CI: push to ipcr-push-85-17-246-67.ip.nsl.sh (the box's cert no longer covers nip.io) [skip ci]

.gitea/workflows/publish.yml

@@ -2,10 +2,10 @@
 # folder exists, and GitHub never reads it.
 #
 # Publishes to IPCR on watch.nsl.sh instead of ghcr.io:
-#   push  ipcr-push-85-17-246-67.nip.io/metadec.eth/<repo>:<tag>   docker login as metadec.eth with the
+#   push  ipcr-push-85-17-246-67.ip.nsl.sh/metadec.eth/<repo>:<tag>   docker login as metadec.eth with the
 #         IPCR_PUSH_TOKEN secret (the metadec.eth namespace token from the IPCR dashboard)
 #   pull  ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/<repo>:<tag>   anonymous
-# The push goes to ipcr-push-85-17-246-67.nip.io, the box's own address, not ipcr-push-watch.nsl.sh: Cloudflare fronts
+# The push goes to ipcr-push-85-17-246-67.ip.nsl.sh, the box's own address, not ipcr-push-watch.nsl.sh: Cloudflare fronts
 # *.watch.nsl.sh and refuses any request over 100 MB (413), which a large image layer is.
 # That host's certificate is signed by the box's private Mesh Router CA, given to buildkit from
 # the IPCR_CA_PEM repo variable. docker login would make the job's Docker daemon check the
@@ -25,7 +25,7 @@ on:
       - 'v*'
 
 env:
-  REGISTRY: ipcr-push-85-17-246-67.nip.io
+  REGISTRY: ipcr-push-85-17-246-67.ip.nsl.sh
   IMAGE_NAME: metadec.eth/${{ github.event.repository.name }}
 
 jobs:
@@ -69,6 +69,9 @@ jobs:
           # v1.2.3 -> 1.2.3, 1.2, 1 ; plus a moving `latest` for the newest tag.
           tags: |
             type=semver,pattern={{version}}
+            # A fix to release 1.2.3 is tagged v1.2.3.1: four numbers are not semver, so
+            # the pattern above makes no tag for it; this one does (image tag 1.2.3.1).
+            type=match,pattern=v(\d+\.\d+\.\d+\.\d+),group=1
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
             type=ref,event=branch

.github/workflows/publish.yml

@@ -39,6 +39,9 @@ jobs:
           # v1.2.3 -> 1.2.3, 1.2, 1 ; plus a moving `latest` for the newest tag.
           tags: |
             type=semver,pattern={{version}}
+            # A fix to release 1.2.3 is tagged v1.2.3.1: four numbers are not semver, so
+            # the pattern above makes no tag for it; this one does (image tag 1.2.3.1).
+            type=match,pattern=v(\d+\.\d+\.\d+\.\d+),group=1
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
             type=raw,value=latest

Cargo.lock

@@ -1965,7 +1965,7 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 [[package]]
 name = "meta-feeder-sdk"
 version = "1.8.0"
-source = "git+https://github.com/worph/meta-feeder-sdk?tag=v1.8.0#612f2aed661925cd22d51b29564832991e246e4d"
+source = "git+https://gitea-watch.nsl.sh/metastar/meta-feeder-sdk?tag=v1.8.0#612f2aed661925cd22d51b29564832991e246e4d"
 dependencies = [
  "anyhow",
  "async-trait",

Cargo.toml

@@ -19,7 +19,7 @@ path = "src/main.rs"
 # The transport-plugin contract. Pinned by TAG, never by path — a path dep
 # resolves outside this repo, which is the Docker build context. See the
 # Dockerfile for building against an unreleased SDK.
-meta-feeder-sdk = { git = "https://github.com/worph/meta-feeder-sdk", tag = "v1.8.0", features = ["transport"] }
+meta-feeder-sdk = { git = "https://gitea-watch.nsl.sh/metastar/meta-feeder-sdk", tag = "v1.8.0", features = ["transport"] }
 
 # libp2p — transport only: identify (address exchange, load-bearing for bitswap
 # reachability), kad (DHT provider records), mdns (LAN discovery) + bitswap.
@@ -56,7 +56,7 @@ multihash-codetable = { version = "0.1", features = ["sha2", "sha3"] }
 
 [dev-dependencies]
 tempfile = "3"
-meta-feeder-sdk = { git = "https://github.com/worph/meta-feeder-sdk", tag = "v1.8.0", features = ["testkit"] }
+meta-feeder-sdk = { git = "https://gitea-watch.nsl.sh/metastar/meta-feeder-sdk", tag = "v1.8.0", features = ["testkit"] }
 
 # ---------------------------------------------------------------------------
 # Workaround for the yanked transitive `core2` (all versions). `multihash-

src/resolve.rs

@@ -45,9 +45,13 @@ pub const CONTENT_CID_HEADER: &str = "x-metamesh-content-cid";
 /// a store-back before it answers.
 const REDEEM_TIMEOUT: Duration = Duration::from_secs(60);
 
-/// Ceiling on a redeemed body. A 100k-segment `.nzb` is ~16 MiB; a subtitle is
+/// Ceiling on a redeemed body — the gateway's own `MAX_REDEEMED_BYTES`. A
-/// kilobytes. Bounds a broken or hostile gateway.
+/// 100k-segment `.nzb` is ~16 MiB and a subtitle kilobytes, but a comic chapter
-pub const MAX_REDEEM_BYTES: usize = 32 * 1024 * 1024;
+/// redeems as one CBZ (`tachiyomi`, meta-feeder-suwayomi): ~24 MB measured for a
+/// 24-page chapter, more for a long webtoon one. Bounds a broken or hostile
+/// gateway. ⚠ The hull's resolve client caps the same body
+/// (`meta-share/src/plugins.rs`, `resolve`); raise both together.
+pub const MAX_REDEEM_BYTES: usize = 64 * 1024 * 1024;
 
 #[derive(Debug)]
 pub enum RedeemError {