Spaces:
Paused
Paused
Commit History
-
fix uptime showing undefined on dashboard
initialData for / route was missing uptimeHuman — only /health and /status computed it. Add uptime calculation to the dashboard render path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>5532c91 -
fix backup status display, sync loop spin, and PM2 log leakage
- postiz-sync.py: cmd_sync/cmd_restore now write status+message fields alongside db_status so dashboard can show BACKUP: SUCCESS/ERROR/RESTORED (previously only db_status was written; dashboard reads status/message) - start.sh: sanitize SYNC_INTERVAL (strip non-digits, clamp ≥60s) to prevent sleep "" failure causing tight infinite sync loop at startup - start.sh: extend PM2 grep filter to drop backslash ASCII art (\\{4,}), PM2 log headers (/root/.pm2/...log last N lines), and > pm2 command echoes Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>4a7c78e
-
change emoji to 📝 (notepad)
7ac2f89 -
feat(sync): skip backup when no state changes detected
Add pg_stat_database activity marker + filesystem markers for uploads, secrets, and .next BUILD_ID. State persisted to /tmp; backup skipped when markers match the last successful upload's snapshot. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>a9c0f66
-
docs: add HuggingFlow to More Projects section
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>83c8430 -
remove debug endpoints before release
Remove publicly-accessible debug endpoints that exposed sensitive data: - /app/debug-logs (API keys, Redis oauth tokens, backend logs) - /app/test-request-token (live OAuth token generation) - /app/test-twitter (raw API connectivity probe) - /app/read-x-provider (container source exposure) - X OAuth callback Redis snapshot logging (/tmp/x-oauth-callbacks.log) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>c87b389 -
reduce startup log verbosity
start.sh: - Expand grep -Ev filter (fix multi-arg syntax → -e flags): suppress [InstanceLoader], [PM2] infra msgs, Prisma package install, pnpm script echo headers, /root/.pm2/logs/ paths, PM2 ASCII art, blank lines, apps/X pm2: lines - "Postgres ready/Starting Redis/Redis ready" → "✓ Postgres/✓ Redis" - "Starting nginx + Postiz PM2 procs" → "Starting Postiz..." - "Waiting for nginx" → "Waiting for Postiz..." postiz-sync.py: - Logger format: "YYYY-MM-DD HH:MM:SS - INFO - msg" → "[sync] msg" - Demote "Database dumped" + "Tarball created" to DEBUG (not shown) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>2272bb9 -
add Google Login guide; rename YOUTUBE_* → GOOGLE_* vars
- Add Google Login platform to setup guide (id: google) with OAuth consent screen + callback URL steps - YouTube guide: step 1 says "already have Google Login? skip to step 2" — same GOOGLE_CLIENT_ID/SECRET, just enable YouTube Data API v3 - start.sh: map GOOGLE_CLIENT_ID/SECRET → YOUTUBE_CLIENT_ID/SECRET so Postiz picks them up (it reads YOUTUBE_* internally) - getSocialPlatforms(): add Google Login entry, update YouTube ready-check to use GOOGLE_CLIENT_ID || YOUTUBE_CLIENT_ID - Channel connections persist across restarts via postgres dump in postiz-sync.py (no change needed — already covered) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>72628ff -
add direct-connect guides + restyle setup page
- Add getDirectPlatformDetails(): guides for Bluesky, Mastodon, Telegram, Dev.to, Hashnode, Nostr, Lemmy, Warpcast — each with step-by-step instructions and field descriptions - Sidebar split into "OAuth Platforms" + "Direct Connect" sections - Remove all gradients: step-num and CTA use solid colors - Single accent color (#3b82f6, drop --accent2) - Primary CTA buttons: white background, dark text - Copy URL button: white with dark text (btn-copy-white) - Panel links: accent blue (was purple) - Env-name pill: blue tint (was purple) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>f4e74f4 -
bypass CF proxy for oauth/access_token — go direct to X
oauth/access_token was returning 500 from X when routed through the CF Worker. OAuth 1.0a signatures are sensitive to exact request details; CF Worker may have altered headers/body. Direct paths (no proxy): /oauth/access_token request_token still proxied (working fine via CF). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>248182d -
debug: snapshot Redis login:/external: 100/500/1500ms after X callback
53c803e
-
debug: add /app/test-request-token to call generateAuthLink directly
24ad4e6 -
debug: grep Postiz source for Redis key patterns in debug-logs
445002b -
debug: add /app/read-x-provider endpoint to inspect provider source
4e795a9 -
debug: check Redis key type before reading, handle hash type
fd7a1c1 -
debug: also inspect external:* keys in Redis check
fdf0380 -
debug: scan Redis DB 0/1/2 + keyspace in debug-logs
ad703e3 -
debug: add Redis codeVerifier check to /app/debug-logs
Add REDIS codeVerifier CHECK section to debug-logs endpoint: - Lists all login:* keys in Redis - For each key: shows oauth_token length, oauth_token_secret length, TTL remaining, and detects structural issues: * No colon → split fails → empty secret → wrong OAuth signature → 500 * Extra colons → secret truncated → wrong signature * Secret too short → might be truncated/corrupted - Cross-checks with callback log to verify token/secret are present This tests the theory that oauth_token_secret corruption in Redis is causing X's oauth/access_token to return 500. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>f9ac23b -
fix: CF Worker must re-POST body on X's api.twitter.com→api.x.com redirect
Root cause: X redirects OAuth-signed POST /oauth/access_token from api.twitter.com to api.x.com (confirmed by domain=.x.com in error response cookies vs domain=.twitter.com for unauthenticated requests). CF Worker redirect:"follow" converts POST→GET per fetch spec, losing the OAuth-signed body → X receives unsigned GET → returns 500 HTML. Fix (cloudflare-proxy-setup.py): buffer the request body as ArrayBuffer, use redirect:"manual", then manually follow 3xx hops re-POSTing the same body (up to 5 hops). This preserves method + OAuth signature on redirect. Also add /app/redeploy-cf-worker endpoint to health-server.js: forces Worker redeploy without a full Space restart by unsetting CLOUDFLARE_PROXY_URL from subprocess env (bypassing the setup script's short-circuit check). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>062df28 -
add /app/test-twitter probe + fix Worker redirect for POST
health-server.js: - /app/test-twitter: probes api.twitter.com GET (reachability) and POST oauth/access_token (no auth) to distinguish IP-blocked (500 HTML) from IP-allowed (400/401 JSON). Shows NODE_OPTIONS + CLOUDFLARE_PROXY_URL. cloudflare-proxy-setup.py: - Worker: change redirect:"follow" → redirect:"manual" so POST bodies are not silently dropped when X returns a 3xx (fetch spec converts POST→GET on 301/302, losing OAuth-signed body → signature mismatch). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>86ec115 -
debug-logs: show cloudflare proxy env status explicitly
Add CLOUDFLARE PROXY STATUS section to /app/debug-logs: - CLOUDFLARE_WORKERS_TOKEN presence (is proxy deployed?) - CLOUDFLARE_PROXY_URL presence (are X calls being proxied?) - NODE_OPTIONS value (is cloudflare-proxy.js injected?) - /opt/cloudflare-proxy.js existence check - cf-proxy-banner-shown marker This reveals whether X oauth/access_token 500 errors are due to HF datacenter IP block bypassed (or not) by the Cloudflare proxy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>3b50174 -
debug: log X OAuth callback params (oauth_verifier presence check)
14458bf -
setup: clarify X OAuth steps — permissions + regenerate keys warning
f8338bc -
debug-logs: tail last N lines + masked X credential diagnostics
468dd01 -
setup: redesign to match dashboard design system + fix X docs
- Match CSS vars exactly to dashboard (--bg:#08080f, --panel, --line, Inter font, font-weight:850 labels, 8px border-radius cards) - Sidebar: dot indicators (green/amber/grey) replace emoji badges - Steps: gradient numbered circles, proper strong/code/link styling - Callback/env blocks: monospace text, accent-coloured copy buttons - Settings CTA: gradient button matching dashboard hero-action style - X/Twitter steps: rewritten with correct OAuth 1.0 Keys instructions (Consumer Key = X_API_KEY, Consumer Secret via Regenerate popup, Native App required, Web App causes error 32) - All callback URLs already correct: /integrations/social/{provider} Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>5e5b81c
-
fix: update footer to credit the author in the dashboard
b6c7f2b
-
Fix: add local time display for sync status in dashboard
87766ca -
Fix: include keepalive status in root dashboard
f20876b -
Fix: Move Cloudflare keepalive setup before health-server to avoid race condition
The health-server was starting before the keepalive setup script finished writing the status file. This caused a race condition where users would see "Worker pending or failed" until the setup completed. Now the setup runs before health-server starts, ensuring the status file exists before any requests are served.b46eebe -
Improve: Better Cloudflare API error diagnostics
dd47a40 -
fix: improve keep-alive status message handling in renderDashboard function
05a6a72 -
fix: correct typo in project name "HuggingMes" in README
751478a
-
refactor: remove cloudflare-worker.js and related configurations
010e97a -
refactor: replace UptimeRobot with Cloudflare Workers for service keep-alive mechanism
5d2b465 -
feat: add /app/debug-logs endpoint to expose backend logs and proxy environment variables
5aec081 -
fix: adjust OAuth callback paths, force /app root redirect, and increase logging verbosity for sync processes
3d8fd70 -
chore: update X OAuth instructions, increase default SYNC_INTERVAL, and adjust app navigation paths
2869840 -
refactor: implement two-pass backup creation to automatically exclude frontend cache if tarball exceeds size limits
264b68d -
feat: document platform architecture and enhance health server dashboard with OAuth setup guides
e47c28d -
dashboard: user-friendly setup guide + platform status grid
- Add getSocialPlatforms() — categorises all Postiz channels into 'works immediately' (no OAuth: Bluesky, Mastodon, Telegram, Dev.to…) and 'needs API keys' (OAuth: LinkedIn, X, YouTube, TikTok, Reddit…) - New renderDashboard(): boot-aware Open Postiz button, 4-step getting started guide, collapsible platform cards with direct developer-portal links, collapsed System & Backup section - Auto-refreshes every 30s; button activates automatically when Postiz comes online (no manual reload needed) - Space Settings deep-link uses SPACE_ID env var for one-click nav to secrets page Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>245f89d -
fix: rewrite Space-host redirects to relative paths + pass x-forwarded-proto
Next.js middleware generates redirects using the public SPACE_HOST (e.g. https://somratpro-huggingpost.hf.space/auth). The HF Spaces reverse proxy intercepts absolute redirects to its own hostname, resolves them server-side, and returns 200 — causing blank white page at /app/ instead of navigating. - health-server rewriteLocation: also rewrite absolute URLs whose hostname matches SPACE_HOST to /app-prefixed relative paths (same logic as 127.0.0.1) so the browser (not HF proxy) handles the navigation and URL bar updates - Dockerfile: patch nginx to pass X-Forwarded-Proto from upstream header ($http_x_forwarded_proto) instead of hardcoding $scheme=http so Next.js builds correct https:// redirect URLs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>57b8b04 -
fix: patch google font → local at runtime to survive cached Stage 1
Stage 1 Docker image may be cached from before the font patch was added. Apply the patch in start.sh at container start (idempotent grep check) so the cached image is fixed without requiring a full Stage 1 rebuild. - Dockerfile Stage 2: COPY vendor fonts + patch script to /opt/vendor/ - start.sh: patch layout.tsx files before next build if still on google font Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>fd4cae0 -
update
bb56821
-
feat: vendor Plus Jakarta Sans fonts and patch layouts to resolve build-time network constraints, update health-server proxy logic, and correct UptimeRobot interval units.
6c0455b -
fix: set FRONTEND_URL to bare origin so CORS allow-origin matches browser
FRONTEND_URL was set to PUBLIC_URL/app (with basePath suffix). Postiz backend uses FRONTEND_URL as the CORS allowed-origin. Browsers send Origin: https://host (scheme+host only, no path per the HTTP spec), so the /app suffix caused every pre-flight and credentialed request to be blocked — making login and signup silently fail. Fix: FRONTEND_URL = PUBLIC_URL (no /app). Email links generated by Postiz (e.g. ${FRONTEND_URL}/auth/login) still work because health-server now redirects any bare /auth/* path to /app/auth/*. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>ff3303a -
fix: serve Next.js public/ files from disk to avoid nginx basePath 502s
Requests for static assets like /app/auth/avatars/*.jpg reach nginx as /auth/avatars/*.jpg; our nginx patch re-adds /app/ making it /app/auth/avatars/*.jpg for Next.js:4200. Next.js can't serve public/ files at that prefixed path → nginx returns 502. health-server now intercepts /app/<ext> paths that are not /_next/ assets and streams them directly from /app/apps/frontend/public/. Falls back to the nginx proxy if the file isn't found there. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>12bbc56 -
perf: move pnpm install before next.config.js patches to preserve cache
Any change to the patch RUN command previously busted the pnpm install cache layer, forcing a full reinstall (~3-4 min) on every push. Moving install first means patch changes only invalidate the patch + build layers. Also consolidates the two patch RUN commands into one to reduce layer count. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>2ecb798 -
fix: redirect bare paths to /app/ and disable image optimization
Post-login 404: Postiz navigates to /launches (no basePath prefix) after auth; health-server now redirects any unrecognized path to /app<path> instead of 404-ing. _next/image 400s: disable Next.js image optimization (unoptimized:true in next.config.js) so <Image> renders plain <img src="/app/auth/avatars/..."> tags that route through nginx correctly, bypassing the optimizer's internal fetch which failed because static files live at the basePath-prefixed path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>0234a7a -
fix: redirect /app root to /app/auth/ instead of white-screening
nginx:5000 returns HTTP 200 with empty body for GET / — it never reaches Next.js for the bare root path. health-server now intercepts GET /app and GET /app/ before proxying and issues a 302 → /app/auth/; Next.js middleware then redirects authenticated users to /launches/ transparently. Also removes the temporary /debug-proxy endpoint and console.warn that were added for diagnosis, and annotates the Dockerfile nginx patch for clarity. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>c4c4e4c -
debug: add /debug-proxy endpoint + empty-200 warning log
Temporary diagnostic: /debug-proxy?path=/foo probes nginx:5000 directly and returns raw status/headers/body as JSON — bypasses health-server proxy layer so we can see what nginx actually returns vs what we forward. Also add console.warn for any 200 response from upstream that has no content-type and no x-powered-by (the empty-body symptom we're chasing). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>ad8ca81