Split: ipx uses the directory service #205

Closed
opened 2026-10-11 20:01:39 -07:00 by rays · 4 comments
Owner

Part of splitting ipx into a directory service, a backend and a frontend (see the tracking issue).

ipx uses the directory service instead of its own directory.

  • Admin settings, in the settings table: Directory URL (empty by default), Access token (write-only: never returned by /api/settings), Share subscriptions (off by default).
  • /api/popular, /api/directory and /api/directory/{id} ask the directory and add whether each feed is yours. The browser never talks to the directory. With no URL set, the Directory and Popular views say no directory is configured, and feeds are added by URL.
  • Subscribing from the directory takes the URL it gives for the id and goes through the usual add-feed path.
  • With sharing on, after each scan ipx sends a snapshot: each public feed it carries and its subscriber count. Never a feed looks_private() catches, an OPML or Patreon creator itself, or a feed marked unlisted.
  • A per-feed unlisted flag, because looks_private() is a heuristic: a key in the path of a host it does not know gets through.
  • If the token cannot send (403, a read-only token), the admin page says so, instead of every scan failing quietly.
  • The local directory code (web.rs, the "popular on this server" section) goes; its privacy tests move to the snapshot builder.
Part of splitting ipx into a directory service, a backend and a frontend (see the tracking issue). ipx uses the directory service instead of its own directory. * Admin settings, in the `settings` table: **Directory URL** (empty by default), **Access token** (write-only: never returned by `/api/settings`), **Share subscriptions** (off by default). * `/api/popular`, `/api/directory` and `/api/directory/{id}` ask the directory and add whether each feed is yours. The browser never talks to the directory. With no URL set, the Directory and Popular views say no directory is configured, and feeds are added by URL. * Subscribing from the directory takes the URL it gives for the id and goes through the usual add-feed path. * With sharing on, after each scan ipx sends a snapshot: each public feed it carries and its subscriber count. Never a feed `looks_private()` catches, an OPML or Patreon creator itself, or a feed marked unlisted. * A per-feed **unlisted** flag, because `looks_private()` is a heuristic: a key in the path of a host it does not know gets through. * If the token cannot send (403, a read-only token), the admin page says so, instead of every scan failing quietly. * The local directory code (`web.rs`, the "popular on this server" section) goes; its privacy tests move to the snapshot builder.
rays added the enhancement label 2026-10-11 20:01:39 -07:00
Author
Owner

The settings go in a Directory section of the admin page in the web interface (web/admin.html), not only the API: Directory URL, Access token (a field that shows whether one is set, never the token itself, with Replace and Clear), Share subscriptions, and the token's name and access level once the directory answers /v1/me, or why it did not (unreachable, 401 revoked, 403 read-only while sharing is on). New UI, so mockups on this issue for approval before it merges.

The settings go in a **Directory** section of the admin page in the web interface (web/admin.html), not only the API: Directory URL, Access token (a field that shows whether one is set, never the token itself, with Replace and Clear), Share subscriptions, and the token's name and access level once the directory answers `/v1/me`, or why it did not (unreachable, 401 revoked, 403 read-only while sharing is on). New UI, so mockups on this issue for approval before it merges.
Author
Owner

Private feeds stay private: none ever goes to the directory. The per-feed flag is called private, not unlisted. A feed is private when it is marked so, when it has a username or password, or when looks_private() catches its address (a paid host, or a key in the query). The snapshot builder leaves out all three, and the directory refuses anything looks_private() catches as well. Tests cover each case.

Private feeds stay private: none ever goes to the directory. The per-feed flag is called **private**, not unlisted. A feed is private when it is marked so, when it has a username or password, or when `looks_private()` catches its address (a paid host, or a key in the query). The snapshot builder leaves out all three, and the directory refuses anything `looks_private()` catches as well. Tests cover each case.
Author
Owner

Built on the branch directory-client (c47aa57), not merged or deployed: this is the new UI for approval. All suites pass (Rust 117 + 11 + 30, Playwright 73, a new browser test for this).

Admin, Directory: a new tab. Address, token (write-only: it says "Set" and offers Clear, never shows it), the share switch, and a status line saying who the directory takes this server to be and how the last snapshot went, or why it refused.

Glass, 390px Modern, desktop

A feed's settings: a Private switch at the end. Anyone subscribed can turn it on; only an admin can turn it off. A feed whose address or login shows it is private has it on and locked, with a line saying why (second Glass shot, the fixture's paid feed).

Glass Glass, a paid address Desktop

The Directory with no directory set up: says so, in place of the grid.

The Directory itself is unchanged in layout. Its wording changes: "N shared by iPX servers" instead of "on this server", "N people subscribe" instead of "people here subscribe".

Decisions that are yours:

  1. A tab of its own (Server, Accounts, Directory, Log), or a section under Server?
  2. Private as a switch at the end of a feed's settings, or nearer the top?
  3. Who may unmark a feed private: admins only (as built), or whoever marked it?

On approval I merge and deploy, then set production's directory address and Tower's token (/mnt/fast/appdata/ipx-directory/tower.token) in the admin page, and turn sharing on.

Built on the branch `directory-client` (c47aa57), **not merged or deployed**: this is the new UI for approval. All suites pass (Rust 117 + 11 + 30, Playwright 73, a new browser test for this). **Admin, Directory**: a new tab. Address, token (write-only: it says "Set" and offers Clear, never shows it), the share switch, and a status line saying who the directory takes this server to be and how the last snapshot went, or why it refused. | Glass, 390px | Modern, desktop | |---|---| | ![](https://git.sdf1.net/attachments/e982ebda-f0e2-4b73-8319-fa3f836ddbe8) | ![](https://git.sdf1.net/attachments/7f9a4640-1989-46f4-8159-509782b33b15) | **A feed's settings**: a Private switch at the end. Anyone subscribed can turn it on; only an admin can turn it off. A feed whose address or login shows it is private has it on and locked, with a line saying why (second Glass shot, the fixture's paid feed). | Glass | Glass, a paid address | Desktop | |---|---|---| | ![](https://git.sdf1.net/attachments/403c04a6-b071-491c-a998-e23958e99f91) | ![](https://git.sdf1.net/attachments/9387f464-1bf5-40bf-9b20-96f23dc4ad67) | ![](https://git.sdf1.net/attachments/bb2209e9-1930-4cde-a108-e62ddf8f509d) | **The Directory with no directory set up**: says so, in place of the grid. ![](https://git.sdf1.net/attachments/1914b4fd-43d1-44e7-87e2-5369740d3bf9) The Directory itself is unchanged in layout. Its wording changes: "N shared by iPX servers" instead of "on this server", "N people subscribe" instead of "people here subscribe". Decisions that are yours: 1. A tab of its own (Server, Accounts, **Directory**, Log), or a section under Server? 2. Private as a switch at the end of a feed's settings, or nearer the top? 3. Who may unmark a feed private: admins only (as built), or whoever marked it? On approval I merge and deploy, then set production's directory address and Tower's token (/mnt/fast/appdata/ipx-directory/tower.token) in the admin page, and turn sharing on.
Author
Owner

Approved as built. Merged as c47aa57 and deployed with ipx-directory. Production's Admin, Directory is set to https://ipx-dir.sdf1.net with Tower's rwa token, sharing on: the first snapshot sent 1471 feeds, none refused; the directory lists each once it has fetched it (193 so far).

Approved as built. Merged as c47aa57 and deployed with ipx-directory. Production's Admin, Directory is set to https://ipx-dir.sdf1.net with Tower's rwa token, sharing on: the first snapshot sent 1471 feeds, none refused; the directory lists each once it has fetched it (193 so far).
rays closed this issue 2026-10-12 07:22:02 -07:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: rays/ipx#205