jwinterm
46e3f2f116
fix: correct API_BASE_URL default (was double-prefixing /api)
...
The default was http://nginx/api but all fetch calls already append
/api/... resulting in http://nginx/api/api/ ... (404). Changed to
http://nginx so the full path is http://nginx/api/admin/auth/verify .
2026-03-15 11:31:19 -04:00
jwinterm
00e04c74bb
security: harden admin auth, reconciler locking, and connection pooling
...
- Use secrets.compare_digest for timing-safe admin key comparison
- Strip whitespace from ADMIN_API_KEY env var
- Add PostgreSQL advisory locks per-invoice in reconciler to prevent
duplicate processing during deployments
- Add wallet-RPC retry with backoff (3 attempts: 0.5s, 1s, 2s)
- Raise MAX_SUBADDRESS_INDEX from 100 to 300
- Tune DB connection pool (pool_size=20, max_overflow=10, recycle=3600)
- Add 1-hour admin session timeout
- Regenerate UI lockfile
2026-03-15 10:49:55 -04:00
jwinterm
20eff23335
fix: use correct Wownero network bytes and 2-byte varint prefix for address validation
...
The monero Python library assumes 1-byte network prefixes (Monero format).
Wownero uses 2-byte varint prefixes (base58 prefix 4146 for primary, 12208
for subaddress), so Address() was rejecting valid Wownero addresses with
"Primary address is invalid".
Replace monero lib Address usage with native Wownero validation:
- Correct netbytes: 0xb2 (primary), 0xb0 (subaddress), 0xb3 (integrated)
- 2-byte varint prefix offset for key extraction (bytes 2-33, 34-65)
- 2-byte varint prefix in subaddress derivation encoding
2026-03-13 14:57:57 -04:00
jwinterm
2ccfee4caa
Add admin panel docs to README, simplify nginx Dockerfile
2026-03-10 11:34:30 -04:00
jwinterm
3da9a21b83
Remove TLS from nginx — NPM handles TLS on LAN
2026-03-10 11:32:18 -04:00
jwinterm
d85e26fbbd
Add admin panel for merchant management
...
- POST/GET/DELETE /api/admin/users endpoints
- Admin UI at /admin with login, user list, create/delete
- Auth via ADMIN_API_KEY env var (separate from tenant auth)
- Tenants remain scoped to their own store only
2026-03-10 11:25:02 -04:00
jwinterm
a8fcde59eb
Send signup requests to apps@such.software, fix default site name
2026-03-09 13:12:10 -04:00
jwinterm
2f09c7b94f
Fix turnstile and resend package versions
2026-03-09 13:04:33 -04:00
jwinterm
341d83196b
Add OPEN_REGISTRATION gate, signup request form, favicon
2026-03-09 13:02:30 -04:00
jwinterm
97b7aaa623
Add Such Software footer, pink/yellow theme, fix GitHub URLs
2026-03-09 11:54:40 -04:00
jwinterm
cccbb4425c
Update logo and README with pricing, fork info, port docs
2026-03-09 11:25:49 -04:00
jwinterm
f8f9b4424c
Fork xmrcheckout for Wownero (WOW)
...
Minimal changes from upstream xmrcheckout to support Wownero:
- Rate provider: Nonlogs WOW-BTC via Kraken BTC/USD
- Subaddress derivation: Wownero network byte overrides (53/63/54)
- Payment URI scheme: wownero:
- Dockerfile: Wownero binaries from Codeberg
- Display text: Monero→Wownero, XMR→WOW throughout UI
- Default daemon: 192.168.88.235:34568
- Added wownero-logo.svg
File and folder structure kept identical to upstream for easy sync.
2026-03-09 11:08:55 -04:00
jwinterm