Merge pull request #90 from Ecohackerfarm/release/v0.10.0

release: v0.10.0

Author: JustTB

db/seed.sql

@@ -24,8 +24,6 @@ services:
         BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
         BETTER_AUTH_URL: ${BETTER_AUTH_URL}
         NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL}
-    ports:
-      - "3000:3000"
     environment:
       DATABASE_URL: ${DATABASE_URL:-postgresql://power2plant:power2plant@db:5432/power2plant}
       BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
@@ -43,4 +41,16 @@ services:
     networks:
       - default
 
+  nginx:
+    image: nginx:1.27-alpine
+    ports:
+      - "80:80"
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      app:
+        condition: service_healthy
+    networks:
+      - default
+
 volumes: {}

docker-compose.yml

@@ -184,7 +184,8 @@ chmod 600 $PROJECT_PATH/prod/.env
 
 `scripts/server/setup.sh` generates and installs:
 - `/etc/systemd/system/${PROJECT}-{prod,dev,deploy.path,deploy.service}`
-- `/etc/nginx/sites-available/${PROJECT}` (symlinked to enabled)
+- `/etc/nginx/conf.d/${PROJECT}-rate-limits.conf` — `limit_req_zone` for `/share/*` (60 req/min per IP)
+- `/etc/nginx/sites-available/${PROJECT}` (symlinked to enabled) — includes rate-limited `/share/` location
 - `$PROJECT_PATH/prod/webhook/hooks.json` (from template, secret substituted)
 
 ```sh
@@ -224,8 +225,9 @@ systemctl status ${PROJECT}-prod
 docker compose --project-directory $PROJECT_PATH/prod logs -f app
 ```
 
-> Prod app binds as `:::3000:3000` — nginx proxies to `[::1]:3000`. If the app
-> isn't reachable via nginx, verify the port binding in `docker ps`.
+> Prod app binds `:::3000` — host nginx proxies to `[::1]:3000`. `/share/*` traffic
+> is rate-limited to 60 req/min per IP (burst 10) at the nginx layer.
+> If the app isn't reachable via nginx, verify the port binding in `docker ps`.
 
 ---
 

docs/server-setup.md

@@ -0,0 +1,32 @@
+# Rate-limit zone for public share pages: 60 req/min per IP (= 1 r/s)
+# 10m shared memory holds ~160k IPs
+limit_req_zone $binary_remote_addr zone=share_rl:10m rate=1r/s;
+
+server {
+    listen 80;
+    server_name _;
+
+    # Increase header buffer for Next.js responses
+    proxy_buffer_size          16k;
+    proxy_buffers              4 16k;
+    proxy_busy_buffers_size    16k;
+
+    # Forward real client IP to the app
+    proxy_set_header Host              $host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # Public share pages — rate limited
+    location /share/ {
+        limit_req zone=share_rl burst=10 nodelay;
+        limit_req_status 429;
+
+        proxy_pass http://app:3000;
+    }
+
+    # Everything else — no rate limit
+    location / {
+        proxy_pass http://app:3000;
+    }
+}

nginx/nginx.conf

@@ -47,6 +47,7 @@
     "react-dom": "^19.0.0",
     "react-leaflet": "^5.0.0",
     "shadcn": "^4.6.0",
+    "sonner": "^2.0.7",
     "tailwind-merge": "^3.5.0",
     "tw-animate-css": "^1.4.0"
   },

package.json

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "user" ADD COLUMN "trustScore" DOUBLE PRECISION NOT NULL DEFAULT 1.0;

pnpm-lock.yaml

@@ -0,0 +1,16 @@
+-- CreateTable
+CREATE TABLE "GardenShare" (
+    "token" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "beds" JSONB NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "GardenShare_pkey" PRIMARY KEY ("token")
+);
+
+-- CreateIndex
+CREATE INDEX "GardenShare_userId_idx" ON "GardenShare"("userId");
+
+-- AddForeignKey
+ALTER TABLE "GardenShare" ADD CONSTRAINT "GardenShare_userId_fkey" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/20260514000000_add_trust_score_to_user/migration.sql

@@ -167,16 +167,29 @@ enum SourceClassification {
 }
 
 model user {
-  id            String      @id @default(cuid())
+  id            String        @id @default(cuid())
   name          String
-  email         String      @unique
-  emailVerified Boolean     @default(false)
+  email         String        @unique
+  emailVerified Boolean       @default(false)
   image         String?
-  createdAt     DateTime    @default(now())
-  updatedAt     DateTime    @updatedAt
+  trustScore    Float         @default(1.0)
+  createdAt     DateTime      @default(now())
+  updatedAt     DateTime      @updatedAt
   sessions      session[]
   accounts      account[]
   garden        UserGarden?
+  gardenShares  GardenShare[]
+}
+
+model GardenShare {
+  token     String   @id
+  userId    String
+  user      user     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  beds      Json
+  createdAt DateTime @default(now())
+  expiresAt DateTime
+
+  @@index([userId])
 }
 
 model session {

prisma/migrations/20260514000001_add_garden_share/migration.sql

@@ -110,7 +110,16 @@ echo "    wrote ${PROJECT}-deploy.path and ${PROJECT}-deploy.service"
 touch /run/p2p-deploy.trigger
 chmod 777 /run/p2p-deploy.trigger  # world-writable sentinel (no sensitive content)
 
-# ── Nginx config ──────────────────────────────────────────────────────────────
+# ── Nginx rate-limit zone ─────────────────────────────────────────────────────
+# limit_req_zone must live in the http{} context → /etc/nginx/conf.d/
+cat > "/etc/nginx/conf.d/${PROJECT}-rate-limits.conf" <<'RLCONF'
+# 60 req/min per IP on /share/* (token-guessing mitigation)
+# 10m shared memory ≈ 160k tracked IPs
+limit_req_zone $binary_remote_addr zone=p2p_share_rl:10m rate=1r/s;
+RLCONF
+echo "    wrote /etc/nginx/conf.d/${PROJECT}-rate-limits.conf"
+
+# ── Nginx site config ─────────────────────────────────────────────────────────
 # Single-quoted NGINX heredoc prevents shell expansion — nginx vars ($host etc.) preserved.
 # sed substitutes only $DOMAIN.
 nginx_template=$(cat <<'NGINX'
@@ -126,6 +135,19 @@ server {
         proxy_read_timeout 10s;
     }
 
+    # Rate-limited: 60 req/min per IP, burst of 10
+    location /share/ {
+        limit_req zone=p2p_share_rl burst=10 nodelay;
+        limit_req_status 429;
+
+        proxy_pass http://[::1]:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+    }
+
     location / {
         proxy_pass http://[::1]:3000;
         proxy_set_header Host $host;