7 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	9c5a183025	feat(cinny): nginx for Element Call on call.chat.lotusguild.org (cinny #43) ... - cinny/nginx.conf: a call.chat.lotusguild.org server block that serves ONLY /public/element-call/ (the same files chat.lotusguild.org already serves there) and 404s everything else, including source maps and dotfiles. - cinny/nginx-security-headers-call.conf (new snippet): frame-ancestors https://chat.lotusguild.org instead of X-Frame-Options SAMEORIGIN, which would block the now cross-origin parent. - cinny/nginx-security-headers.conf: the app's Permissions-Policy delegates autoplay/camera/display-capture/microphone to the call origin (without it the cross-origin frame's getUserMedia is refused). Outer quotes switched to single: the inner "origin" quotes broke nginx parsing. Nothing changes for users until config.json sets elementCallUrl (separate step). Snippets are installed by hand on LXC 106; nginx.conf deploys on merge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 23:24:32 -04:00
Lotus CIandClaude Opus 5.5	1dccca914c	landing: re-verify every client claim (reviewed 2026-09-26) ... Each client's card and all 64 table cells were checked against its latest release (source at the release tag, changelogs, official docs): Cinny v4.12.7, Element Web v1.12.29, Element X 26.09.2, FluffyChat v2.9.5, Commet v0.5.0, Nheko v0.12.1. ~95 cells corrected, notes tightened, chips made consistent (platforms / SDK / one calling chip). Notable: - Cinny: calls, voice rooms and screenshare via Element Call are stable (card gained the calling chip); ring, who-reacted, read receipts: yes; polls: no. - Element X: cannot START a screenshare (mobile web views have no getDisplayMedia) — chip is now "Voice & Video". - FluffyChat: threads, pinning, media gallery, custom status, QR invites: yes; calls still experimental (DM-only, legacy 1:1). - Commet: web app + Windows/Linux, no macOS; screenshare, widgets (v0.5.0), favourites: yes; "Beta" chip dropped (not self-described). - Nheko: calls are 1:1 only and only in Linux builds; threads: yes; no release since Aug 2025. - Element: no bookmarks or scheduling; custom status is Labs; QR invites and sort order: yes. - Lotus Chat: Vodozemac yes (Rust crypto), widgets yes, push = only while open (no background push yet); desktop app is Windows + Linux (the feature list said macOS). - Vodozemac is yes for every js-sdk client now (Rust crypto). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 16:53:07 -04:00
Lotus CIandClaude Opus 5.5	f0017f4d5a	landing: structured feature groups, single-source comparison table (#11) ... - The ~1,800-word fork paragraph becomes 7 titled groups, one short line per feature, plus a link to LOTUS_FEATURES.md. - Single source: landing/data/features.json + comparison.json, rendered into index.html by landing/build.py between BEGIN/END markers (all 71 table rows re-render with identical cell text). - CSS moved to landing/style.css; build.py inlines it because the LXC 139 deploy copies index.html only. - "Client comparison last reviewed" stamp driven by comparison.json. - CI job `landing-fresh` fails if index.html drifts from its sources. - Feature list brought up to date: 629 avatar decorations in 28 categories, mic level meter + remembered per-person volume, search operators, paste-as-code, thread "Mark all read", pinch-zoom/swipe media viewer, room widgets with a permission prompt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 15:11:50 -04:00
Lotus CIandClaude Opus 5.5	e28256ab3a	docs: note the Element Call headers exception ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 19:26:52 -04:00
Lotus CIandClaude Opus 5.5	d4fd1d0b8e	fix(cinny/nginx): let the app frame its bundled Element Call again ... Web calls broke ("nobody can join calls from the web version"): 23ad133 (cinny #210) put the security-headers snippet, including the app CSP, on every .html response. /public/element-call/index.html then carried frame-ancestors 'none', so the browser refused to load it inside the app ("Content-Security-Policy ... frame-ancestors 'none'"). Desktop was fine (it loads Element Call from its own bundle). Before #210 that page had no CSP. A `location ^~ /public/element-call/` now serves it with cinny-security-headers-framed.conf: the same headers minus the CSP (X-Frame-Options SAMEORIGIN still limits framing to chat.lotusguild.org), and the same caching (HTML no-cache, hashed assets 1 year). Applied live on LXC 106 (backup sites-available/cinny.bak-ecframe-*), nginx -t ok; verified from outside: no CSP on the call page, and the live site frames it and it loads ("Element Call"). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 19:26:44 -04:00
Lotus CIandClaude Opus 5.5	23ad133dc3	cinny(nginx): security headers on every location; sync repo with live (cinny #210, #214, #155) ... Applied on LXC 106 (backed up, `nginx -t`, reloaded) and recorded here: - Security headers (incl. CSP) moved to snippets/cinny-security-headers.conf and included at server level plus in the /sw.js, static-asset and json/html locations. nginx drops inherited add_header in any block that sets its own, so static assets were served without nosniff and /sw.js without a CSP (a service worker takes its CSP from its own script). Now every path carries all seven headers. Verified: the SW installs and controls the page under the CSP with no violations. - #214: CSP no longer allows fonts.googleapis.com / fonts.gstatic.com (VT323 is self-hosted since cinny 6f250353). - #155: the /share-target → /share 303 is now live (it was only in the repo; the 106 matrix-deploy hook has been dead since May, so repo edits never reached it). absolute_redirect off makes it relative. - README: the snippet, and that 106 needs these applied by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-23 23:17:53 -04:00
Lotus CIandClaude Opus 5.5	1dacf29d53	security(deploy): webhook secrets out of git; all exposed ones rotated ... deploy/hooks-lxc*.json in this public repo held the HMAC secrets for every auto-deploy webhook (and 106's cinny-build token), readable anonymously. Six values had been committed: the four matrix-deploy secrets, 106's lotus-deploy secret (publicly reachable through chat.lotusguild.org/hooks/lotus-deploy) and the cinny-build token. - All six rotated on the servers and in Gitea (matrix hooks 6-9, cinny hook 69). The old values are rejected. - Secrets now live in /etc/webhook/secrets.env (0600) on each LXC, loaded by a systemd drop-in that also enables webhook's -template mode; the hooks files use {{ getenv "NAME" | js }} placeholders. - The repo hooks files are now exact copies of the live ones, so they also document the *-config-deploy hooks they were missing. Those three secrets were never committed and are unchanged. - README: where the secrets live and how to rotate one. - CI `hooks-no-secrets` fails if a literal secret lands in a hooks file again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-23 22:29:52 -04:00