LotusGuild/matrix
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cinny-web): serve avatar decorations from chat.lotusguild.org/decorations (#22)
Lint / Shell (shellcheck) (push) Successful in 14s
Details
Lint / JS (eslint) (push) Successful in 11s
Details
Lint / No secrets in webhook configs (push) Successful in 5s
Details
Lint / Landing page is rendered (matrix (push) Successful in 4s
Details
Lint / Python (ruff) (push) Successful in 6s
Details
Lint / Python deps (pip-audit) (push) Successful in 32s
Details
Lint / Secret scan (gitleaks) (push) Successful in 4s
Details
Lint / Shell (shellcheck) (pull_request) Successful in 7s
Details
Lint / JS (eslint) (pull_request) Successful in 5s
Details
Lint / No secrets in webhook configs (pull_request) Successful in 4s
Details
Lint / Landing page is rendered (matrix (pull_request) Successful in 3s
Details
Lint / Python (ruff) (pull_request) Successful in 4s
Details
Lint / Python deps (pip-audit) (pull_request) Successful in 30s
Details
Lint / Secret scan (gitleaks) (pull_request) Successful in 4s
Details

Browse Source 
Decorations came through Nextcloud's public DAV: a new PHP session (four
cookies) per image and no cache headers, on every decorated avatar. The
set (629 decorations + thumbnails, 573 MB) is now a versioned Gitea
generic package (avatar-decorations 1.0.0, 4 tar parts), pinned by
sha256 in cinny/decorations.sha256. LXC 106's deploy installs it to
/var/www/decorations-<version> (verified against the pin and the
in-package manifest; previous version kept; failures leave the live set
alone), and nginx serves /decorations/ with a one-week public cache.
deploy/publish-decorations.sh publishes a new version and writes the pin.

Fixes #22

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
This commit is contained in:
Lotus CI
2026-10-19 12:32:34 -04:00
co-authored by Claude Opus 5.5
parent 96d1778bb4
commit b6380b6c8a
5 changed files with 131 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10
View File
@@ -472,6 +472,16 @@ chmod 600 /etc/cinny-monitor.env
**Cinny-build webhook token** (header `X-Build-Token` on the `cinny-build` hook): `CINNY_BUILD_TOKEN` in LXC 106's `/etc/webhook/secrets.env`, not in git. Reachable on `10.10.10.6:9001` (`webhook-lotus`); `:9000` is bound to `127.0.0.1`. Note: LotusBot doesn't implement `!cinny-update` at the moment, so nothing calls this hook.
### Avatar decorations (matrix #22)
Served from **`https://chat.lotusguild.org/decorations/`**: `<slug>.png` and `thumbs/<slug>.webp`, `Cache-Control: public, max-age=604800`, no cookies. They used to come through Nextcloud's public DAV, which started a PHP session per image and sent no cache headers.
- **Storage:** Gitea generic package `avatar-decorations` (`https://code.lotusguild.org/api/packages/LotusGuild/generic/avatar-decorations/<version>/`), in ≤150 MB tar parts (the proxy refuses larger uploads). Nothing goes in git except the pin.
- **Pin:** `cinny/decorations.sha256`, the sha256 of each part, which names the version.
- **Deploy:** `deploy/lxc106-cinny.sh` installs the pinned version when the pin changes (or nothing is installed yet). It downloads the parts, checks them against the pin and against the `MANIFEST.sha256` inside, unpacks to `/var/www/decorations-<version>`, and atomically repoints `/var/www/decorations`. The previous version is kept for rollback; a failed download or checksum leaves the live set unchanged. nginx: `location ^~ /decorations/` in `cinny/nginx.conf`.
- **Updating the set:** put the files in a folder (`<slug>.png` + `thumbs/<slug>.webp`) and run `GITEA_TOKEN=… deploy/publish-decorations.sh <folder> <new-version>`. That rewrites the pin; commit it. Add or remove the catalog entries in cinny's `src/app/features/lotus/avatarDecorations.ts`. Use a new version for every change: an image replaced under the same name can be cached for up to a week.
- **Rollback:** revert `cinny/decorations.sha256`, or on LXC 106 run `ln -sfn /var/www/decorations-<old>/decorations /var/www/decorations`.
### Webhook secrets — rotating
Secrets used to be committed in `deploy/hooks-lxc*.json` in this public repo; all exposed ones were rotated on 2026-09-23 and moved to `secrets.env`. To rotate one: