jwinterm
5b747ab923
fix: correct API_BASE_URL default (was double-prefixing /api)
...
The default was http://nginx/api but all fetch calls already append
/api/... resulting in http://nginx/api/api/ ... (404). Changed to
http://nginx so the full path is http://nginx/api/admin/auth/verify .
2026-03-15 11:31:17 -04:00
jwinterm
1ce08560a2
security: harden admin auth, reconciler locking, and connection pooling
...
- Use secrets.compare_digest for timing-safe admin key comparison
- Strip whitespace from ADMIN_API_KEY env var
- Add PostgreSQL advisory locks per-invoice in reconciler to prevent
duplicate processing during deployments
- Add wallet-RPC retry with backoff (3 attempts: 0.5s, 1s, 2s)
- Raise MAX_SUBADDRESS_INDEX from 100 to 300
- Tune DB connection pool (pool_size=20, max_overflow=10, recycle=3600)
- Add 1-hour admin session timeout
- Regenerate UI lockfile
2026-03-15 10:49:24 -04:00
jwinterm
17ba489ee2
Add admin panel docs to README, fix nginx for reverse proxy setup
2026-03-10 11:34:28 -04:00
jwinterm
47cd52686a
Remove TLS from nginx — NPM handles TLS on LAN
2026-03-10 11:32:16 -04:00
jwinterm
5f1154d363
Add admin panel for merchant management
...
- POST/GET/DELETE /api/admin/users endpoints
- Admin UI at /admin with login, user list, create/delete
- Auth via ADMIN_API_KEY env var (separate from tenant auth)
- Tenants remain scoped to their own store only
2026-03-10 11:24:38 -04:00
jwinterm
bf6dd29c1f
Send signup requests to apps@such.software
2026-03-09 13:12:01 -04:00
jwinterm
57e549ddf4
Fix turnstile and resend package versions
2026-03-09 13:04:23 -04:00
jwinterm
3eabad598d
Add OPEN_REGISTRATION gate, signup request form, favicon
2026-03-09 13:02:21 -04:00
jwinterm
408312cce7
Add hosted by Such Software to footer
2026-03-09 11:54:38 -04:00
jwinterm
a69d199fab
Switch rate provider from CoinGecko to Kraken
...
Kraken public API is free and doesn't require an API key.
Supports XMR/USD and XMR/EUR pairs.
2026-03-09 10:27:47 -04:00
jwinterm