localStorage seeding via injected classic script on the proxied origin (applesauce-accounts nsec account)
created
modified
neode-ui/docker/indee-demo-signin.js
neode-ui/docker/nginx-demo.conf
neode-ui/Dockerfile.web
docker-compose.demo.yml
demo-deploy/docker-compose.yml
neode-ui/src/composables/useDemoIntro.ts
neode-ui/src/views/appSession/useAppIdentity.ts
neode-ui/mock-backend.js
Primary sign-in path used (seeded nsec account, self-signing) — NIP-07 bridge fallback NOT needed; verified against the live bundle
Dropped `sub_filter_types text/html` (text/html is nginx's default sub_filter type; explicit listing produced a duplicate-MIME warning)
duration
completed
~50 min
2026-07-29
complete
Quick Task 260729-gjd: IndeeHub in the Demo Summary
One-liner: Whole-origin nginx proxy of indee.tx1138.com on :2101 with an injected throwaway-nsec sign-in seeder, demo iframe launch via same-host :2101, and IndeeHub pre-installed in every fresh mock-backend session.
mock-backend.js staticDevApps gains indeedhub (running, lanPort 8190) → installed on every fresh session
What was verified at exec time (live-bundle facts)
Live site still serves X-Frame-Options: SAMEORIGIN, no CSP; bundle assets/index-BMWtjRCn.js.
Account serialization confirmed by de-minifying the live bundle: private-key account class has static type="nsec", toJSON → { signer: { key: <hex sk> }, id, pubkey, metadata, type }; the manager registers the nsec type (MM(Fe) registers mr) and restores from indeedhub-accounts + activates by id from indeedhub-active-account. Vn/je confirmed hex decode/encode.
Pubkey math independently validated against BIP340 test vectors (sk=1 → Gx, sk=3 → F9308A01…) before embedding the generated pair. Mismatch would trigger the bundle's "Account signer mismatch" guard, so this was load-bearing.
Throwaway demo identity
Freshly generated 2026-07-29 for this task (generator ran in scratchpad, not committed):
sk embedded in neode-ui/docker/indee-demo-signin.js, clearly labelled PUBLIC-DEMO-ONLY / not a secret (threat T-gjd-01: accepted by design). Never a real user key.
Local verification results
nginx parse:nginx -t clean in nginx:alpine (podman, with --add-host neode-backend:127.0.0.1 to satisfy the pre-existing upstream reference).
Live proxy smoke (podman, config + seeder mounted):curl through :2101 → 200, no X-Frame-Options / CSP, injected <script src="/__demo/indee-demo-signin.js"> present in HTML, seed script served same-origin, hashed asset /assets/index-BMWtjRCn.js proxied 200.
Unit tests: 195/195 green (src/views/appSession + src/stores), running with IS_DEMO=false — non-demo path exercised.
Demo build:VITE_DEMO=1 npm run build succeeded; bundle (web/dist/neode-ui/assets/index-ChDwfLt5.js) contains the 2101 launch logic. This is exactly what Dockerfile.web builds (ARG VITE_DEMO=1 default).
Mock backend: boots with DEMO=1; /ws/db initial dump of a fresh session contains indeedhub with state=running, ui=true, lan http://localhost:8190.
No IP leaks: none of the changed files contain the private release-server IP; pre-existing occurrences in dist (catalog.json/marketplace data) are scrubbed+gated by the existing Dockerfile.web guard.
Submodule guard: ran before all three commits; nothing under indeedhub/ ever staged. No file deletions in any commit.
Deviations from Plan
1. [Minor] Dropped sub_filter_types text/html from the :2101 block
Found during: Task 1 nginx parse check
Issue: nginx warns duplicate MIME type "text/html" — text/html is sub_filter's built-in default type
Fix: removed the redundant directive (identical behavior), noted in a comment
2. [Environment] Plain (non-demo) build + vue-tsc typecheck could not be run — permission denied
Three attempts (npm run build, vite build --outDir <scratch>, vue-tsc --noEmit) were denied by the permission system mid-execution.
Proxy coverage: 195 unit tests ran and passed under IS_DEMO=false (compiles + non-demo runtime behavior), and the demo build compiled the same source. All changed TS is IS_DEMO-gated with types unchanged at call sites.
Residual risk: low; a plain npm run build before the next real-node frontend ship will confirm (it runs vue-tsc).
3. [Flag] web/dist/neode-ui/ currently holds a VITE_DEMO=1 bundle
The demo verification build overwrote the (gitignored) web/dist/neode-ui output. Rebuild with a plain npm run build before any real-node frontend deploy/ISO/OTA that rsyncs web/dist — do not ship the demo bundle to real nodes.
Fallback status
The plan's fallback (extension-type account + window.nostr postMessage shim + mock signer) was not needed — the primary seeded-nsec path matches the live bundle's restore contract exactly. If post-deploy testing shows a login wall anyway, the fallback is fully documented in the PLAN (Task 1 action block).
Post-deploy checklist for orchestrator (vps2, after demo image rebuild + redeploy)
curl -sI http://146.59.87.168:2101/ → 200, NO X-Frame-Options; curl -s http://146.59.87.168:2101/ | grep indee-demo-signin → hit. If unreachable: open port 2101 in the vps2 firewall (new requirement of this change).
Fresh private window → http://146.59.87.168:2100 → login entertoexit → IndeeHub shows installed/running in My Apps with no install step.
Launch IndeeHub → renders inside the in-app iframe session (not a new tab), content browsable, no identity-picker modal.
Signed-in check: IndeeHub header shows an active account (avatar/profile, not a sign-in button). Note: the throwaway key has no published kind-0 profile, so expect a default avatar/truncated npub rather than a named profile — that still counts as signed in. If a login wall appears, execute the documented fallback and redeploy.
Spot-check served responses for the private release-server IP (should be none; build guard enforces).
Reload the iframe once — sign-in must persist (localStorage already seeded even if a service worker serves cached HTML without the injected tag).
Reminder: the demo-deploy thin stack now publishes ${DEMO_INDEE_PORT:-2101}:2101 — the public archy-demo repo copy of that compose file needs syncing when the images ship.
Self-Check: PASSED
neode-ui/docker/indee-demo-signin.js — FOUND
neode-ui/docker/nginx-demo.conf :2101 block — FOUND
