Release v0.1.1:2 with certrelay, nacho, and prebuilt subspaces.

Remove the embedded explorer/indexer stack, switch subspaces to prebuilt images, add certrelay and nacho as always-on services, expose Spaces and Subs APIs, and wire optional HTTP basic auth for subs and subs-prover with the correct SUBS_BASIC_AUTH_PASSWORD env var. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-23 12:06:16 -04:00
parent 931becd274
commit ad64a47d42
30 changed files with 1364 additions and 831 deletions
@@ -0,0 +1,96 @@
+import { storeJson } from '../fileModels/storeJson'
+import { i18n } from '../i18n'
+import { sdk } from '../sdk'
+import { randomPassword } from '../utils'
+
+const { InputSpec, Value } = sdk
+
+const DEFAULT_USERNAME = 'spaces'
+
+const inputSpec = InputSpec.of({
+  username: Value.text({
+    name: i18n('Username'),
+    description: i18n(
+      'Username for HTTP basic auth in front of subs-prover (SUBS_PROVER_BASIC_AUTH_USER).',
+    ),
+    warning: null,
+    footnote: null,
+    default: DEFAULT_USERNAME,
+    required: true,
+    masked: false,
+    placeholder: 'spaces',
+    minLength: 1,
+    maxLength: null,
+  }),
+  password: Value.text({
+    name: i18n('Password'),
+    description: i18n(
+      'Password for HTTP basic auth in front of subs-prover (SUBS_PROVER_BASIC_AUTH_PASSWORD). Leave blank to auto-generate a random one.',
+    ),
+    warning: null,
+    footnote: null,
+    default: null,
+    required: false,
+    masked: true,
+    placeholder: '(leave blank to auto-generate)',
+    minLength: 0,
+    maxLength: null,
+  }),
+})
+
+export const setSubsProverCredentials = sdk.Action.withInput(
+  // id
+  'set-subs-prover-credentials',
+
+  // metadata
+  async ({ effects }) => ({
+    name: i18n('Set Subspaces Prover Auth Credentials'),
+    description: i18n(
+      'Set or rotate the HTTP basic auth credentials enforced in front of the Subspaces Prover. Saving restarts the service if auth is currently enabled.',
+    ),
+    warning: null,
+    allowedStatuses: 'any',
+    group: null,
+    visibility: 'enabled',
+  }),
+
+  // input
+  inputSpec,
+
+  // prefill — current username, never the password (the user explicitly types
+  // a new password or leaves blank to auto-generate)
+  async ({ effects }) => {
+    const subsProverAuth = await storeJson.read((s) => s.subsProverAuth).once()
+    return {
+      username: subsProverAuth?.username ?? DEFAULT_USERNAME,
+      password: null,
+    }
+  },
+
+  // run
+  async ({ effects, input }) => {
+    const password =
+      input.password && input.password.length > 0
+        ? input.password
+        : randomPassword()
+
+    await storeJson.merge(effects, {
+      subsProverAuth: { username: input.username, password },
+    })
+
+    const enabled = await storeJson.read((s) => s.subsProverAuthEnabled).once()
+
+    return {
+      version: '1',
+      title: i18n('Success'),
+      message: enabled
+        ? i18n(
+            'Subspaces Prover Auth credentials saved. The service is restarting so subs-prover picks up the new credentials.',
+          )
+        : i18n(
+            'Subspaces Prover Auth credentials saved. Auth is currently DISABLED — enable it with "Enable Subspaces Prover Auth" to enforce these credentials.',
+          ),
+      result: null,
+    }
+  },
+)