Skip to content

Revert direct pushes to main #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
graphite-app merged 1 commit into from
Apr 27, 2026
Merged

Revert direct pushes to main #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 0 additions & 49 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 0 additions & 2 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,6 @@ rain_orderbook_app_settings = { path = "lib/rain.orderbook/crates/settings", def
rain_orderbook_bindings = { path = "lib/rain.orderbook/crates/bindings", default-features = false }
rain-math-float = { path = "lib/rain.orderbook/lib/rain.interpreter/lib/rain.interpreter.interface/lib/rain.math.float/crates/float" }
wasm-bindgen = "=0.2.100"
moka = { version = "0.12", features = ["future"] }
rusqlite = { version = "0.32" }

[dev-dependencies]
tracing-test = "0.2"
Expand Down
8 changes: 3 additions & 5 deletions keys.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,16 @@ rec {
st0x-op =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZ56nOYbGDd0ZfbqxeY7AbvaQGQrHnlC80ccpRGpCoj";
host =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN1JMILASAjU2qxDdKpdwprx+GllpRWDneNk7dazY3uY";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK9JhlVsHGlSS3c+RGKFSwXyuFpvUTbnOny9e2AdBQ6G";
ci =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTd2zKSwHgWegi290EiK5nYp1Wp4+x2fDYqFxbd0WLN";
arda =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAyTREGZCOzMsl7N9dp1saN/t7DCs7YesusVUKApMJ78";
sid = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPl3/6RlR6Rvz0ZRyZukzFtt4zUYNz5OVuTsajJl7V3n";
alastair =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJArH3PA+bFIon0JkCVQGs9aWr45lnVjiiTLLO9BPItn";
};

roles = with keys; {
infra = [ st0x-op ci sid alastair ];
ssh = [ st0x-op ci arda sid alastair ];
infra = [ st0x-op ci sid ];
ssh = [ st0x-op ci arda sid ];
};
}
34 changes: 1 addition & 33 deletions os.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,42 +99,11 @@ in {
enable = true;
recommendedTlsSettings = true;
recommendedProxySettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;

# Rate-limit zone: 10 req/s per IP, burst 20
appendHttpConfig = ''
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
'';

virtualHosts."api.st0x.io" = {
enableACME = true;
forceSSL = true;

extraConfig = ''
# Security headers
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Limit request body size (API payloads are small)
client_max_body_size 1m;
'';

# Block common exploit scanners (PHP, Docker, ThinkPHP, etc.)
locations."~ \\.(php|asp|aspx|jsp|cgi)$" = {
return = "444";
};
locations."~ ^/(containers|_ignition|vendor|public/index)" = {
return = "444";
};

locations."/" = {
proxyPass = "http://127.0.0.1:8000";
extraConfig = ''
limit_req zone=api burst=20 nodelay;
limit_req_status 429;
'';
};
};
};
Expand All @@ -157,7 +126,7 @@ in {
};

fileSystems."/mnt/data" = {
device = "/dev/disk/by-id/scsi-0DO_Volume_st0x-rest-api-data-v2";
device = "/dev/disk/by-id/scsi-0DO_Volume_st0x-rest-api-data";
fsType = "ext4";
};
Comment on lines 128 to 131
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Find any other references to the old/new volume identifiers to confirm which is canonical in this repo.
rg -nP -C2 'DO_Volume_st0x-rest-api-data(-v2)?'

Repository: ST0x-Technology/st0x.rest.api

Length of output: 252

🏁 Script executed:

#!/bin/bash
# Check git history of os.nix line 129 to see what was changed
git log -p --follow -S 'DO_Volume_st0x-rest-api-data' -- os.nix | head -100

Repository: ST0x-Technology/st0x.rest.api

Length of output: 55

🏁 Script executed:

#!/bin/bash
# Also search for any -v2 references in the entire codebase
rg 'st0x-rest-api-data-v2|DO_Volume.*v2' --type nix --type txt --type md

Repository: ST0x-Technology/st0x.rest.api

Length of output: 55

🏁 Script executed:

#!/bin/bash
# Check git diff to see what this PR actually changes
git diff HEAD~1 os.nix 2>/dev/null || git diff os.nix 2>/dev/null || echo "No git diff available"

Repository: ST0x-Technology/st0x.rest.api

Length of output: 55

🏁 Script executed:

#!/bin/bash
# List recent commits affecting os.nix with one-line summaries
git log --oneline -20 -- os.nix

Repository: ST0x-Technology/st0x.rest.api

Length of output: 116

🏁 Script executed:

#!/bin/bash
# Show the full diff of the last commit that touched os.nix
git log -1 -p -- os.nix | head -150

Repository: ST0x-Technology/st0x.rest.api

Length of output: 4581

🏁 Script executed:

#!/bin/bash
# Check git status and any staged changes
git status os.nix
git diff --cached os.nix 2>/dev/null || echo "No staged changes"

Repository: ST0x-Technology/st0x.rest.api

Length of output: 139

🏁 Script executed:

#!/bin/bash
# Search for any mention of v2 in os.nix or related files
cat os.nix | grep -i v2 || echo "No v2 found in os.nix"

Repository: ST0x-Technology/st0x.rest.api

Length of output: 95

🏁 Script executed:

#!/bin/bash
# Show the three commits that were reverted
git show 543a103:os.nix 2>/dev/null | grep -A5 'mnt/data' || echo "os.nix not in 543a103"
git show 50e7fd9:os.nix 2>/dev/null | grep -A5 'mnt/data' || echo "os.nix not in 50e7fd9"
git show b1ebea3:os.nix 2>/dev/null | grep -A5 'mnt/data' || echo "os.nix not in b1ebea3"

Repository: ST0x-Technology/st0x.rest.api

Length of output: 1903

🏁 Script executed:

#!/bin/bash
# Check git log for all commits and their affected files
git log --oneline --all -30

Repository: ST0x-Technology/st0x.rest.api

Length of output: 1931

🏁 Script executed:

#!/bin/bash
# Show which files were modified by the three direct pushes
git show --name-status 543a103 | head -20
git show --name-status 50e7fd9 | head -20
git show --name-status b1ebea3 | head -20

Repository: ST0x-Technology/st0x.rest.api

Length of output: 2429

Verify the reverted /mnt/data device by-id matches the currently attached DigitalOcean volume.

This revert switches the mount target from scsi-0DO_Volume_st0x-rest-api-data-v2 (introduced in commit 50e7fd9) back to scsi-0DO_Volume_st0x-rest-api-data. If the production droplet's attached volume is still the -v2 variant, the mount unit will fail at activation, breaking /mnt/data and cascading failures for logs, systemd ReadWritePaths, and logrotate/tmpfiles rules. Confirm with ops which volume is currently attached and either keep the -v2 identifier or ensure the non-v2 volume is attached before merging.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@os.nix` around lines 128 - 131, Confirm which DigitalOcean block device is
actually attached to the production droplet and update the mount entry
accordingly: check the node for the by-id name (e.g., whether it is
"scsi-0DO_Volume_st0x-rest-api-data-v2" or
"scsi-0DO_Volume_st0x-rest-api-data"), then in the Nix expression update the
fileSystems."/mnt/data" device value to the exact by-id string that exists (or
have ops reattach the non-v2 volume before merging); ensure the updated device
string replaces the current device value in the fileSystems."/mnt/data" block so
systemd mount units will succeed.


Expand All @@ -166,7 +135,6 @@ in {
experimental-features = [ "nix-command" "flakes" ];
auto-optimise-store = true;
download-buffer-size = 268435456;
sandbox = false;
};

gc = {
Expand Down
132 changes: 0 additions & 132 deletions src/cache.rs
View file
Open in desktop

This file was deleted.

Loading
Loading