image]
|
||||
tech-stack:
|
||||
added: []
|
||||
patterns:
|
||||
- "Whole-origin per-port reverse proxy for frame-busting external SPAs (vs broken path-prefix sub_filter)"
|
||||
- "localStorage seeding via injected classic script on the proxied origin (applesauce-accounts nsec account)"
|
||||
key-files:
|
||||
created:
|
||||
- neode-ui/docker/indee-demo-signin.js
|
||||
modified:
|
||||
- neode-ui/docker/nginx-demo.conf
|
||||
- neode-ui/Dockerfile.web
|
||||
- docker-compose.demo.yml
|
||||
- demo-deploy/docker-compose.yml
|
||||
- neode-ui/src/composables/useDemoIntro.ts
|
||||
- neode-ui/src/views/appSession/useAppIdentity.ts
|
||||
- neode-ui/mock-backend.js
|
||||
decisions:
|
||||
- "Primary sign-in path used (seeded nsec account, self-signing) — NIP-07 bridge fallback NOT needed; verified against the live bundle"
|
||||
- "Dropped `sub_filter_types text/html` (text/html is nginx's default sub_filter type; explicit listing produced a duplicate-MIME warning)"
|
||||
metrics:
|
||||
duration: "~50 min"
|
||||
completed: 2026-07-29
|
||||
status: complete
|
||||
---
|
||||
|
||||
# Quick Task 260729-gjd: IndeeHub in the Demo Summary
|
||||
|
||||
**One-liner:** Whole-origin nginx proxy of indee.tx1138.com on :2101 with an injected throwaway-nsec sign-in seeder, demo iframe launch via same-host :2101, and IndeeHub pre-installed in every fresh mock-backend session.
|
||||
|
||||
## Commits
|
||||
|
||||
| Task | Commit | Scope |
|
||||
|------|--------|-------|
|
||||
| 1 | 69bc3d3f | nginx :2101 whole-origin proxy + indee-demo-signin.js seeder + Dockerfile.web COPY/EXPOSE + both compose files publish 2101 |
|
||||
| 2 | 66d540f8 | useDemoIntro: DEMO_EXTERNAL_URLS → DEMO_PROXY_PORTS, demoAppUrl builds `<protocol>//<hostname>:2101/`; useAppIdentity: picker suppressed under IS_DEMO |
|
||||
| 3 | d00ca624 | mock-backend.js staticDevApps gains indeedhub (running, lanPort 8190) → installed on every fresh session |
|
||||
|
||||
## What was verified at exec time (live-bundle facts)
|
||||
|
||||
- Live site still serves `X-Frame-Options: SAMEORIGIN`, no CSP; bundle `assets/index-BMWtjRCn.js`.
|
||||
- Account serialization confirmed by de-minifying the live bundle: private-key account class has `static type="nsec"`, `toJSON` → `{ signer: { key: <hex sk> }, id, pubkey, metadata, type }`; the manager registers the nsec type (`MM(Fe)` registers `mr`) and restores from `indeedhub-accounts` + activates by id from `indeedhub-active-account`. `Vn`/`je` confirmed hex decode/encode.
|
||||
- Pubkey math independently validated against BIP340 test vectors (sk=1 → Gx, sk=3 → F9308A01…) before embedding the generated pair. Mismatch would trigger the bundle's "Account signer mismatch" guard, so this was load-bearing.
|
||||
|
||||
## Throwaway demo identity
|
||||
|
||||
Freshly generated 2026-07-29 for this task (generator ran in scratchpad, not committed):
|
||||
- pk `7261540160244ec65ce0bf86ba03997e9b1b3b35c277e416bf1c7ba4271fee31`
|
||||
- sk embedded in `neode-ui/docker/indee-demo-signin.js`, clearly labelled PUBLIC-DEMO-ONLY / not a secret (threat T-gjd-01: accepted by design). Never a real user key.
|
||||
|
||||
## Local verification results
|
||||
|
||||
1. **nginx parse:** `nginx -t` clean in `nginx:alpine` (podman, with `--add-host neode-backend:127.0.0.1` to satisfy the pre-existing upstream reference).
|
||||
2. **Live proxy smoke (podman, config + seeder mounted):** `curl` through :2101 → 200, **no X-Frame-Options / CSP**, injected `<script src="/__demo/indee-demo-signin.js">` present in HTML, seed script served same-origin, hashed asset `/assets/index-BMWtjRCn.js` proxied 200.
|
||||
3. **Unit tests:** 195/195 green (`src/views/appSession` + `src/stores`), running with IS_DEMO=false — non-demo path exercised.
|
||||
4. **Demo build:** `VITE_DEMO=1 npm run build` succeeded; bundle (`web/dist/neode-ui/assets/index-ChDwfLt5.js`) contains the 2101 launch logic. This is exactly what Dockerfile.web builds (ARG VITE_DEMO=1 default).
|
||||
5. **Mock backend:** boots with DEMO=1; `/ws/db` initial dump of a fresh session contains `indeedhub` with `state=running`, ui=true, lan `http://localhost:8190`.
|
||||
6. **No IP leaks:** none of the changed files contain the private release-server IP; pre-existing occurrences in dist (catalog.json/marketplace data) are scrubbed+gated by the existing Dockerfile.web guard.
|
||||
7. **Submodule guard:** ran before all three commits; nothing under `indeedhub/` ever staged. No file deletions in any commit.
|
||||
|
||||
## Deviations from Plan
|
||||
|
||||
**1. [Minor] Dropped `sub_filter_types text/html` from the :2101 block**
|
||||
- **Found during:** Task 1 nginx parse check
|
||||
- **Issue:** nginx warns `duplicate MIME type "text/html"` — text/html is sub_filter's built-in default type
|
||||
- **Fix:** removed the redundant directive (identical behavior), noted in a comment
|
||||
- **Commit:** 69bc3d3f
|
||||
|
||||
**2. [Environment] Plain (non-demo) build + vue-tsc typecheck could not be run — permission denied**
|
||||
- Three attempts (`npm run build`, `vite build --outDir <scratch>`, `vue-tsc --noEmit`) were denied by the permission system mid-execution.
|
||||
- **Proxy coverage:** 195 unit tests ran and passed under IS_DEMO=false (compiles + non-demo runtime behavior), and the demo build compiled the same source. All changed TS is IS_DEMO-gated with types unchanged at call sites.
|
||||
- **Residual risk:** low; a plain `npm run build` before the next real-node frontend ship will confirm (it runs vue-tsc).
|
||||
|
||||
**3. [Flag] `web/dist/neode-ui/` currently holds a VITE_DEMO=1 bundle**
|
||||
- The demo verification build overwrote the (gitignored) `web/dist/neode-ui` output. **Rebuild with a plain `npm run build` before any real-node frontend deploy/ISO/OTA that rsyncs `web/dist`** — do not ship the demo bundle to real nodes.
|
||||
|
||||
## Fallback status
|
||||
|
||||
The plan's fallback (extension-type account + window.nostr postMessage shim + mock signer) was **not needed** — the primary seeded-nsec path matches the live bundle's restore contract exactly. If post-deploy testing shows a login wall anyway, the fallback is fully documented in the PLAN (Task 1 action block).
|
||||
|
||||
## Post-deploy checklist for orchestrator (vps2, after demo image rebuild + redeploy)
|
||||
|
||||
1. `curl -sI http://146.59.87.168:2101/` → 200, NO `X-Frame-Options`; `curl -s http://146.59.87.168:2101/ | grep indee-demo-signin` → hit. **If unreachable: open port 2101 in the vps2 firewall** (new requirement of this change).
|
||||
2. Fresh private window → `http://146.59.87.168:2100` → login `entertoexit` → IndeeHub shows installed/running in My Apps with no install step.
|
||||
3. Launch IndeeHub → renders inside the in-app iframe session (not a new tab), content browsable, **no identity-picker modal**.
|
||||
4. Signed-in check: IndeeHub header shows an active account (avatar/profile, not a sign-in button). Note: the throwaway key has no published kind-0 profile, so expect a default avatar/truncated npub rather than a named profile — that still counts as signed in. If a login wall appears, execute the documented fallback and redeploy.
|
||||
5. Spot-check served responses for the private release-server IP (should be none; build guard enforces).
|
||||
6. Reload the iframe once — sign-in must persist (localStorage already seeded even if a service worker serves cached HTML without the injected tag).
|
||||
7. Reminder: the `demo-deploy` thin stack now publishes `${DEMO_INDEE_PORT:-2101}:2101` — the public archy-demo repo copy of that compose file needs syncing when the images ship.
|
||||
|
||||
## Self-Check: PASSED
|
||||
|
||||
- neode-ui/docker/indee-demo-signin.js — FOUND
|
||||
- neode-ui/docker/nginx-demo.conf :2101 block — FOUND
|
||||
- Commits 69bc3d3f, 66d540f8, d00ca624 — FOUND in git log
|
||||
- No paths under indeedhub/ in any commit — VERIFIED
|
||||
- SUMMARY frontmatter status: complete — SET
|
||||
Loading…
x
Reference in New Issue
Block a user