Worph
39f82e1f96
23 apps (MetaCore, the library/network/client tiers and 13 MetaFeeder*) move out of the general-purpose Worph/AppStore into their own store so the MetaMesh family releases on its own cadence. - asset URLs repointed to cdn.jsdelivr.net/gh/Worph/MetaAppStore@main - store scaffolding added (category/recommend/featured lists, licence, contributing, gitattributes) - psd-source/meta-icons-v2 icon generator follows the apps MetaMCP stays in Worph/AppStore: it is third-party metatool-ai software, not part of MetaMesh.
65 lines
3.6 KiB
Markdown
65 lines
3.6 KiB
Markdown
# MetaFeeder · Usenet — Rationale
|
|
|
|
## What deviation / exception is being requested
|
|
|
|
1. `metafeederusenet-feeder` runs `user: 0:0`.
|
|
2. The **NNTmux web UI is published on its own hostname**
|
|
(`metafeederusenetnntmux-<user>.<domain>`) with no AppShield sidecar in front of it — it
|
|
is protected by NNTmux's own login only.
|
|
3. The seeded `nntmux.env` contains TMDB and TVDB API keys as literals.
|
|
|
|
## Why it is necessary
|
|
|
|
1. The feeder publishes resolved records to the shared MetaCore and writes plugin artwork
|
|
through its WebDAV endpoint; those targets are created and owned by MetaCore's
|
|
root-running container.
|
|
2. NNTmux is a Laravel application with its own user table, session handling and admin
|
|
role. Its admin account is created at install from `$APP_DEFAULT_PASSWORD`, so
|
|
authentication is **enabled by default** — the "app's own built-in auth" alternative the
|
|
security checklist accepts. Fronting it with AppShield as well would double-prompt on
|
|
every page and breaks its own OTP and password-reset flows.
|
|
3. Those two keys are NNTmux's upstream project defaults, shipped in its own
|
|
`.env.example`. They are shared read-only application keys for public metadata catalogs,
|
|
not user credentials, and they are what makes the app work immediately after
|
|
installation with no manual configuration. An operator can replace them from the NNTmux
|
|
admin UI.
|
|
|
|
## Security mitigations in place
|
|
|
|
- The NNTmux admin password is `$APP_DEFAULT_PASSWORD` — the platform-generated secret —
|
|
and the database password comes from the same variable. Neither is a hardcoded literal,
|
|
and both are surfaced to the user in `tips.before_install`.
|
|
- The feeder's own configuration UI *is* behind AppShield + Authelia SSO
|
|
(`ghcr.io/yundera/appshield:2.0.9`).
|
|
- `metafeederusenet-db`, `-redis` and `-manticore` are on the app-private
|
|
`metafeederusenet` bridge network, carry no Caddy labels and publish no host port, so no
|
|
sibling app on the shared `pcs` network can resolve or dial them.
|
|
- NNTP provider credentials are deliberately left **blank** in the seed; the user fills
|
|
them in per `tips.before_install`. Nothing ships with a working news account.
|
|
- The `nntmux.env` seed is guarded by `[ ! -f … ]`, so a reinstall or version upgrade never
|
|
overwrites the operator's provider settings. `scanner.sh` is intentionally rewritten on
|
|
every run — it is shipped code, not operator config, so a store update must be able to
|
|
replace a stale copy; the write is idempotent.
|
|
- No user directories are mounted. All binds are under `/DATA/AppData/metafeederusenet/`,
|
|
declared in `x-compose-app.folders`.
|
|
- `cpu_shares` on all nine services; every image pinned (the NNTmux and Manticore images by
|
|
digest).
|
|
|
|
## Alternatives considered and rejected
|
|
|
|
- **AppShield in front of NNTmux.** Two independent login gates on one UI; its OTP,
|
|
password-reset and API endpoints break behind the OIDC redirect.
|
|
- **Blank the TMDB/TVDB keys.** The app then installs into a state where covers and
|
|
metadata silently fail until the user finds two upstream registration flows — a direct
|
|
violation of "works immediately after installation, no manual configuration required for
|
|
basic functionality".
|
|
- **Run the feeder as `$PUID:$PGID`.** Writes into MetaCore's root-owned tree fail.
|
|
|
|
## Data protection
|
|
|
|
All state — MariaDB, the NZB store, the feeder cursor, the TMDB cache — is under
|
|
`/DATA/AppData/metafeederusenet/`, the unit Maison archives on uninstall and restores from
|
|
backup, so an uninstall/reinstall with "keep user data" comes back with the release
|
|
catalogue intact rather than re-scanning Usenet from scratch. No user media directory is
|
|
mounted into any service.
|