chahinebrini
db7875fb34
feat(ops/mdm): AdGuard ClientID handshake — nginx + watcher
...
End-to-end DoH-to-backend wiring for Mac auto-activation:
Mac → dns.rebreak.org/dns-query/<token> → nginx → AdGuard
→ querylog.json (CP field) → watcher.py → POST /handshake → backend
- ops/nginx/dns.rebreak.org.conf: vhost with `location ^~ /dns-query`
prefix-match (not exact). proxy_pass without trailing slash preserves
the full path so AdGuard parses the ClientID natively.
- watcher.py: NDJSON tail with inode-based rotation safety, per-token
60s in-memory cooldown, urllib (no external deps), graceful 401/404/5xx
- rebreak-handshake-watcher.service: systemd unit, EnvironmentFile with
chmod 600 (HANDSHAKE_SECRET never in git), NoNewPrivileges + PrivateTmp
- DOH_CLIENTID_HANDSHAKE.md: architecture + flow diagram + risk table
- RUNBOOK.md: status/logs/restart commands + deploy ordering
Not yet deployed. Verify-checklist before `nginx -s reload`:
1. confirm AdGuard DoH port (config assumes 127.0.0.1:3000)
2. confirm TLS cert exists for dns.rebreak.org
3. snapshot current nginx config
4. `nginx -t` dry-run
5. functional curl + grep CP in querylog before starting watcher
2026-05-15 22:41:38 +02:00
chahinebrini
f7c9c79365
feat(admin): Admin App initial commit + Deploy-Infrastructure
...
apps/admin/:
- Nuxt 4.1.3 + @nuxt/ui 4 + @nuxtjs/supabase, port 3017 staging
- 7 pages: index (59 LOC dashboard), login (72 LOC), auth/confirm, plus stubs
für domains/users/stats/moderation (14-17 LOC each, content für separate
Phase 2 Session)
- composables/useAdminAuth.ts: Supabase login + verifyAdminRole hook
- middleware/admin-auth.ts: route guard (Phase 3 backend-check ready)
- layouts/default.vue, app.vue, README.md
- nuxt.config.ts: SSR=true, port 3017, dark-mode preference, Supabase
pkce-flow, runtimeConfig.adminSecret für Phase 3 backend-binding
Deploy-Infrastructure:
- .github/workflows/deploy-admin-staging.yml: build admin auf push to main mit
path-filter apps/admin/**, scp tar zu Server, atomic-mv + pm2 restart
- scripts/deploy-admin-from-artifact.sh: Server-side deploy (extract, atomic mv,
pm2 reload). Kein prisma-migrate (admin hat kein eigenes DB-Schema).
- apps/admin/start-admin-staging.sh: pm2 start-script mit Infisical-wrapper,
port 3017, mappt Infisical SUPABASE_URL/KEY auf NUXT_PUBLIC_*
- ecosystem.config.js: rebreak-admin-staging Eintrag (port 3017,
max_memory_restart 400M)
- ops/nginx/admin-staging.rebreak.org.conf: HTTP→HTTPS redirect, SSL paths,
proxy auf 127.0.0.1:3017, noindex header
Pending User-Actions für go-live:
1. DNS-A-Record admin.staging.rebreak.org → 49.13.55.22
2. SSL-cert via certbot (oder bestehender wildcard *.staging.rebreak.org)
3. nginx-config auf Server aktivieren (sudo cp + ln + reload)
4. pm2 initial start: pm2 start ecosystem.config.js --only rebreak-admin-staging
5. Infisical-secret ADMIN_SECRET (server-only, Phase 3 binding)
GH-Actions: keine neuen Secrets (nutzt bestehende HETZNER_SSH_KEY/HOST/USER)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-08 22:30:17 +02:00
chahinebrini
5dfbe886a4
fix(ops/nginx): sync configs aus /etc/nginx/sites-available/ vom rebreak-server
...
Mein vorheriger Push hatte ältere ops/nginx/-Versionen aus dem rebreak-monorepo.
Server hatte ACME-Challenge, security-Headers (HSTS, X-Frame-Options, X-XSS),
separate /webhook Location, X-Robots-Tag — alles war im Repo nicht drin.
Geänderte/neue files:
- staging.rebreak.org.conf — full version mit ACME + security
- db-staging.rebreak.org.conf — minimal diff
- default.conf — NEU
- rebreak-staging-new.conf — NEU
Live nginx selbst war nicht betroffen (nginx -t ok), Repo-Sources jetzt
auf Live-Stand synchronisiert.
2026-05-06 14:12:31 +02:00
chahinebrini
f2e822be95
feat(sos): llmProvider toggle + sort:latency + bench scaffolding
...
- backend/coach: routing zu Sonnet (default) / Haiku / Groq Llama je nach
sessionData.llmProvider. sort:latency für Anthropic-Modelle (-30..58% TTFB).
- frontend: LlmProviderToggle (Sonnet/Haiku/Groq pills), llmProvider.ts
Storage-Helper. sosStream.ts schickt llmProvider im /sos-session-Body.
- bench: SosTtsBenchmark sammelt Marker (req->session, lyra-ttfb, lyra-done,
tts-fired/headers/body/file, audio-loaded, first-audio); Output als console.table.
- ops: backend/scripts/llm-bench.sh + Python-Variante für realistic SOS-Prompt.
- speak-cartesia + speak-elevenlabs Endpoints (waren ungetracked, jetzt mit drin).
2026-05-06 13:58:07 +02:00
