2026/2026-08-17--bonfire-chromium-login.md

@@ -1,34 +0,0 @@
-# Bonfire — Chromium login stays on homepage (2026-08-17)
-
-Site: **https://bonfire.hacktivism.ch/**  
-Canonical: `configs/bonfire/README.md` (section *Login in Chromium*).
-
-## Symptom
-
-- **Firefox:** Log in and `/login` work.
-- **curl** `https://bonfire.hacktivism.ch/login`: 200, title *Log in*.
-- **Chromium** (operator profile, tab on `/`): **Log in** click does nothing; typing `/login` in the address bar still shows *Explore local activities*. Incognito/Firefox not affected.
-
-Not the `isoc` account (email + username profile exist; login API ok).
-
-## Checks
-
-| Check | Result |
-|-------|--------|
-| Guest `/` HTML | `data-live-socket="false"`; **Log in** is `<a href="/login" data-phx-link="redirect">` |
-| `#modal` | `opacity-0 modal-closed`; `modal_invisible` loading stub has **no CSS rule** (Chromium can show a black overlay) |
-| Bonfire JS | `navigator.serviceWorker.register("/pwabuilder-sw.js", {scope: "/"})` |
-| `/pwabuilder-sw.js` (before kill-switch) | 404; hashed `pwabuilder-sw-*.js` exists under `priv/static/` |
-| UI | badge **Federation disabled** while container `FEDERATE=true` |
-
-## Workaround
-
-Unregister the worker for `bonfire.hacktivism.ch` in that Chromium profile (`chrome://serviceworker-internals` or DevTools Application), clear site data, hard reload. Then `/login` matches Firefox.
-
-Host copies (optional, recreate-volatile in the image): `~/koopa-bonfire/data/branding/{pwabuilder-sw.js,hacktivism-login-fix.css,unregister-sw.js}`.
-
-## Upstream
-
-Not marked known in Bonfire GitHub (2026-08-17): no issue matches `pwabuilder-sw` or “service worker login”. Related PWA issues are push (#1292) and widgets (#1758), not Chromium `/login` hijack.
-
-**Still open locally.** File a bonfire-app issue when ready: `configs/bonfire/TODO-chromium-login-upstream.md`.

README.md

@@ -32,7 +32,7 @@ configs/                   # mirrored app configs (caddy, taler, forgejo, …)
   taler-exchange/          # exchange conf (inside ansible container)
   taler-exchange-ansible/  # container taler-hacktivism-exchange-ansible
   forgejo/                 # rootless git.hacktivism.ch
-  castopod/ bonfire/ lemmy/ prime/ # compose mirrors (no secret values)
+  castopod/ bonfire/ prime/ # compose mirrors (no secret values)
   tops/                    # koopa-tops-ng1…ng3 + autostart unit
   tor/                     # KoopaRelay ORPort 8080
 scripts/                   # merchant, exchange, monitoring helpers
@@ -52,7 +52,6 @@ scripts/                   # merchant, exchange, monitoring helpers
 | `taler-hacktivism-bank` | libeufin-bank (GOA) | **9012** (+ landing **9013**) |
 | `koopa-castopod` (+ mariadb/redis) | Castopod | **9020** |
 | `koopa-bonfire` (+ postgres) | Bonfire | **9021** |
-| `koopa-lemmy-proxy` (+ lemmy/ui/pictrs/db) | Lemmy | **9026** |
 | `koopa-prime-jellyfin` | Jellyfin | **9022** |
 | `koopa-prime-qbittorrent` | qBittorrent | **9023** |
 | `koopa-forgejo` (+ postgres) | Forgejo rootless | **9024** + SSH **9200** |
@@ -63,8 +62,8 @@ Start model (exchange): `~/ansible-taler-exchange/` → `run-container-koopa.sh`
 Start model (user apps): `hernani` → `cd ~/koopa-* && podman-compose up -d`.  
 Start model (tops): user unit `container-koopa-tops.service` (linger).
 
-Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`** / `lemmy.` / `tops.ng1`–`ng3`.hacktivism.ch  
-(Caddy → 9010–9015 / 9020–**9026** / **9090–9092**; git-SSH host **9200** direct).
+Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`** / `tops.ng1`–`ng3`.hacktivism.ch  
+(Caddy → 9010–9015 / 9020–**9024** / **9090–9092**; git-SSH host **9200** direct).
 
 Service **details**: `configs/taler-hacktivism*`, `configs/taler-exchange*`, `configs/forgejo/`, `configs/tops/`, `scripts/*`.  
 Host-wide picture: **`host/overview/services.md`**.  

configs/README.md

@@ -9,7 +9,7 @@ Directories are named to match **live podman container names** where possible.
 | `taler-exchange/` | conf inside exchange container | (see exchange-ansible) |
 | `taler-exchange-ansible/` | **`taler-hacktivism-exchange-ansible`** | `taler-hacktivism-exchange-ansible:landing` |
 | `bank-landing/` `exchange-landing/` `merchant-landing/` | nginx landing snippets | ports 9013–9015 |
-| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, … | compose mirrors |
+| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, … | compose mirrors |
 | `tops/` | `koopa-tops-ng1` … `ng3` | `nginxinc/nginx-unprivileged:1.27-alpine` (non-root, :8080) |
 | `caddy/` `firewalld/` `systemd/` | host services | |
 | `tor/` | **`koopa-tor-relay`** (podman host net) | `localhost/koopa-tor-relay:latest` (**non-root** uid 1000) |

configs/bonfire/README.md

@@ -25,29 +25,4 @@ scripts/bonfire/install-systemd.sh
 Units: `container-koopa-bonfire-db`, `container-koopa-bonfire`, `gitbot-mirror`.  
 Needs `loginctl enable-linger hernani`. Run `podman-compose up -d` once before first boot.
 
-Public feeds: `public-feeds.md`.
-
-## Login in Chromium (PWA service worker)
-
-Firefox and `curl` reach https://bonfire.hacktivism.ch/login (200, real form).  
-**Chromium** (same URL or the yellow **Log in** buttons) can stay on the guest homepage. Not an account/password bug.
-
-Cause (two layers):
-
-1. **Service worker** — Bonfire JS registers `/pwabuilder-sw.js` with `scope: "/"`. An old worker in the Chromium profile intercepts navigations (including `/login`) and serves the cached start page. Firefox typically has no worker → login works there.
-2. **Guest homepage** — static cache / `data-live-socket="false"` plus LiveView `data-phx-link="redirect"` on **Log in**. Without a live socket the click is swallowed. Guest HTML can also leave an empty `modal_invisible` overlay (black panel in Chromium).
-
-Workaround (this Chromium profile):
-
-- `chrome://serviceworker-internals` → **bonfire.hacktivism.ch** → Unregister  
-  or DevTools → Application → Service Workers → Unregister + Clear site data  
-- hard reload, then open `/login`  
-- or **Incognito** (no SW)
-
-Server-side notes (host `~/koopa-bonfire/data/branding/`, not a substitute for unregister): kill-switch `pwabuilder-sw.js`, overlay CSS, login-click JS. Container copies are overwritten on image recreate.
-
-Daylog: `2026/2026-08-17--bonfire-chromium-login.md`.  
-**Unsolved** in operator Chromium. File-upstream TODO: `TODO-chromium-login-upstream.md`.  
-UI badge **Federation disabled** can still show while `.env` has `FEDERATE=true` (see `2026/2026-07-10--bonfire-federate.md`).
-
-**Upstream (checked 2026-08-17):** not filed as a known Bonfire bug. GitHub `org:bonfire-networks` issues: 0 hits for `pwabuilder-sw` / `service worker login`. PWA tickets are [web push #1292](https://github.com/bonfire-networks/bonfire-app/issues/1292) and [dashboard widgets #1758](https://github.com/bonfire-networks/bonfire-app/issues/1758) — not this Chromium navigation stall. Login-labelled issues are other topics (2FA, Welcome Back button, OAuth).
+Public feeds: `public-feeds.md`.

configs/bonfire/TODO-chromium-login-upstream.md

@@ -1,15 +0,0 @@
-# TODO — file Chromium login stall upstream
-
-**Status:** open (2026-08-17). Symptom on https://bonfire.hacktivism.ch/ is **unsolved** in the operator Chromium profile.
-
-Firefox and `curl` work. Chromium stays on the guest homepage (Log in click and `/login` in the address bar).
-
-**Upstream:** not a known Bonfire issue. GitHub `org:bonfire-networks` has 0 issues for `pwabuilder-sw` / “service worker login”. PWA tickets (#1292 web push, #1758 widgets) are something else.
-
-## Still to do
-
-1. File a **bonfire-app** bug (Social **1.0.5**): Chromium + PWA SW (`register("/pwabuilder-sw.js", {scope: "/"})`) can keep `/` and `/login` on the cached guest homepage; guest page also uses `data-live-socket="false"` + `data-phx-link="redirect"` on Log in.
-2. Link this instance as one repro (no secrets). Point at `README.md` § *Login in Chromium* and `2026/2026-08-17--bonfire-chromium-login.md`.
-3. After a GitHub issue exists, put the URL here and in `README.md`; close this TODO.
-
-Do **not** treat unregister-SW / Incognito / Firefox as a product fix — those are local workarounds only.

configs/lemmy/README.md

@@ -10,12 +10,9 @@
 
 Secrets: host `~/koopa-lemmy/{.env,lemmy.hjson}` (mode 600). Not in this repo.
 
-Theme: `extra_themes/hacktivism-overrides.css` + `scripts/lemmy/apply-branding.sh` (exchange-dark, same palette as Bonfire).
-
 ```bash
 cd ~/koopa-lemmy && set -a && source .env && set +a && podman-compose up -d
 scripts/lemmy/install-systemd.sh
-scripts/lemmy/apply-branding.sh
 ```
 
 Daylog: `2026/2026-08-17--lemmy.md`.

configs/lemmy/compose.yml

@@ -54,9 +54,6 @@ services:
       - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
       - LEMMY_UI_LEMMY_EXTERNAL_HOST=${LEMMY_HOSTNAME}
       - LEMMY_UI_HTTPS=true
-      - LEMMY_UI_EXTRA_THEMES_FOLDER=/app/extra_themes
-    volumes:
-      - ./extra_themes:/app/extra_themes:ro
     depends_on:
       - lemmy
     restart: unless-stopped

configs/lemmy/extra_themes/hacktivism-overrides.css

@@ -1,54 +0,0 @@
-/* hacktivism — same palette as bonfire/git.hacktivism.ch (exchange-dark) */
-:root,
-[data-bs-theme=dark],
-[data-bs-theme=light] {
-  --bs-primary: #e8a838;
-  --bs-primary-rgb: 232, 168, 56;
-  --bs-secondary: #3d3128;
-  --bs-secondary-rgb: 61, 49, 40;
-  --bs-success: #16a34a;
-  --bs-info: #3ecfbf;
-  --bs-info-rgb: 62, 207, 191;
-  --bs-warning: #f0d090;
-  --bs-body-color: #fff6e8;
-  --bs-body-color-rgb: 255, 246, 232;
-  --bs-body-bg: #1a1410;
-  --bs-body-bg-rgb: 26, 20, 16;
-  --bs-emphasis-color: #fff6e8;
-  --bs-secondary-color: #ebe0d0;
-  --bs-tertiary-bg: #221c16;
-  --bs-border-color: #2a2018;
-  --bs-link-color: #e8a838;
-  --bs-link-color-rgb: 232, 168, 56;
-  --bs-link-hover-color: #f0d090;
-  --bs-link-hover-color-rgb: 240, 208, 144;
-}
-body {
-  background-color: #1a1410 !important;
-  color: #fff6e8 !important;
-}
-.navbar,
-.navbar-dark,
-.bg-dark,
-.navbar.bg-dark {
-  background-color: #14110e !important;
-}
-.navbar .navbar-brand,
-.navbar .nav-link.active {
-  color: #e8a838 !important;
-}
-.btn-primary {
-  background-color: #e8a838 !important;
-  border-color: #e8a838 !important;
-  color: #1a1410 !important;
-}
-.card,
-.list-group-item,
-.post-listing,
-.comment {
-  background-color: #221c16 !important;
-  color: #fff6e8 !important;
-  border-color: #2a2018 !important;
-}
-a { color: #e8a838 !important; }
-a:hover { color: #f0d090 !important; }

host/caddy/README.md

@@ -8,7 +8,7 @@ Canonical mirror in this repo: **`configs/caddy/Caddyfile`** (same content as `h
 | **9000** | HTTP + ACME webroot + HTTPS redirect |
 | **9001** | HTTPS vhosts |
 
-Public sites: `taler` / `exchange` / `bank` / `castopod` / `bonfire` / `prime` / `bt` / **`git`** / **`paivana`** / **`lemmy`** / tops.ng*.  
+Public sites: `taler` / `exchange` / `bank` / `castopod` / `bonfire` / `prime` / `bt` / **`git`** / **`paivana`** / tops.ng*.  
 Forgejo HTTP: Caddy → `127.0.0.1:9024`. Git SSH is **host :9200** (not Caddy).  
 Paivana: Caddy → `127.0.0.1:9025`.
 

scripts/README.md

@@ -16,7 +16,6 @@
 | `nym/` | **koopa-nym** build/up/status (nym.com nym-node) |
 | `taler-wallet-cli/` | thin wrappers; **benchmarks live in** `../benchmarks/` |
 | `castopod/` | host `hernani` podman-compose `~/koopa-castopod` — see `castopod/README.md` |
-| `lemmy/` | host `hernani` podman-compose `~/koopa-lemmy` — see `configs/lemmy/README.md` |
 
 **Secrets:** never in this tree — sibling **`../koopa-admin-secrets`** (`koopa/host-root/<service>/` ↔ `/root/` on host; `containers/…/secrets/` for in-container).
 

scripts/lemmy/apply-branding.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-# Build extra_themes/hacktivism.css (darkly + hacktivism overrides) and set site default.
-set -euo pipefail
-LIVE="${HOME}/koopa-lemmy"
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-OVERRIDES="${ROOT}/configs/lemmy/extra_themes/hacktivism-overrides.css"
-OUT="${LIVE}/extra_themes/hacktivism.css"
-
-mkdir -p "${LIVE}/extra_themes"
-podman exec koopa-lemmy-ui cat /app/dist/assets/css/themes/darkly.css > "${OUT}"
-cat "${OVERRIDES}" >> "${OUT}"
-echo "wrote ${OUT} ($(wc -l < "${OUT}") lines)"

scripts/login-health/README.md

@@ -65,7 +65,7 @@ overall: OK   ok=42 warn=0 fail=0
 | Git SSH | TCP `:9200` |
 
 **Critical** (→ overall FAIL): merchant, exchange, bank, forgejo, edge/critical ports.  
-**Optional** (→ WARN): castopod, bonfire, lemmy, prime, bt, paivana, tops, tor, nym.
+**Optional** (→ WARN): castopod, bonfire, prime, bt, paivana, tops, tor, nym.
 
 Read-only. No restarts, no secrets.