DorianandClaude Fable 5
877d1f6389
CI / check (push) Failing after 6m10s
1. server/src/app.ts: CSP img-src only allowed 'self'/data:/blob: — nostr profile pictures come from kind:0 metadata, a URL the user sets via their own client, hosted on whatever domain they picked. There's no central image host for a decentralized identity system, so every external profile pic was CSP-blocked and rendered as a broken image. Added https: (broad) — safe here since images can't execute script even from an untrusted origin, unlike script-src which stays locked to 'self'. 2. frontend/src/pages/JoinBoutPage.vue: the new AI-answer option (1.2.7) was reported as invisible — it was gated behind picking POLLING (not the default WEBHOOK) AND behind a collapsed toggle within that. Changed: POLLING is now the default mode (also the documented default in BOTFIGHTS.md), the AI section is expanded by default instead of collapsed, and the POLLING button's own description now mentions the option so it's visible without any extra click. 3. docker-compose.arena.yml: image tag 1.2.1 -> 1.2.7, matching what's actually deployed on the canonical arena (rolled live via ssh+docker compose pull/up this session — this commit just brings the repo's copy of the compose file back in sync with reality). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
64 lines
3.0 KiB
YAML
64 lines
3.0 KiB
YAML
# docker-compose.arena.yml — the CANONICAL public BotFights arena
|
|
#
|
|
# This is the counterpart to docker-compose.yml (the local/dev stack). It runs
|
|
# ONLY the published registry image (no `build:` section — the arena runs exactly
|
|
# what nodes run, never a locally-built variant), with payments deliberately
|
|
# unconfigured and no reverse proxy in front (direct exposure on :9100, so the
|
|
# app's own rate limiter must see the real socket peer IP — see TRUSTED_PROXY note
|
|
# below).
|
|
#
|
|
# Deploy notes live in docs/arena-deployment.md — this file has no secrets. The
|
|
# JWT_SECRET value is generated on the host into /opt/botfights-arena/.env (0600,
|
|
# never committed).
|
|
#
|
|
# Arena-as-relay: this compose file is not special — it is the SAME image any
|
|
# node can run standalone (no ARENA_UPSTREAM_URL) to host its own public arena.
|
|
# The Foundation's VPS2 instance below is just the well-known default rendezvous,
|
|
# not a hardcoded authority. See docs/arena-deployment.md "Hosting your own arena".
|
|
|
|
services:
|
|
botfights-arena:
|
|
image: localhost:3000/lfg2025/botfights:1.2.7
|
|
container_name: botfights-arena
|
|
restart: unless-stopped
|
|
ports:
|
|
- "9100:9100"
|
|
volumes:
|
|
- botfights-arena-data:/app/server/data
|
|
# Explicit override (not just relying on the image's baked-in HEALTHCHECK):
|
|
# the currently published 1.1.0 tag predated the Dockerfile's HEALTHCHECK
|
|
# directive; kept for continuity across image rolls.
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://localhost:9100/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 10s
|
|
retries: 3
|
|
environment:
|
|
- NODE_ENV=production
|
|
- PORT=9100
|
|
- FIGHT_LOOP_ENABLED=true
|
|
- PUBLIC_ARENA_URL=https://botfights.archipelago-foundation.org
|
|
# TRUSTED_PROXY=1 since 2026-07-30: the arena now sits behind
|
|
# nginx-proxy-manager at https://botfights.archipelago-foundation.org
|
|
# (Let's Encrypt cert, live). The app trusts X-Forwarded-For from NPM
|
|
# for its per-IP rate limiting instead of the raw socket peer (which
|
|
# would otherwise see every request as coming from NPM's own IP).
|
|
- TRUSTED_PROXY=1
|
|
# Auth — value comes from the host .env, never hardcoded here.
|
|
# Generated on VPS2 with: openssl rand -hex 32 (see docs/arena-deployment.md)
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- BOTFIGHTS_CREATOR_PUBKEYS=${BOTFIGHTS_CREATOR_PUBKEYS:-da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39}
|
|
# Deliberately OMITTED: this instance IS the upstream — never point it at
|
|
# another arena.
|
|
# - ARENA_UPSTREAM_URL=
|
|
# ── Payments are OUT OF SCOPE for this deployment (phase 09 CONTEXT.md
|
|
# scope fence: "OUT: Lightning/cashu payment changes"). Do not set:
|
|
# - BOTFIGHTS_WALLET_ENCRYPTION_KEY=
|
|
# - BOTFIGHTS_NWC_URL=
|
|
# - BOTFIGHTS_CASHU_MINT_URL=
|
|
# - BOTFIGHTS_DEV_PAYOUT_LNADDRESS=
|
|
|
|
volumes:
|
|
botfights-arena-data:
|