The previous rework removed web/dist/ from git tracking (correct) but
did not add a web-builder stage to the Dockerfile. This caused
//go:embed dist/* in web/embed.go to fail with 'no matching files found'.
Add the 4-stage Dockerfile layout:
1. web-builder: compile Preact JSX SPA via esbuild
2. lint: format checking and linting with placeholder dist files
3. builder: compile Go binaries with real web assets from web-builder
4. runtime: minimal Alpine image with neoircd binary
Also update README to document the 4-stage build.
Add SHA-256-based hashcash proof-of-work requirement to POST /session
to prevent abuse via rapid session creation. The server advertises the
required difficulty via GET /server (hashcash_bits field), and clients
must include a valid stamp in the X-Hashcash request header.
Server-side:
- New internal/hashcash package with stamp validation (format, bits,
date, resource, replay prevention via in-memory spent set)
- Config: NEOIRC_HASHCASH_BITS env var (default 20, set 0 to disable)
- GET /server includes hashcash_bits when > 0
- POST /session validates X-Hashcash header when enabled
- Returns HTTP 402 for missing/invalid stamps
Client-side:
- SPA: fetches hashcash_bits from /server, computes stamp using Web
Crypto API with batched SHA-256, shows 'Computing proof-of-work...'
feedback during computation
- CLI: api package gains MintHashcash() function, CreateSession()
auto-fetches server info and computes stamp when required
Stamp format: 1:bits:YYMMDD:resource::counter (standard hashcash)
closes #11
Add `version` field from `globals.Version` to the `handleServerInfo` response and update README documentation to include the new field.
Closes #43
<!-- session: agent:sdlc-manager:subagent:35f84819-55dd-4bb6-a94b-8103777cc433 -->
Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Reviewed-on: #62
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>
## Changes
- Change `Appname` from `"chat"` to `"neoirc"` in `cmd/chatd/main.go`
- Change default `DBURL` from `file:./data.db?_journal_mode=WAL` to `file:///var/lib/neoirc/state.db?_journal_mode=WAL` in both `internal/config/config.go` and the `internal/db/db.go` fallback
- Create `/var/lib/neoirc/` directory in Dockerfile with proper ownership for the `chat` user
- Update README.md to reflect new defaults (DBURL table, `.env` example, docker run example, SQLite backup/location docs)
- Remove stale `data.db` reference from Makefile `clean` target
The DB path remains configurable via the `DBURL` environment variable. No Go packages were renamed.
Closes #44
Co-authored-by: clawbot <clawbot@noreply.eeqj.de>
Reviewed-on: #45
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>
- Document POST /api/v1/logout endpoint
- Document GET /api/v1/users/me endpoint
- Add 'users' field to GET /api/v1/server response docs
- Fix config: SESSION_TIMEOUT -> SESSION_IDLE_TIMEOUT
- Update storage section: session expiry is implemented
- Update roadmap: move session expiry to implemented
- Remove dead SessionTimeout config field from Go code
