Coolify deployment: Rust API, TypeScript web, PostgreSQL and notification worker #4
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Prepare and deploy new public repository code/cl8y-wallet-security to Coolify using existing authorized infrastructure. Dockerfiles, pinned builds/lockfiles, nonroot images, health/readiness, private PostgreSQL networking, migrations before ready, durable storage and least-privilege DB roles, notification worker concurrency/leadership, TLS and exact deployment provenance. Read existing Coolify infrastructure first and create separate resources; preserve unrelated applications. Secrets through authorized broker or workload credential mechanisms, never repository/logs. Backups, bounded restore drill/runbook, safe rollbacks and environment example with placeholders. Restrict admin/API and egress appropriately; production chain events must be verified allowlisted contract identities.
A healthy scaffold is distinct from functional on-chain management/notification delivery. Use owned sandbox data for smoke verification; no real-user alerts or mainnet recovery actions for testing. Record exact live URL, source SHA and health/migration evidence, and unavailable dependencies honestly.
Dependency: backend/UI deployable shard; contract ABI configuration and mail/Telegram credentials gate relevant production features only.
Working rules
User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.
Implementation assigned to BB worker
thr_wur9hgwhec, coordinated bythr_4rw76j9kerin security epic.Dependency/order: Deployable backend/UI, private PostgreSQL and independent auth/deployment review; enable contract/notification features only with verified live prerequisites.
Worker is active in an isolated worktree. It owns implementation and truthful acceptance evidence, with independent review before production completion. Initial orchestration does not establish code/deployment acceptance.
Implementation is published in PR #5. The API is a working Rust/PostgreSQL service with ADR-036 wallet authentication, exact-origin/CSRF sessions, independent wallet proofs and delayed dual-consent profile assignments; these are explicitly distinct from chain authority. The accessible TypeScript frontend is integrated, and its exact ABI continuation is in progress against independently reviewed token/controller schema pin
2d70d43c651ecd4491c0736c89ae2975ee825686.Finalized receipt ingestion, checkpoint/replay/divergence handling, transactional warning outbox, bounded controller fanout, encrypted double-opt-in email/Telegram pairing, retry and visible delivery uncertainty are implemented. Nine focused backend checks passed against owned disposable PostgreSQL, including an owned loopback receipt fixture. UI checks use owned API/provider doubles; there have been no real-recipient test sends or chain transactions.
Independent auth/security/deployment review identified and drove fixes for proxy admission, connection starvation, lease/retry ambiguity, worker session-forgery privileges, activation filtering, cross-profile email floods and untrusted-event checkpoint poisoning. Final source/UI/live review remains in progress. Coolify's dedicated portal PostgreSQL resource is now running; API/static/worker release and exact live migration/source/worker/backup receipts remain pending. No feature or production acceptance is inferred from source or database startup.
No deployed security-v1 token/controller identities exist per the contract lead, so live chain coverage and signing remain unavailable until verified deployment configuration is supplied. Notification provider credentials are absent, gating those channels only. Issues #1–#4 stay open for their unverified acceptance. Research followups #6/#7 are separate future scope.
Verified scoped deployment is live at https://security.cl8y.com. Source PR #5 and deployment-recipe/receipt PR #8 are merged to main; checkout
/home/answorld/repos/cl8y-wallet-securitywas fast-forwarded without overwriting changes.Actual workload source:
e44569e45b15dbee4b0347dff742f92bd85bedb2. Immutable OCI manifest:sha256:07b476118ac7ca8a8af9653471026d02c0e615ace174231bd50aea06392b607e; tested config digest:sha256:556024673401ce7337c00ab54a40230abc6e1ffe45d03a41af27eb1ea7c772d9. Separately reviewed runtime hook:b8aa303154b25d3017816c258b0daeb8954b7b26; it selects the deployment's unique private PostgreSQL hostname and preserves credentials, volumes and trust. Immutable tags preserve both source references. Current main also contains post-release operator recipe/receipts; the running artifact remains pinned.Actual evidence: TLS health 200 with matching source and migration 5; advancing matching worker; all 16 live owned-wallet checks passed (signed login, one-use replay rejection, independent second wallet, dual-consent >=24h assignment, cancellation, secure cookie/logout); all 13 exact-image persistence/privilege/owned-restore checks passed. Independent reviewer verified source, HTTPS/redirect/security headers, one authorized invalid forwarded-header negative probe, source/migration/heartbeat, runtime UID/credential/DDL boundaries, private networking and backup/restore. No real-recipient messages or chain transactions were sent.
Public receipts: live, storage.
Full production acceptance remains OPEN; issues #1–#4 are not closed by source merge or this deployment:
thr_n4vtxxfcb7/coordinatorthr_4rw76j9kerown that dependency; UI ownerthr_yc2yevrgcwowns subsequent real-chain/wallet acceptance. Live defaults are never invented.thr_ywz2dcyd3p, provider PR #9. Authorized scoped Mailu enrollment was found and completed in disabled/test-restricted state, so email is pending adapter/gateway/review/owned proof rather than falsely called unavailable. Fresh review is on hold for durable retry-window aging across pending/blocked states; fixing before activation. Independent Telegram bot registration/token capability remains to be established; unrelated polling bots are not reused. Current delivery readiness is false and no real sends are claimed.thr_tj2burwn8bis continuing authorized scoped enrollment/inventory/restore proof. Live local backup/scratch restore passed; off-host recovery has not been invented.Independent reviewer
thr_rbd98geiraremains assigned for fresh provider/deployment increments. No human approval, reading, monitoring or credential handoff is requested; all remaining technical work has explicit active agent ownership.November 1 continuation completed all independently available rollout work. The original failed workers were reconciled/read-only; replacement workers handled scoped implementation and independent review without duplicate mutations.
Portal https://security.cl8y.com is healthy at workload source4fbe039/schema6. Production email is enabled after exactly3 owned opt-in/verification/timer/contact-removal messages passed. The temporary receiver is disabled and its token revoked; the scoped normal sender remains enabled. API/PG are outside the notification network; only the nonroot worker has its SMTP credential and internal fixed-gateway route. Tests sent no messages to unrelated recipients and made no chain transactions.
Encrypted offhost upload/readback/anonymous-denial and fresh-vault offline restore are verified for current schema5 and post-trial schema6. The latter preserves3 SMTP sent/first-attempt rows, full timer/contact/event/outbox metadata and owned-profile active sessions0; scratch auth is invalidated and all scratch/helpers/listeners removed. Source publication is merged through PR16, PR19, PR20 and PR21; current main66f26d2. Runtime receipt, schema6 restore.
Daily native script automation auto_cqn_6q-vhlg is enabled at03:20UTC with a10-minute cap and frozen controller/hash checks. Both the native manual proof and first actual scheduled run succeeded; the scheduled run arun_hdhbo8t7oq4 exited0 with verified ciphertext48899c03... and durable readbackv7. This is conditional on the operator/BB host, VPN and credential availability; WG is active but its boot unit remains disabled (noninteractive enable was denied). Reboot-safe availability and <=24-hour RPO are not claimed; documented source-point phase drift can reach49h plus outage. Failure messages go to the existing agent owner with rate limiting, not a human monitoring assignment. Automation evidence.
Issue remains open for its exact remaining availability/production gates. The independent Telegram identity/token and on-chain governance/signing/protocol transition are separate gates; token protection coverage remains0/35. No extra broad tests or new provider messages are warranted for unchanged accepted components.