From 700037c368d16207d977a6b3fc6cdbd9fc4e33e1 Mon Sep 17 00:00:00 2001 From: rays Date: Mon, 12 Oct 2026 17:56:07 +0000 Subject: [PATCH] CLAUDE.md: the home page, where it is and how it is published (#216) Co-Authored-By: Claude Opus 5.5 --- CLAUDE.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 8f17e58..65f6e35 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -20,6 +20,7 @@ service of the `content` project, beside audiobookshelf, immich and Plex (#208). | Old database | `/mnt/user/ipx/state.db`, SQLite, used until the move to Postgres on 2026-09-18 and kept for rollback | `/data/state.db` | | Downloads | `/mnt/user/ipx/downloads` | `/downloads` | | Directory | `ipx-directory` in the same project, `192.168.1.130:8100`, public at `directory.ipxreader.app` through the tunnel with no Access in front: its pages are anyone's to browse, read only (#215), and its API (`/v1`) takes a token for everything. Until 2026-10-12 it was `ipx-dir.sdf1.net` (#214). Config `/mnt/fast/appdata/ipx-directory/directory.toml` (token hashes; Tower's own token in `tower.token` beside it, and entered in ipx's Admin, Directory, which keeps it in the database's `settings`), database `ipx_directory` on the same Postgres, URL in `directory.env` beside the compose file. See [docs/directory.md](docs/directory.md) | `/config/directory.toml` | +| Home page | `ipxreader.app` (and `www`): a static page from `site/`, on the Cloudflare Pages project `ipxreader`, not on Tower. See below | | | Web UI | `ipx-web` (Caddy) in the same project, at `192.168.1.130:8099`, also `ipodderx.sdf1.net` via a Cloudflare tunnel. It serves the page and passes `/api` and `/media` to ipx, whose own port is published nowhere; its address on `ipx_default` is pinned to `192.168.64.10` (#203) | ipx `0.0.0.0:8099`, Caddy `:8080` | | Sign-in via the tunnel | Cloudflare Access app `ipodderx`, with Authentik as its identity provider; see [docs/sso.md](docs/sso.md) | Caddy passes `Cf-Access-*` only from `192.168.64.1`, the `ipx_default` gateway cloudflared arrives from (`TUNNEL_PEER`; the subnet is pinned in the compose file); ipx trusts them only from Caddy, `192.168.64.10`, and only with a valid `Cf-Access-Jwt-Assertion` (`access_team`, `access_aud`) | @@ -71,6 +72,16 @@ docker compose -f /mnt/fast/arcane/projects/ipx/compose.yaml pull ipx-web docker compose -f /mnt/fast/arcane/projects/ipx/compose.yaml up -d ipx-web ``` +The home page (`site/`, #216) is not on Tower. `sh site/build.sh` puts it in `site/dist` with the +typeface, logo and icon from `web/`, and it goes to the Cloudflare Pages project `ipxreader` by +direct upload, since there is no wrangler login here: hash each file as wrangler does (BLAKE3 of +its base64 contents plus its extension, the first 32 hex digits, with the `blake3-wasm` package), +ask the project for an upload token (`GET .../pages/projects/ipxreader/upload-token`), send the +files to `/pages/assets/upload` with that token, then create a deployment +(`POST .../pages/projects/ipxreader/deployments`) with the manifest of paths and hashes and +`_headers`. Its screenshots (`site/shots`) come from a scratch iPX on public feeds, never +production's, which would show whose subscriptions are whose. + Testing sign-in from Tower itself proves nothing about the tunnel: Tower's own requests reach the published port as `192.168.1.130`, and Caddy rightly strips their `Cf-Access-*`. Send them from a container on another network, as cloudflared's are (#209).