posts fix

.forgejo/workflows/deploy.yaml

@@ -255,6 +255,18 @@ jobs:
         # database and bank credentials.
         run: |
           set -eu
+          # The inverse guard: everything that IS meant to be served must be
+          # world-readable. Caddy and catcrafts-server run as their own users,
+          # so a 0600 file (mktemp's default, once shipped by fetch-posts.sh)
+          # deploys "successfully" and then 403s / renders an empty page.
+          # (/deploy-app/content gets the same check in its own deploy step,
+          # after its rsync — here it would still hold the previous run.)
+          unreadable=$(find /deploy -type f ! -perm -o+r -print 2>/dev/null || true)
+          if [ -n "$unreadable" ]; then
+            echo "ERROR: deployed files not world-readable (host services cannot serve them):" >&2
+            echo "$unreadable" >&2
+            exit 1
+          fi
           bad=$(find /deploy -maxdepth 1 \( -name '*.db' -o -name '*.db-*' \
                 -o -name '*.pem' -o -name '*.key' -o -name '*.env' \
                 -o -name '.*' ! -name '.' \) -print 2>/dev/null || true)
@@ -305,6 +317,14 @@ jobs:
           fi
           install -m 0755 "$MSQ" /deploy-app/libmsquic.so.2.new
           mv -f /deploy-app/libmsquic.so.2.new /deploy-app/libmsquic.so.2
+          # Same world-readable guard as the web root: the server runs as its
+          # own user, and a 0600 content file renders as an empty page.
+          unreadable=$(find /deploy-app/content -type f ! -perm -o+r -print 2>/dev/null || true)
+          if [ -n "$unreadable" ]; then
+            echo "ERROR: deployed content not world-readable:" >&2
+            echo "$unreadable" >&2
+            exit 1
+          fi
           # Swap the binary into place atomically, so a request arriving mid-copy
           # never hits a truncated executable.
           mv -f /deploy-app/catcrafts-server.new /deploy-app/catcrafts-server

content/posts.json

@@ -8,11 +8,9 @@
     "excerpt": "While celebrating my previous post of working call audio @pvagner@fedi.ml left this excellent comment: And this reminded me something that i and many devs sadly often forget, if its works for me it doesn't mean it works for everyone. My philosophy is that linux should be as…",
     "media": [
       {
-        "src": "/media/54d923869e19d71c.mp4",
+        "src": "https://files.catbox.moe/q0acuo.mp4",
         "kind": "video",
-        "poster": "/media/63acea1959c6400d.webp",
+        "poster": "https://ani.social/pictrs/image/5948f014-e9d4-4ace-bf6f-6f85e9b5f2fc.webp"
-        "w": 1080,
-        "h": 1080
       }
     ],
     "score": 82,
@@ -27,11 +25,9 @@
     "excerpt": "At first, man thinks he controls the modem. But after the 20th reboot, man learns the modem controls him. — Epictetus So here it is! working VoLTE calls with audio on linux! What a rollercoaster it has been i'll tell you that. The frequency between my previous posts was only a…",
     "media": [
       {
-        "src": "/media/8bc5b5a6565ba864.mp4",
+        "src": "https://ani.social/pictrs/image/50e19f20-3667-4368-91ec-d787c515b9e7.mp4",
         "kind": "video",
-        "poster": "/media/7133dc70534bf47a.webp",
+        "poster": "https://ani.social/pictrs/image/00dfc344-88e7-46a1-973b-db7f3e58f679.webp"
-        "w": 854,
-        "h": 480
       }
     ],
     "score": 501,
@@ -46,11 +42,9 @@
     "excerpt": "My quest to 100% feature completeness continues! Today i bring before you... The working microphone! Now everyone is going to ask: Does this mean working calls? I asked the same thing, and with maybe a bit too much excitement i inserted my SIM card. But the answer is no, neither…",
     "media": [
       {
-        "src": "/media/8e0ef8ba7e9769ec.mp4",
+        "src": "https://ani.social/pictrs/image/752d0c86-666d-48dc-a0c5-aa2bba430afd.mp4",
         "kind": "video",
-        "poster": "/media/7f1d353c81fa55e6.webp",
+        "poster": "https://ani.social/pictrs/image/37bcfe3c-0c6b-4250-b432-7a71cf5de927.webp"
-        "w": 854,
-        "h": 480
       }
     ],
     "score": 296,
@@ -65,11 +59,9 @@
     "excerpt": "Well that was easy. Here i was thinking audio was going to be the boss fight... These were small easily identifiable kernel changes, not the entire investigations that GPS and NFC needed. Ill be working to getting calls fully working, but this is already a big step. And speaking…",
     "media": [
       {
-        "src": "/media/f9d29d90b4c9c9b9.mp4",
+        "src": "https://ani.social/pictrs/image/5963d0aa-5bff-4d46-bb1c-d3e1f6563918.mp4",
         "kind": "video",
-        "poster": "/media/07b79c6415f4c487.webp",
+        "poster": "https://ani.social/pictrs/image/25cca4db-40ab-4664-8a1d-6d93e3ffa249.webp"
-        "w": 854,
-        "h": 480
       }
     ],
     "score": 165,
@@ -84,11 +76,9 @@
     "excerpt": "No new features today, just wanted to make a short post. It is completely possible to do linux development on the go! Is it convenient? Probably not. Is a laptop better? Most likely. Is it funny? Yes. Also a double table is definitely better: photo of a linux phone with a…",
     "media": [
       {
-        "src": "/media/1c75b19e98c7b6ef.webp",
+        "src": "https://ani.social/pictrs/image/a318590f-6ab0-48ac-8a1d-81c37cda77f0.webp",
         "kind": "image",
-        "poster": "",
+        "poster": ""
-        "w": 1920,
-        "h": 887
       }
     ],
     "score": 264,
@@ -103,11 +93,9 @@
     "excerpt": "This is the continuation of my ongoing effort to get the FP6 fully feature complete with linux. I chose NFC cause i thought it would be relatively easy like GPS, well that assumption turned out to be wrong. But alot of time later and as you can see in the video now reading…",
     "media": [
       {
-        "src": "/media/c8de4451ce9d5663.mp4",
+        "src": "https://ani.social/pictrs/image/fae177a4-73d2-43a7-9dd6-0228af1424f8.mp4",
         "kind": "video",
-        "poster": "/media/c6a1a1a41b2883e5.webp",
+        "poster": "https://ani.social/pictrs/image/883180d4-2994-44c9-b2a9-9ba5400b3e59.webp"
-        "w": 854,
-        "h": 480
       }
     ],
     "score": 218,
@@ -122,11 +110,9 @@
     "excerpt": "I really want to turn this phone into my daily driver, so i started working on one of the features i would want in a daily driver, working GPS. This is the current component support table of postmarketos: FP6 feature support table i think audio is too complex for me, so i…",
     "media": [
       {
-        "src": "/media/ce6475f10b3baeee.webp",
+        "src": "https://ani.social/pictrs/image/c2561f4d-73ce-4e89-89bd-5ada7990ded9.webp",
         "kind": "image",
-        "poster": "",
+        "poster": ""
-        "w": 887,
-        "h": 1920
       }
     ],
     "score": 471,

tools/fetch-media.sh

@@ -150,6 +150,9 @@ if jq --slurpfile map "$MAP" '
           else . + { poster: (($m[.poster].path) // .poster) }
           end)))
     ' "$POSTS" > "$TMP_POSTS" 2>/dev/null; then
+    # Same reason as the chmod on each mirrored file: mktemp is 0600 and the
+    # mode survives to production, where other users must read this.
+    chmod 0644 "$TMP_POSTS"
     mv "$TMP_POSTS" "$POSTS"
 else
     rm -f "$TMP_POSTS"

tools/fetch-posts.sh

@@ -212,6 +212,10 @@ fi
 rm -f "$LINKED"
 
 mkdir -p content
+# mktemp files are born 0600, and that mode survives rsync -a all the way to
+# production — where the server runs as another user and Caddy 403s the copy
+# in the web root. The media loop already learned this (chmod there too).
+chmod 0644 "$TMP"
 mv "$TMP" "$OUT"
 trap - EXIT
 rm -f "$RAW"