nvrl
7f8d625a8d
A `!` now means force or everything and nothing else (`:w!`, `:search!`, `:export!`, `:logout!`). A command that did a second thing behind its bang takes a word for it instead: `:space new|name|rm`, `:list name|rm`, `:task [add]|edit`, `:upload seal`, `:import zip [/]`. `:card` while reading a document makes a card about it, so `:card!` is gone. Merged: `:export` downloads what has focus, a file as it is or a document as markdown (`:download` folded in); `:share [off|new]` replaces `:unshare` and `:link`, and the list's `s` and `y` give way to it and the info sheet; `:noh` replaces `:clear`; `:vault [unlock|lock|passwd]` replaces `:unlock`, `:lock` and `:passwd`; Esc in the list puts down what `m` picked up before it closes the document, replacing `:unmark`. The old spellings run as their new lines for one release through a table in commands.ts; help and Tab leave them out, and the wiki lists them. A settings sheet (`,` or `:settings`) holds the options, the vault, the backup, the signed-in browsers, ssh keys and capture tokens. Each row runs the command a line would. Bare `:set`, `:vault`, `:backup`, `:sessions`, `:sshkey` and `:token` open it at their part. `?` shows the keys and commands to start with, flagged in the keymap and the command table; a second `?` (or `:help all`) shows all of them, and a filter always searches all of them. Help rows are keyed by key and description, as two contexts can share a label.
2.4 KiB
Deploying
The workspace is one binary with the frontend inside, and one data directory. It needs no database server and no runtime on the host.
On a server
- Build it:
make buildmakestarget/release/narl-workspace. - Copy the binary and a
.envto the server. SetWORKSPACE_USER,WORKSPACE_PASSWORDandWORKSPACE_SECRET; the server will not start with the examples from.env.example. - Put a reverse proxy that terminates TLS in front of
WORKSPACE_BIND, and setWORKSPACE_SECURE_COOKIE=1. - Keep
WORKSPACE_DATA_DIRsafe. It is the whole state: the database and the uploads.
The proxy must:
- pass the
Hostheader through unchanged, because a write that a browser says came from another origin is refused; - allow request bodies as large as
WORKSPACE_MAX_UPLOAD_MB; - not weaken the security headers the app sends (
Content-Security-Policy,Referrer-Policy: no-referrerand the rest).
GET /api/health answers without a login, for a supervisor. SIGTERM gives
requests in flight eight seconds to finish.
Docker
cp .env.example .env # set WORKSPACE_USER, WORKSPACE_PASSWORD, WORKSPACE_SECRET
docker compose up -d --build
The image builds the frontend with bun and the binary with cargo, then ships
only the binary on debian:trixie-slim, running as an unprivileged user. The
database and uploads live in the diary-data volume. Keep
COMPOSE_PROJECT_NAME=narl-diary if you rename the directory, or compose looks
for the volume under a new name and finds an empty one.
The port is published on 127.0.0.1:4242 only. To serve it through traefik,
copy compose.override.yml.example to compose.override.yml and set the host.
It joins the external narl network, drops the published port, and sets
WORKSPACE_SECURE_COOKIE=1.
Sessions and security
- Every signed-in browser is a row on the server.
:sessionslists them in the settings sheet (,),:sessions rm <n>signs one out and locks the vault, and:logout!signs out every one. - Changing
WORKSPACE_SECRETorWORKSPACE_PASSWORDalso signs everyone out. - Wrong passwords are answered more slowly each time, up to 30 seconds. A browser that has logged in before is slowed only by its own mistakes.
- With
WORKSPACE_SECURE_COOKIE=1the cookie isSecureand__Host-prefixed, and every answer carries HSTS for a year. - Uploads are only served as types that cannot run in the browser.
See Configuration for every setting.