connor/news
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Swap news-backend to the Python service

Browse Source 
Applied to ~/compose.yml (snapshot: ~/compose.yml.pre-news-v2). The image is
tagged localhost/news-py:latest rather than reusing the registry tag, so the
Rust image stays on disk as the rollback path, and the old database at
./data/news/db is untouched -- rollback is a two-line edit.

Verified from the public internet, not the LAN:
  GET /                              -> 403, Authelia gating browser paths
  POST /api/feedback/../bogus        -> {"error":"bad signature"} from the APP,
                                        proving the carve-out bypasses Authelia
  POST /api/feedback/../<valid HMAC> -> {"ok":true}, and the row persists

That last line is the loop that never fired once in v0.2, and it is now proven
working from off-LAN with a signature check in front of it.
This commit is contained in:
connor committed 2026-09-08 16:48:16 -04:00
1 parent 4d58e5ca38
commit c9cbc3c7d2
1 file changed
+20 -8
Download Patch File Download Diff File Expand all files Collapse all files
deploy/README.md
+20 -8
View File
@@ -3,9 +3,10 @@
This replaces the `news-backend` service (from `../news_triage`) in place: same
host, same vhost, same ntfy topic.
## 1. Compose
## 1. Compose — APPLIED 2026-09-08
Replace the `news-backend` block in `~/compose.yml`:
The `news-backend` block in `~/compose.yml` now reads (snapshot of the previous
file: `~/compose.yml.pre-news-v2`):
```yaml
news-backend:
@@ -47,7 +48,16 @@ Replace the `news-backend` block in `~/compose.yml`:
start_period: 20s
```
Copy `profile/*.toml` to `~/config/news2/`. A bind-mounted config edit needs
The image is tagged `localhost/news-py:latest` rather than reusing
`git.rcjohnstone.com/connor/news:latest`, so the Rust image stays on disk as the
rollback path; the old database at `./data/news/db` is likewise untouched.
Rolling back is a two-line edit plus `podman-compose up -d news-backend`.
Config lives in `~/config/news2/` (copied from `profile/*.toml`).
The `caddy` service still bind-mounts `./data/news/web:/srv/news:ro`, which is
now unused since the Caddyfile no longer serves a static SPA. Harmless; remove
it whenever the compose file is next touched. A bind-mounted config edit needs
`sudo podman restart news-backend`; `podman-compose up -d` will not restart a
container when only a mounted file changed. An **environment** change does need
the full `up -d`.
@@ -106,11 +116,13 @@ that populated it should be disabled:
sudo systemctl disable --now news-update.timer
```
**Current state:** the vhost is public and correctly gated, but `news-backend`
is still the old Rust service, which no longer has its SPA served by Caddy. So
`https://news.rcjohnstone.com/` is a 404 behind the login until the compose
service is switched to this image. Notifications from the old service are
unaffected.
**Verified after the swap**, from the public internet rather than the LAN:
| request | result | meaning |
|---|---|---|
| `GET /` | 403 (Authelia) | browser paths are gated |
| `POST /api/feedback/.../bogus` | `{"error":"bad signature"}` | reaches the app, unauthenticated, and rejects a forgery |
| `POST /api/feedback/.../<valid HMAC>` | `{"ok":true}` and a row in `feedback` | **the loop that never once worked in v0.2** |
## 3. Scheduling