216 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	cf42d0aab0	docs: registration is closed (SSO/LLDAP only); note Draupnir encryption status ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 18:52:37 -04:00
jared	6c50f51feb	Merge pull request 'Revert Draupnir Rust crypto (#26)' (#28) from revert-draupnir-rust-crypto into main	2026-10-16 18:40:05 -04:00
Lotus CIandClaude Opus 5.5	cabc393b6b	Revert Draupnir Rust crypto (#26): it fails to start without a device-bound token ... With experimentalRustCrypto: true, Draupnir 2.9.0 exits on startup with "Encryption not possible: server not revealing device ID": its access token is not bound to a device, which matrix-bot-sdk crypto requires. Restores experimentalRustCrypto: false so the deploy hook brings it back. To enable encryption later, give Draupnir a device-bound access token (a normal password login) first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 18:36:16 -04:00
jared	72a3e3ba17	Merge pull request 'draupnir: enable Rust crypto so it can read commands in the encrypted management room' (#26) from draupnir-rust-crypto into main	2026-10-16 18:34:55 -04:00
jared	162d8b5a80	Merge pull request 'landing: describe SSO sign-up, drop dashes and hyphens from the page text' (#27) from landing-sso-wording into main	2026-10-13 02:48:19 -04:00
Lotus CIandClaude Opus 5.5	d17c40e79f	landing: describe SSO sign-up, drop dashes and hyphens from the page text ... The "How to Join" steps still said to register with a token from Jared; accounts now come from LLDAP and people sign in with Lotus SSO. The steps now read: ask Jared for a Lotus Guild account, open chat.lotusguild.org and sign in with Lotus SSO, join the space. The contact line asks "Questions or need an account?" and the server details say "Invite only". Visible text no longer uses em dashes, en dashes or hyphens (dashes became colons, commas, full stops or "to"; compounds became separate words), in the hand-written parts and in data/features.json / comparison.json, with index.html regenerated by build.py. Package names (matrix-js-sdk, matrix-rust-sdk, matrix-dart-sdk, matrix-sdk-crypto-wasm) and D-Bus keep their hyphens; markup, URLs and <code> are untouched. The reviewed date displays as "September 26, 2026" (datetime attribute stays ISO). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-13 02:36:25 -04:00
Lotus CIandClaude Opus 5.5	77e719183a	draupnir: enable Rust crypto so it can read commands in the encrypted management room ... The management room is end-to-end encrypted, but Draupnir ran with experimentalRustCrypto: false and Pantalaimon off, so it could post there (its own messages are unencrypted) but never saw commands: its last reply to a command was ~57 days ago, and `!draupnir rooms add …` sent from Lotus on 2026-10-13 was ignored. The same command sent unencrypted worked at once (✅, joined dco-memes-minecraft). Merging deploys via lxc110-draupnir.sh, which restarts draupnir. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-13 01:34:10 -04:00
jaredandClaude Opus 5.5	7c857bea1e	docs: record the Devdesk hookshot webhook ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 23:34:02 -04:00
jaredandClaude Opus 5.5	f2db3b1b3e	hookshot: DevDesk "Claude needs you" webhook (devdesk#28) ... devdesk-notify-matrix on CT 126 posts here when a Claude session waits for input and no browser tab or SSH client is attached. Deploying this transform creates the Devdesk hook in Spam and Stuff. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 23:30:31 -04:00
jaredandClaude Opus 5.5	5efd214ebe	docs: record the Ci-Alert hookshot webhook and how to look up hook UUIDs ... The Ci-Alert hook existed (created when ci-alert.js was deployed) but its URL was never set in Gitea, so every repo's notify-failure job skipped. The org secret MATRIX_WEBHOOK_URL now points at it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 19:08:53 -04:00
jared	e988465906	Add MIT license	2026-10-03 00:16:58 -04:00
jared	effa27da3d	Merge pull request 'cinny config: status banner from the Kuma page (cinny #124)' (#17) from config-status-pages into main ... Merge pull request #17: cinny config status banner (cinny #124)	2026-09-29 13:24:51 -04:00
Lotus CIandClaude Opus 5.5	8d80ebf4c2	cinny config: status banner from the Kuma page (cinny #124) ... Adds `statusPages` for matrix.lotusguild.org → the Kuma status page https://isitup.lotusguild.org/status/matrix (groups Homeserver, Voice calls, Login). The banner code (cinny #255) and the CSP (#16) are already live; production's config.json comes from this file, so without this entry the client never asks Kuma. The LXC 106 deploy merges it into the live file and keeps server-only values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 12:35:55 -04:00
jared	0914339180	Merge pull request 'cinny CSP: allow the Kuma status page (cinny #124)' (#16) from csp-kuma-status into main ... Merge pull request #16: cinny CSP allows the Kuma status page (cinny #124)	2026-09-29 12:28:30 -04:00
Lotus CIandClaude Opus 5.5	9fcbd410f2	cinny CSP: allow the app to read the Kuma status page (cinny #124) ... Add https://isitup.lotusguild.org to connect-src so the client can fetch the public status JSON (GET /api/status-page/matrix and /api/status-page/heartbeat/matrix) for the homeserver status banner. Read-only public JSON, no credentials; nothing else changes. The live snippet (/etc/nginx/snippets/cinny-security-headers.conf on LXC 106) was identical to this file before the change; install it by hand with a backup and `nginx -t` (the deploy script only handles cinny/nginx.conf). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 12:08:45 -04:00
jared	d76d276da4	Merge pull request #15: LXC 106 deploy: merge config.json, self-update (#13)	2026-09-28 18:52:30 -04:00
Lotus CIandClaude Opus 5.5	8d47df711d	fix(lxc106): deploy script merges config.json and updates itself (#13) ... LXC 106's matrix-deploy hook has not fired since May: Gitea posts to 10.10.10.6:9000, which webhook.service binds to 127.0.0.1. The same hooks (same secret) are served by webhook-lotus on :9001; the Gitea hook is being re-pointed there. Before it starts firing again: - cinny/config.json is merged into the live file instead of copied over it. The live file carries gifApiKey (injected by lotus_deploy.sh), empty in git, which a copy would blank. Repo keys win except where the repo value is empty and the live one isn't. Backup goes to /root/config-backups; the live file is left untouched on error. - The script installs its own updates (deploy/lxc106-cinny.sh → /usr/local/bin/matrix-deploy.sh, after bash -n). Until now repo edits to it never reached the server. - A hooks.json change restarts webhook-lotus 15 s after the script exits, since that listener is the one running this script. - README: port 9001, the file list, and the history. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 18:47:49 -04:00
Lotus CIandClaude Opus 5.5	9baafd4928	cinny: load Element Call from call.chat.lotusguild.org (cinny #43) ... Sets elementCallUrl so the web app frames the call page on its own origin (desktop keeps its bundled copy). Applied on LXC 106 in place (the live file also carries the injected gifApiKey; backup in /root/config-backups/), since the matrix-deploy webhook there has not fired since May. Rollback: remove this key (live: restore the backup) and new calls use the bundled same-origin page again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-27 11:52:52 -04:00
jared	97d9416b01	Merge pull request #12: nginx for Element Call on call.chat.lotusguild.org (cinny #43)	2026-09-27 02:32:07 -04:00
Lotus CIandClaude Opus 5.5	9c5a183025	feat(cinny): nginx for Element Call on call.chat.lotusguild.org (cinny #43) ... - cinny/nginx.conf: a call.chat.lotusguild.org server block that serves ONLY /public/element-call/ (the same files chat.lotusguild.org already serves there) and 404s everything else, including source maps and dotfiles. - cinny/nginx-security-headers-call.conf (new snippet): frame-ancestors https://chat.lotusguild.org instead of X-Frame-Options SAMEORIGIN, which would block the now cross-origin parent. - cinny/nginx-security-headers.conf: the app's Permissions-Policy delegates autoplay/camera/display-capture/microphone to the call origin (without it the cross-origin frame's getUserMedia is refused). Outer quotes switched to single: the inner "origin" quotes broke nginx parsing. Nothing changes for users until config.json sets elementCallUrl (separate step). Snippets are installed by hand on LXC 106; nginx.conf deploys on merge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 23:24:32 -04:00
Lotus CIandClaude Opus 5.5	1dccca914c	landing: re-verify every client claim (reviewed 2026-09-26) ... Each client's card and all 64 table cells were checked against its latest release (source at the release tag, changelogs, official docs): Cinny v4.12.7, Element Web v1.12.29, Element X 26.09.2, FluffyChat v2.9.5, Commet v0.5.0, Nheko v0.12.1. ~95 cells corrected, notes tightened, chips made consistent (platforms / SDK / one calling chip). Notable: - Cinny: calls, voice rooms and screenshare via Element Call are stable (card gained the calling chip); ring, who-reacted, read receipts: yes; polls: no. - Element X: cannot START a screenshare (mobile web views have no getDisplayMedia) — chip is now "Voice & Video". - FluffyChat: threads, pinning, media gallery, custom status, QR invites: yes; calls still experimental (DM-only, legacy 1:1). - Commet: web app + Windows/Linux, no macOS; screenshare, widgets (v0.5.0), favourites: yes; "Beta" chip dropped (not self-described). - Nheko: calls are 1:1 only and only in Linux builds; threads: yes; no release since Aug 2025. - Element: no bookmarks or scheduling; custom status is Labs; QR invites and sort order: yes. - Lotus Chat: Vodozemac yes (Rust crypto), widgets yes, push = only while open (no background push yet); desktop app is Windows + Linux (the feature list said macOS). - Vodozemac is yes for every js-sdk client now (Rust crypto). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 16:53:07 -04:00
Lotus CIandClaude Opus 5.5	f0017f4d5a	landing: structured feature groups, single-source comparison table (#11) ... - The ~1,800-word fork paragraph becomes 7 titled groups, one short line per feature, plus a link to LOTUS_FEATURES.md. - Single source: landing/data/features.json + comparison.json, rendered into index.html by landing/build.py between BEGIN/END markers (all 71 table rows re-render with identical cell text). - CSS moved to landing/style.css; build.py inlines it because the LXC 139 deploy copies index.html only. - "Client comparison last reviewed" stamp driven by comparison.json. - CI job `landing-fresh` fails if index.html drifts from its sources. - Feature list brought up to date: 629 avatar decorations in 28 categories, mic level meter + remembered per-person volume, search operators, paste-as-code, thread "Mark all read", pinch-zoom/swipe media viewer, room widgets with a permission prompt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 15:11:50 -04:00
Lotus CIandClaude Opus 5.5	e28256ab3a	docs: note the Element Call headers exception ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 19:26:52 -04:00
Lotus CIandClaude Opus 5.5	d4fd1d0b8e	fix(cinny/nginx): let the app frame its bundled Element Call again ... Web calls broke ("nobody can join calls from the web version"): 23ad133 (cinny #210) put the security-headers snippet, including the app CSP, on every .html response. /public/element-call/index.html then carried frame-ancestors 'none', so the browser refused to load it inside the app ("Content-Security-Policy ... frame-ancestors 'none'"). Desktop was fine (it loads Element Call from its own bundle). Before #210 that page had no CSP. A `location ^~ /public/element-call/` now serves it with cinny-security-headers-framed.conf: the same headers minus the CSP (X-Frame-Options SAMEORIGIN still limits framing to chat.lotusguild.org), and the same caching (HTML no-cache, hashed assets 1 year). Applied live on LXC 106 (backup sites-available/cinny.bak-ecframe-*), nginx -t ok; verified from outside: no CSP on the call page, and the live site frames it and it loads ("Element Call"). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 19:26:44 -04:00
Lotus CIandClaude Opus 5.5	23ad133dc3	cinny(nginx): security headers on every location; sync repo with live (cinny #210, #214, #155) ... Applied on LXC 106 (backed up, `nginx -t`, reloaded) and recorded here: - Security headers (incl. CSP) moved to snippets/cinny-security-headers.conf and included at server level plus in the /sw.js, static-asset and json/html locations. nginx drops inherited add_header in any block that sets its own, so static assets were served without nosniff and /sw.js without a CSP (a service worker takes its CSP from its own script). Now every path carries all seven headers. Verified: the SW installs and controls the page under the CSP with no violations. - #214: CSP no longer allows fonts.googleapis.com / fonts.gstatic.com (VT323 is self-hosted since cinny 6f250353). - #155: the /share-target → /share 303 is now live (it was only in the repo; the 106 matrix-deploy hook has been dead since May, so repo edits never reached it). absolute_redirect off makes it relative. - README: the snippet, and that 106 needs these applied by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-23 23:17:53 -04:00
Lotus CIandClaude Opus 5.5	1dacf29d53	security(deploy): webhook secrets out of git; all exposed ones rotated ... deploy/hooks-lxc*.json in this public repo held the HMAC secrets for every auto-deploy webhook (and 106's cinny-build token), readable anonymously. Six values had been committed: the four matrix-deploy secrets, 106's lotus-deploy secret (publicly reachable through chat.lotusguild.org/hooks/lotus-deploy) and the cinny-build token. - All six rotated on the servers and in Gitea (matrix hooks 6-9, cinny hook 69). The old values are rejected. - Secrets now live in /etc/webhook/secrets.env (0600) on each LXC, loaded by a systemd drop-in that also enables webhook's -template mode; the hooks files use {{ getenv "NAME" | js }} placeholders. - The repo hooks files are now exact copies of the live ones, so they also document the *-config-deploy hooks they were missing. Those three secrets were never committed and are unchanged. - README: where the secrets live and how to rotate one. - CI `hooks-no-secrets` fails if a literal secret lands in a hooks file again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-23 22:29:52 -04:00
jaredandClaude Opus 5	a16cc85420	cinny: 303 /share-target → /share for the PWA share target (#155) ... The service worker normally answers the share-sheet POST itself; this keeps a POST that reaches nginx before the worker controls the page from returning 405. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-20 13:36:09 -04:00
jaredandClaude Opus 5	c553c28957	cinny nginx: drop fonts.googleapis.com / fonts.gstatic.com from the CSP ... Lotus Chat 6f250353 self-hosts VT323, so nothing legitimate loads from Google any more; keeping the hosts allowed would let a regression pass silently. NOTE: the live config is hand-maintained at /etc/nginx/sites-available/cinny on LXC 106 — apply the same two edits there after the cinny deploy lands. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-19 13:16:52 -04:00
jaredandClaude Opus 5	ee5f78b71e	voice-limit-guard: live revoke never fired — LiveKit's JSON uses snake_case permissions ... livekit-server (verified on 1.13.7) serialises ParticipantPermission as can_publish / can_publish_sources; the reconciler read canPublish / canPublishSources, saw 'publishes nothing' for everyone and never called UpdateParticipant, so turning Allow Screen Sharing off did not stop an in-progress share. Normalise the permission keys before deciding. Verified on a local Synapse + LiveKit + guard stack: share track gone from the SFU 2 s after the policy flip. Tests added (44 pass). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-18 22:10:14 -04:00
jaredandClaude Opus 5	99bc15c6f0	landing: September 2026 features — settings sync, tracking-param stripping, system-wide hotkeys, PWA install + badge ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-17 23:30:16 -04:00
jaredandClaude Opus 5	d3ee2e2401	fix(lxc106): hooks.json carries matrix-deploy, cinny-build and lotus-deploy ... The host's /etc/webhook/hooks.json was replaced on 2026-05-21 with a copy containing only lotus-deploy, which dropped matrix-deploy and cinny-build; this repo's copy had the opposite gap. No push to this repo has deployed to LXC 106 since May. The tracked file is now the union of all three. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-15 22:24:13 -04:00
jaredandClaude Opus 5	b6ea4a333e	fix(cinny-deploy): queue a trigger that arrives mid-deploy instead of dropping it ... lotus_deploy.sh took an flock and exited if a deploy was already running. The poll loop only retargets origin/lotus while it is still waiting on CI; a push that lands during npm ci / npm run build was silently never deployed until the next unrelated push (cinny 81a6d9c9 — the MSC4515 call fix — passed CI but never reached the web root). A concurrent trigger now leaves a .pending marker and the running deploy re-execs itself once at the end, which re-fetches and re-gates on CI as usual. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-14 19:25:28 -04:00
jaredandClaude Opus 5	67a08c7402	fix(cinny): upstream-merge script pushes and hands off to CI instead of deploying ... lotus-build.sh merged the latest upstream tag, then built, copied to the web root, reloaded nginx and only then pushed — the one path that could change production without any CI gate (cinny#98). It now merges, runs the same local gates CI runs (npm ci, typecheck, eslint, prettier, tests), and pushes; the push triggers Gitea CI and lotus_deploy.sh deploys once "Build & Quality Checks" is green, like every other lotus commit. A failed gate leaves the merge local for inspection and notifies the room. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-13 00:44:44 -04:00
jaredandClaude Fable 5.1	75d9599e22	docs(landing): note re-tuned Arcade + Deep Space seasonal overlays ... Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-12 01:29:39 -04:00
jaredandClaude Sonnet 5	ea7ecf3f73	fix(bot): un-reacting from a poll never un-counted the vote ... wyr/acronym/nhie/hottake tracked votes only on reaction-add, using "add to bucket A, remove from bucket B" logic that self-corrects when switching reactions but not when a reaction is simply removed — nio never subscribed to RedactionEvent at all, so an un-react was invisible to the bot. Fixes LotusGuild/matrix#6 (repro: react agree and disagree, remove disagree, still counted as disagree). Adds unrecord_* counterparts to each record_* vote function, a reaction_id -> (poll_event_id, sender) index in Callbacks (only populated for reactions on messages we're actually tracking, so it stays bounded) so a later redaction can be traced back to what to un-count, and wires up RedactionEvent -> callbacks.redaction in bot.py. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-31 21:19:06 -04:00
jaredandClaude Opus 5	cccd0084fb	docs: record Synapse 1.159.0 upgrade ... Not a security release. No schema bump, background updates drained, homeserver.yaml preserved via --force-confold, experimental_features untouched. MSC4140 delayed events verified still working. Note the prerequisite: 1.159.0 ships a new expiry on the packages.matrix.org GPG key, so matrix-org-archive-keyring must be upgraded first or apt fails with EXPKEYSIG. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-19 12:15:33 -04:00
jaredandClaude Opus 5	70db0648f1	fix: read LiveKit credentials from env file instead of hardcoding ... LIVEKIT_KEY/LIVEKIT_SECRET were committed in the unit since 68a6acf (2026-06-12). That secret signs re-issued SFU join tokens, so it controlled who could publish. Rotated and moved to /etc/matrix-deploy.env (0600); livekit-server, lk-jwt-service and voice-limit-guard all updated and verified against the new value. Environment= overrides EnvironmentFile= regardless of order, so the hardcoded lines had to be removed rather than shadowed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-17 01:25:05 -04:00
jaredandClaude Opus 5	d014ef9a04	docs: record PLP storage fix, Synapse 1.158.0, worker triggers ... Synapse and PostgreSQL moved to the plpSSDPool Ceph pool (enterprise SSDs with power-loss protection) after consumer NVMe fsync latency was traced as the cause of dropped calls: slow fsync stalled restart_delayed_event past Element Call's 18s delayed_leave_event_delay_ms, firing the MSC4140 delayed event and clearing every m.call.member at once. INSERT INTO stream_positions went 87.30ms -> 0.462ms mean. Also: - Correct the Synapse version to 1.158.0 (file claimed 1.157.2; the upgrade was performed but never logged - second time) - Correct the push_rules.limits note: the limits are enforced by default in 1.157.2+, so no config block is needed. Verified against the installed synapse/config/push_rules.py - Record worker revisit thresholds. Synapse measures 0.045 cores, 4.5% of its single-process ceiling, so a worker split would add Redis and routing to solve a CPU problem that does not exist - Note that presence is a deliberate, paid-for cost tied to Cinny features - BBR now applied on compute-storage-gpu-01 as well - Remove a duplicated "Server Checklist" header Ceph pool topology and drive-level detail deliberately left out; that belongs with the cluster docs, not the Matrix README. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-17 01:15:00 -04:00
jaredandClaude Opus 5	fb933b0b13	feat(matrixbot): remove the auto-invite welcome flow entirely ... Joining the Lotus Guild Space (join_rule: public) triggered a welcome DM; reacting to it made the bot invite that user into a fixed room list. Now that #general is published to the public room directory, any stranger can join the Space and trigger this. The room list excluded the invite-only rooms, but it included Voice, whose join rule is `knock`. An invite bypasses a knock gate, so a stranger could skip the approval step that rule exists to enforce. Removes welcome.py, the Space-join watcher in Callbacks.member, both welcome-reaction hooks, and the admin `cleanwelcome` command. The bot no longer issues invites automatically anywhere. The PL50+ `invite` and `inviteall` commands are untouched: those are deliberate admin actions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-16 15:46:36 -04:00
jaredandClaude Opus 5	9e5d3ec83d	feat(matrixbot): stop auto-joining invites, restrict commands to two rooms ... #general is now published to the public room directory, so the bot is reachable by strangers. Two hardening changes: - Invites are only accepted from INVITE_ALLOWED_USERS (defaults to ADMIN_USERS). Anything else is declined via room_leave so hostile invites do not accumulate as pending. Previously any invite from anyone was auto-joined. - Commands and the passive scramble/riddle answer checks only run in COMMAND_ROOMS (#commands and #management). The gate sits early in Callbacks.message, so the bot stays silent everywhere else, including #general. Set COMMAND_ROOMS="*" to restore the old behaviour. Reaction handlers are deliberately left ungated so the welcome flow keeps working; game votes elsewhere cannot match an active game. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-16 01:37:45 -04:00
jaredandClaude Opus 5	7c05827dbc	fix(matrixbot): replace mcrcon with a thread-safe RCON client ... mcrcon implements its read timeout with signal.SIGALRM, which only works on the main thread. The Minecraft commands call it from a worker thread via loop.run_in_executor, so it raised "signal only works in main thread of the main interpreter" on every invocation. The replacement uses socket.settimeout(), which has no such restriction. This code was already deployed on LXC 151 but had never been committed, so any matrixbot deploy would have reverted it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-16 01:37:38 -04:00
Claude	5d420e318c	docs: record Synapse 1.157.2 security upgrade ... Upgraded LXC 151 from 1.157.1 to 1.157.2 (packages.matrix.org, Trixie), a security release fixing 11 advisories (6 High / 3 Moderate / 2 Low; no CVE IDs assigned). Applies to us: most High-severity issues need open federation (we federate) and two call out untrusted local users. Pure apt bump — no upgrade.md notes for v1.157.2, no schema migration, Python/PostgreSQL minimums unchanged, homeserver.yaml preserved via --force-confold. Clean restart (NRestarts=0), version endpoint reports 1.157.2, no errors, federation healthy. Note: 1.157.2 adds an OPTIONAL push_rules.limits config block (safe defaults) for the push-rule-exhaustion advisory — captured for later tuning, not required. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-28 17:05:55 -04:00
Claude	0a451a6f82	docs: record Synapse 1.157.1 upgrade + add upgrade runbook ... Upgraded LXC 151 from 1.156.0 to 1.157.1 (packages.matrix.org, Trixie). The host was found on 1.156.0 despite this README recording 1.155.0 — an intermediate upgrade had gone unlogged. Corrected the infra and Tech Stack tables and noted the drift so future upgrades verify with dpkg rather than trusting the docs. Not a security release (no CVEs in range; the last were fixed in 1.152.1), but 1.157.0 fixes an application-service ephemeral-events regression shipped in 1.156.0, which affects hookshot. No schema-version bump (94 -> 94) and the three new background updates completed immediately. Our experimental_features block (MatrixRTC/Element Call MSCs) is unaffected by 1.157.0's removal of msc3861, which we do not use; it was preserved via --force-confold. Also adds a Synapse upgrade runbook — the repo had no documented procedure or automation for this at all, so the two prior upgrades were done out-of-band. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-23 23:29:41 -04:00
jaredandClaude Opus 4.8	c15a48971d	deploy(cinny): follow origin/lotus HEAD while gating on CI ... Companion to cinny's `concurrency: cancel-in-progress`. The poll loop latched origin/lotus once at startup; with CI cancel-in-progress a superseded run's status flips to error/failure, so polling the latched (now-cancelled) SHA would abort and — with the flock skipping the newer push's deploy — strand the newest commit undeployed (a deploy freeze, the exact class this script fought before). - Re-resolve origin/lotus each poll iteration; retarget the CI gate to HEAD if it advanced (fresh MAX_WAIT window). - On a failure/error status, re-check HEAD before aborting — only a genuine failure of the CURRENT HEAD aborts; a superseded/blip SHA is followed instead. - Reset to the gated $COMMIT_SHA (not a bare origin/lotus that may have advanced past the gate after the loop) so we build exactly what passed CI. shellcheck clean; reviewed (SHIP). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-19 22:09:30 -04:00
jaredandClaude Opus 4.8	3835ce4020	docs: document on-device message translation ... Add the translation feature to the landing page (Newest July 2026 prose + comparison-table row) and the README custom-features table. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-18 16:19:01 -04:00
jaredandClaude Opus 4.8	d9dfc54200	fix(cinny): restore gifApiKey placeholder + redact leaked key from README ... The production config.json (cp'd from cinny/config.json by deploy/lxc106-cinny.sh) lost its "gifApiKey": "" placeholder, so lotus_deploy.sh's sed injection had no field to fill -> the GIF composer button disappeared (it renders only when gifApiKey is non-empty). Restore the placeholder so future deploys inject the key. Also redact the real Giphy key that was committed in the README (it belongs only in /etc/lotus-deploy.env on LXC 106). NOTE: the key remains in git history (commit f3a7bcd) — it should be rotated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-08 00:56:47 -04:00
jaredandClaude Opus 4.8	6d5583398b	docs: document cinny inline media embeds ... - README Custom Features: 'Inline media embeds' row (16 providers, facade, CSP note incl. the live LXC 106 frame-src allowlist vs the repo wildcard fallback). - landing: add inline media embeds to the July 2026 feature list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-07 12:13:02 -04:00
jaredandClaude Opus 4.8	b72d6620cc	chore(nginx): widen CSP frame-src to https: for room widgets (MSC1236) ... Room widgets embed arbitrary third-party https pages in a sandboxed iframe; frame-src was 'self' + openstreetmap only. Apply + nginx -s reload. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-03 13:27:23 -04:00
jaredandClaude Opus 4.8	64262b39ec	chore(nginx): drop api.qrserver.com from CSP (invite QR now generated locally) ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 22:19:22 -04:00
jaredandClaude Opus 4.8	6293a62e47	feat(nginx): add HSTS + Permissions-Policy to chat.lotusguild.org (P6-4) ... Adds Strict-Transport-Security (2y, includeSubDomains, preload) and a Permissions-Policy that allows only the features the app uses (camera/mic/ display-capture for calls, geolocation for location share, autoplay/fullscreen/ encrypted-media) and denies the rest. Complements the existing X-Frame/CSP/ Referrer headers. Apply: reload nginx on the LXC. TLS terminates upstream (listen 80), so verify the header reaches the browser (front proxy must pass it through) — else set HSTS at the TLS terminator. Verify a call + location share still work. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 14:41:08 -04:00