Grimoire keeps its own SECRET_KEY, docker-compose.yml is the deploy compose, a repo rename moves its snippets; logo, README, licence #214

Merged

bvandeusen merged 5 commits from dev into main 2026-10-22 16:42:34 -04:00

Conversation 0 Commits 5 Files Changed 24

+1249 -156

bvandeusen commented 2026-10-22 16:42:24 -04:00

Owner

Copy Link

Copy Source

• The instance keeps its own SECRET_KEY in /data/secret_key when none is set, so restarts and updates never change it. docker-compose.yml is now the compose users deploy from (nothing to set), and the dev build moves to docker-compose.dev.yml. The README carries the compose inline. (#6244)
• bind_repo(moved_from=…) moves snippet locations that name the old repo, and a re-run finishes an earlier move. (#6245)
• The header draws the clasped grimoire, the README takes the standard shape, and the licence is AGPL-3.0-only.

CI green on dev head f77d18c (run 9691).

🤖 Generated with Claude Code

- **The instance keeps its own SECRET_KEY** in `/data/secret_key` when none is set, so restarts and updates never change it. `docker-compose.yml` is now the compose users deploy from (nothing to set), and the dev build moves to `docker-compose.dev.yml`. The README carries the compose inline. (#6244) - **`bind_repo(moved_from=…)` moves snippet locations** that name the old repo, and a re-run finishes an earlier move. (#6245) - The header draws the clasped grimoire, the README takes the standard shape, and the licence is AGPL-3.0-only. CI green on dev head f77d18c (run 9691). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

bvandeusen added 5 commits 2026-10-22 16:42:24 -04:00

rename(547): the header draws the clasped grimoire, and the README takes the standard shape ... 92a15d3e1a

AppLogo still drew the old open book with a spark, so the new mark showed
only in the browser tab. It now draws the same clasped grimoire as
favicon.svg, in the mark's own fixed colours. That covers the header and
the sign-in, register and password pages.

The README follows the house order: the logo, name and tagline, a short
summary, quick start including the plugin install, the settings a reader
must set, setup pitfalls, updating and backups, features grouped by what
you do, troubleshooting by the error text, development, and licence.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

licence: Fabled Grimoire is AGPL-3.0-only ... 81fe851509

LICENSE carries the GNU Affero General Public License v3.0 text, the same
file the other Fabled projects ship. pyproject.toml, the frontend's
package.json and lockfile, and the plugin manifest declare it as the SPDX
expression AGPL-3.0-only, and the README says what it asks of anyone who
runs a modified version over a network. Reading `license` as an SPDX
expression needs setuptools 77, so the build floor rises to it. The
project description now matches the README's tagline.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(6244): the instance keeps its own SECRET_KEY in /data, and docker-compose.yml is the compose users deploy from ... 787685ac63

With no SECRET_KEY set, Grimoire fell back to a fixed placeholder. The
quickstart compose substituted change-me-in-production, so the README's
own update step (pull, up -d) recreated the container on that placeholder,
and every credential sealed under the key the user started with stopped
opening.

- config: with neither SECRET_KEY nor SECRET_KEY_FILE, the first start
  writes a random key to DATA_DIR/secret_key (mode 0600, published with a
  hard link so concurrent starts agree), and later starts read it back.
  An explicit key wins and leaves the file alone. A missing
  SECRET_KEY_FILE or an empty key file stops the start instead of
  switching keys. With no data directory (a run outside the container)
  the process gets a temporary key and says so.
- app: warns on a public placeholder key, on a temporary key, and when
  /data is not a mounted volume.
- Dockerfile creates /data.
- docker-compose.yml is now the deploy compose (published image, both
  volumes, nothing to set). The build-from-source compose is
  docker-compose.dev.yml, and docker-compose.quickstart.yml is gone. The
  Swarm stack file gains the /data volume and keeps its explicit key,
  because a Swarm can move the app away from a node-local volume.
- README: a Deploy section with the compose inline, SECRET_KEY optional,
  "keep both volumes", and updates that keep the key. A test holds the
  README's copy equal to the file.
- Installs that ran on the change-me-in-production placeholder get a key
  of their own on the new compose; Settings then asks once for saved
  forge tokens and the backup secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(6245): bind_repo(moved_from=…) moves the snippet locations recorded in the old repo ... e89e6a24de

A repo renamed on its forge kept every snippet location naming the old
repo: the binding and the shape ledger moved, the snippets did not.

- snippets.move_location_repo rewrites, on every live snippet of the
  project, each location whose repo is the old remote in any form (URL,
  normalized key, "owner/Repo", bare "Repo", compared without case) to
  the new normalized key. A snippet the caller can only read is listed
  in read_only and left alone.
- Its loop is shared with move_locations through _rewrite_locations,
  which saves each changed snippet through update_snippet.
- bind_repo calls it after the binding moves and reports snippets_moved
  and snippets_read_only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(6245): a re-run of bind_repo(moved_from=…) finishes an earlier move ... f77d18cb63

Once the binding has moved, the old remote is no longer bound, and
move_binding refused. An install that renamed its repo before snippet
locations moved with it had no way to move them. When the old remote is
unbound and the new one is bound to this project, bind_repo now skips the
binding move and still moves the snippet locations that name the old
repo.

The snippet-move test gives each location its own path: rewritten to one
repo, identical locations merge into one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bvandeusen merged commit db62985966 into main 2026-10-22 16:42:34 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

renovate-bot bvandeusen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bvandeusen/FabledGrimoire#214