---
phase: quick-260729-gjd
plan: 01
subsystem: public-demo
tags: [demo, indeedhub, nginx, reverse-proxy, nostr, mock-backend]
requires: []
provides:
  - "IndeeHub whole-origin demo proxy on :2101 (framing headers stripped, sign-in seeded)"
  - "Demo iframe launch of indeedhub via demoAppUrl → <host>:2101/"
  - "IndeeHub pre-installed/running on every fresh demo session"
affects: [demo-deploy, neode-ui demo image]
tech-stack:
  added: []
  patterns:
    - "Whole-origin per-port reverse proxy for frame-busting external SPAs (vs broken path-prefix sub_filter)"
    - "localStorage seeding via injected classic script on the proxied origin (applesauce-accounts nsec account)"
key-files:
  created:
    - neode-ui/docker/indee-demo-signin.js
  modified:
    - neode-ui/docker/nginx-demo.conf
    - neode-ui/Dockerfile.web
    - docker-compose.demo.yml
    - demo-deploy/docker-compose.yml
    - neode-ui/src/composables/useDemoIntro.ts
    - neode-ui/src/views/appSession/useAppIdentity.ts
    - neode-ui/mock-backend.js
decisions:
  - "Primary sign-in path used (seeded nsec account, self-signing) — NIP-07 bridge fallback NOT needed; verified against the live bundle"
  - "Dropped `sub_filter_types text/html` (text/html is nginx's default sub_filter type; explicit listing produced a duplicate-MIME warning)"
metrics:
  duration: "~50 min"
  completed: 2026-07-29
status: complete
---

# Quick Task 260729-gjd: IndeeHub in the Demo Summary

**One-liner:** Whole-origin nginx proxy of indee.tx1138.com on :2101 with an injected throwaway-nsec sign-in seeder, demo iframe launch via same-host :2101, and IndeeHub pre-installed in every fresh mock-backend session.

## Commits

| Task | Commit | Scope |
|------|--------|-------|
| 1 | 69bc3d3f | nginx :2101 whole-origin proxy + indee-demo-signin.js seeder + Dockerfile.web COPY/EXPOSE + both compose files publish 2101 |
| 2 | 66d540f8 | useDemoIntro: DEMO_EXTERNAL_URLS → DEMO_PROXY_PORTS, demoAppUrl builds `<protocol>//<hostname>:2101/`; useAppIdentity: picker suppressed under IS_DEMO |
| 3 | d00ca624 | mock-backend.js staticDevApps gains indeedhub (running, lanPort 8190) → installed on every fresh session |

## What was verified at exec time (live-bundle facts)

- Live site still serves `X-Frame-Options: SAMEORIGIN`, no CSP; bundle `assets/index-BMWtjRCn.js`.
- Account serialization confirmed by de-minifying the live bundle: private-key account class has `static type="nsec"`, `toJSON` → `{ signer: { key: <hex sk> }, id, pubkey, metadata, type }`; the manager registers the nsec type (`MM(Fe)` registers `mr`) and restores from `indeedhub-accounts` + activates by id from `indeedhub-active-account`. `Vn`/`je` confirmed hex decode/encode.
- Pubkey math independently validated against BIP340 test vectors (sk=1 → Gx, sk=3 → F9308A01…) before embedding the generated pair. Mismatch would trigger the bundle's "Account signer mismatch" guard, so this was load-bearing.

## Throwaway demo identity

Freshly generated 2026-07-29 for this task (generator ran in scratchpad, not committed):
- pk `7261540160244ec65ce0bf86ba03997e9b1b3b35c277e416bf1c7ba4271fee31`
- sk embedded in `neode-ui/docker/indee-demo-signin.js`, clearly labelled PUBLIC-DEMO-ONLY / not a secret (threat T-gjd-01: accepted by design). Never a real user key.

## Local verification results

1. **nginx parse:** `nginx -t` clean in `nginx:alpine` (podman, with `--add-host neode-backend:127.0.0.1` to satisfy the pre-existing upstream reference).
2. **Live proxy smoke (podman, config + seeder mounted):** `curl` through :2101 → 200, **no X-Frame-Options / CSP**, injected `<script src="/__demo/indee-demo-signin.js">` present in HTML, seed script served same-origin, hashed asset `/assets/index-BMWtjRCn.js` proxied 200.
3. **Unit tests:** 195/195 green (`src/views/appSession` + `src/stores`), running with IS_DEMO=false — non-demo path exercised.
4. **Demo build:** `VITE_DEMO=1 npm run build` succeeded; bundle (`web/dist/neode-ui/assets/index-ChDwfLt5.js`) contains the 2101 launch logic. This is exactly what Dockerfile.web builds (ARG VITE_DEMO=1 default).
5. **Mock backend:** boots with DEMO=1; `/ws/db` initial dump of a fresh session contains `indeedhub` with `state=running`, ui=true, lan `http://localhost:8190`.
6. **No IP leaks:** none of the changed files contain the private release-server IP; pre-existing occurrences in dist (catalog.json/marketplace data) are scrubbed+gated by the existing Dockerfile.web guard.
7. **Submodule guard:** ran before all three commits; nothing under `indeedhub/` ever staged. No file deletions in any commit.

## Deviations from Plan

**1. [Minor] Dropped `sub_filter_types text/html` from the :2101 block**
- **Found during:** Task 1 nginx parse check
- **Issue:** nginx warns `duplicate MIME type "text/html"` — text/html is sub_filter's built-in default type
- **Fix:** removed the redundant directive (identical behavior), noted in a comment
- **Commit:** 69bc3d3f

**2. [Environment] Plain (non-demo) build + vue-tsc typecheck could not be run — permission denied**
- Three attempts (`npm run build`, `vite build --outDir <scratch>`, `vue-tsc --noEmit`) were denied by the permission system mid-execution.
- **Proxy coverage:** 195 unit tests ran and passed under IS_DEMO=false (compiles + non-demo runtime behavior), and the demo build compiled the same source. All changed TS is IS_DEMO-gated with types unchanged at call sites.
- **Residual risk:** low; a plain `npm run build` before the next real-node frontend ship will confirm (it runs vue-tsc).

**3. [Flag] `web/dist/neode-ui/` currently holds a VITE_DEMO=1 bundle**
- The demo verification build overwrote the (gitignored) `web/dist/neode-ui` output. **Rebuild with a plain `npm run build` before any real-node frontend deploy/ISO/OTA that rsyncs `web/dist`** — do not ship the demo bundle to real nodes.

## Fallback status

The plan's fallback (extension-type account + window.nostr postMessage shim + mock signer) was **not needed** — the primary seeded-nsec path matches the live bundle's restore contract exactly. If post-deploy testing shows a login wall anyway, the fallback is fully documented in the PLAN (Task 1 action block).

## Post-deploy checklist for orchestrator (vps2, after demo image rebuild + redeploy)

1. `curl -sI http://146.59.87.168:2101/` → 200, NO `X-Frame-Options`; `curl -s http://146.59.87.168:2101/ | grep indee-demo-signin` → hit. **If unreachable: open port 2101 in the vps2 firewall** (new requirement of this change).
2. Fresh private window → `http://146.59.87.168:2100` → login `entertoexit` → IndeeHub shows installed/running in My Apps with no install step.
3. Launch IndeeHub → renders inside the in-app iframe session (not a new tab), content browsable, **no identity-picker modal**.
4. Signed-in check: IndeeHub header shows an active account (avatar/profile, not a sign-in button). Note: the throwaway key has no published kind-0 profile, so expect a default avatar/truncated npub rather than a named profile — that still counts as signed in. If a login wall appears, execute the documented fallback and redeploy.
5. Spot-check served responses for the private release-server IP (should be none; build guard enforces).
6. Reload the iframe once — sign-in must persist (localStorage already seeded even if a service worker serves cached HTML without the injected tag).
7. Reminder: the `demo-deploy` thin stack now publishes `${DEMO_INDEE_PORT:-2101}:2101` — the public archy-demo repo copy of that compose file needs syncing when the images ship.

## Self-Check: PASSED

- neode-ui/docker/indee-demo-signin.js — FOUND
- neode-ui/docker/nginx-demo.conf :2101 block — FOUND
- Commits 69bc3d3f, 66d540f8, d00ca624 — FOUND in git log
- No paths under indeedhub/ in any commit — VERIFIED
- SUMMARY frontmatter status: complete — SET