Repository navigation
Prepare the template for a public demo - #157
Merged
Merged
Conversation
The template now runs as a public demo. Its server IP lives in config/deploy.demo.yml and .kamal/secrets.demo, which are gitignored so the origin behind Cloudflare stays out of this public repo and out of generated apps. AGENTS.md no longer says the repo is never deployed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yY6PzRNWo8SrwyPeja5xZ
A public demo lets anyone make the app send mail. Password reset and confirmation resend were limited only by the global 300 requests per 5 minutes per IP, and invitations not at all, so a stranger's inbox could be flooded and the sending domain's reputation would pay for it. Password reset and confirmation resend now allow 5 per minute per IP and 3 per hour per address; invitation create + resend allow 20 per hour per shopkeeper. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yY6PzRNWo8SrwyPeja5xZ
dadachi
changed the title
Anyone can sign up on the public demo, so its data would only grow and keep strangers' email addresses forever. PurgeInactiveDemoShopkeepersJob deletes shopkeepers whose last sign-in (or sign-up, if they never signed in) is older than DEMO_PURGE_INACTIVE_DAYS, with their owned accounts. The variable is set only in the gitignored config/deploy.demo.yml. Unset, the job does nothing, and a test keeps it out of the committed deploy.yml so generated apps never delete their real users. With 30 days nobody still using the app is deleted: tokens expire 30 days after sign-in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yY6PzRNWo8SrwyPeja5xZ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
api.nativeapptemplate.com, deployed withbin/kamal deploy -d demo.config/deploy.demo.ymlwith the real server IP,.kamal/secrets.demoas a symlink tosecrets) are gitignored, so the origin behind Cloudflare stays out of this public repo and out of generated apps.deploy.ymlkeeps the192.168.0.1placeholder.ThrottleMailRequests), invitation create + resend 20/hour per shopkeeper. Before, a public demo would let anyone flood a stranger's inbox through the sending domain.PurgeInactiveDemoShopkeepersJob(daily) deletes shopkeepers inactive forDEMO_PURGE_INACTIVE_DAYSdays with their owned accounts. The variable lives only indeploy.demo.yml(demo: 30, matching the 30-day token lifespan); unset, the job is a no-op, and a test keeps it out of the committeddeploy.yml.Test plan
demo destination files stay out of gittest fails before the.gitignorechange, passes afterbin/kamal config -d demomerges the demo IP over the placeholder;Kamal::Secrets.new(destination: "demo")resolves through the symlinktest/integration/mail_throttle_test.rb(5 tests) fails before the limits (mail enqueued), passes afterKamal::Configurationwith-d demomergesDEMO_PURGE_INACTIVE_DAYSwhile keeping the base envbin/rubocop,bin/brakeman,bin/rails test(635 runs, 0 failures)🤖 Generated with Claude Code
https://claude.ai/code/session_012yY6PzRNWo8SrwyPeja5xZ