From c9cbc3c7d27524d61ff593b94aeb5917a8c0b9d7 Mon Sep 17 00:00:00 2001
From: Connor Johnstone <c@rcjohnstone.com>
Date: Tue, 8 Sep 2026 16:48:16 -0400
Subject: [PATCH] Swap news-backend to the Python service

Applied to ~/compose.yml (snapshot: ~/compose.yml.pre-news-v2). The image is
tagged localhost/news-py:latest rather than reusing the registry tag, so the
Rust image stays on disk as the rollback path, and the old database at
./data/news/db is untouched -- rollback is a two-line edit.

Verified from the public internet, not the LAN:
  GET /                              -> 403, Authelia gating browser paths
  POST /api/feedback/../bogus        -> {"error":"bad signature"} from the APP,
                                        proving the carve-out bypasses Authelia
  POST /api/feedback/../<valid HMAC> -> {"ok":true}, and the row persists

That last line is the loop that never fired once in v0.2, and it is now proven
working from off-LAN with a signature check in front of it.
---
 deploy/README.md | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/deploy/README.md b/deploy/README.md
index e2ae741..388f973 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -3,9 +3,10 @@
 This replaces the `news-backend` service (from `../news_triage`) in place: same
 host, same vhost, same ntfy topic.
 
-## 1. Compose
+## 1. Compose — APPLIED 2026-09-08
 
-Replace the `news-backend` block in `~/compose.yml`:
+The `news-backend` block in `~/compose.yml` now reads (snapshot of the previous
+file: `~/compose.yml.pre-news-v2`):
 
 ```yaml
   news-backend:
@@ -47,7 +48,16 @@ Replace the `news-backend` block in `~/compose.yml`:
       start_period: 20s
 ```
 
-Copy `profile/*.toml` to `~/config/news2/`. A bind-mounted config edit needs
+The image is tagged `localhost/news-py:latest` rather than reusing
+`git.rcjohnstone.com/connor/news:latest`, so the Rust image stays on disk as the
+rollback path; the old database at `./data/news/db` is likewise untouched.
+Rolling back is a two-line edit plus `podman-compose up -d news-backend`.
+
+Config lives in `~/config/news2/` (copied from `profile/*.toml`).
+
+The `caddy` service still bind-mounts `./data/news/web:/srv/news:ro`, which is
+now unused since the Caddyfile no longer serves a static SPA. Harmless; remove
+it whenever the compose file is next touched. A bind-mounted config edit needs
 `sudo podman restart news-backend`; `podman-compose up -d` will not restart a
 container when only a mounted file changed. An **environment** change does need
 the full `up -d`.
@@ -106,11 +116,13 @@ that populated it should be disabled:
 sudo systemctl disable --now news-update.timer
 ```
 
-**Current state:** the vhost is public and correctly gated, but `news-backend`
-is still the old Rust service, which no longer has its SPA served by Caddy. So
-`https://news.rcjohnstone.com/` is a 404 behind the login until the compose
-service is switched to this image. Notifications from the old service are
-unaffected.
+**Verified after the swap**, from the public internet rather than the LAN:
+
+| request | result | meaning |
+|---|---|---|
+| `GET /` | 403 (Authelia) | browser paths are gated |
+| `POST /api/feedback/.../bogus` | `{"error":"bad signature"}` | reaches the app, unauthenticated, and rejects a forgery |
+| `POST /api/feedback/.../<valid HMAC>` | `{"ok":true}` and a row in `feedback` | **the loop that never once worked in v0.2** |
 
 ## 3. Scheduling