npub1tkq8unhsd5jqx6ueex5lcpsgknrpquxuk44ftpjlpm3ulaake7xs76txrw/ngit-grasp-mirror/nix/module.nix, branch v1.0.0

drop nostr-db backend support, keep only lmdb and memory

2026-02-25T15:07:40+00:00

feat: add NGIT_LOG_LEVEL configuration option

2026-01-27T20:38:15+00:00

Add proper log level configuration following standard approach: - CLI flag: --log-level - Environment variable: NGIT_LOG_LEVEL - Default: info - Supports simple levels (error, warn, info, debug, trace) - Supports filter expressions (e.g., ngit_grasp=debug,actix_web=info) Configuration is now consistent across all four sources: 1. src/config.rs - Config struct with log_level field 2. docs/reference/configuration.md - Full documentation 3. nix/module.nix - NixOS module with logLevel option 4. .env.example - Example configuration file This replaces the previous RUST_LOG approach with proper integration into the ngit-grasp configuration system, enabling trace logging from CLI, environment variables, or NixOS configuration.

fix(nix): use separate setup service to create dataDir before namespace setup

2026-01-21T15:17:10+00:00

The main service uses ReadWritePaths for security hardening, but systemd requires these paths to exist BEFORE setting up the mount namespace. ExecStartPre runs AFTER namespace setup, so it cannot create the directories. This fix adds a separate oneshot setup service (ngit-grasp-{name}-setup) that: - Runs before the main service without namespace restrictions - Creates dataDir and subdirectories (git/, relay/) with mkdir -p - Sets proper ownership (user:group) and permissions (750) - Uses RemainAfterExit so it only runs once per boot The main service now depends on the setup service via requires/after. Fixes: 'Failed to set up mount namespacing: /path: No such file or directory'

fix(nix): explicitly create parent directories for dataDir in tmpfiles

2026-01-21T15:13:45+00:00

The tmpfiles.rules now explicitly creates the parent directory of dataDir with root:root ownership and 0755 permissions before creating the service-owned directories. This ensures the directory hierarchy exists even if parent directories are missing. While systemd-tmpfiles should create parent directories automatically, this makes the behavior explicit and ensures proper permissions on the immediate parent directory.

feat: add archive-grasp-services configuration option

2026-01-21T13:38:11+00:00

Enables relay operators to backup/archive specific GRASP servers by domain. Includes configuration, validation, documentation, and integration tests.

fix(nix): auto-create data directories with ExecStartPre

2026-01-20T07:43:02+00:00

Add ExecStartPre directives to ensure data directories exist before service starts. This fixes service failures when using custom dataDir paths that don't exist yet. The tmpfiles.rules weren't automatically executed during nixos-rebuild switch, causing 'status=226/NAMESPACE' errors. ExecStartPre runs as root (+ prefix) to create directories with proper ownership/permissions.

config: increase max_connections default from 2000 to 4096

2026-01-19T15:03:59+00:00

Increases connection limit across all configuration sources: - src/config.rs: default_value_t = 4096 - docs/reference/configuration.md: updated default and examples - nix/module.nix: maxConnections default = 4096 - .env.example: updated default and comment This allows the relay to handle more concurrent connections and reduces the likelihood of connection exhaustion under normal load. The previous limit of 2000 was too conservative for production deployments.

Add explicit rate limits and total connection limit

2026-01-14T13:40:03+00:00

- Make RateLimit explicit in relay builder (500 subs, 60 events/min) - Add NGIT_MAX_CONNECTIONS config option (default: 500) - Update all 4 config locations (src, nix, docs, .env.example) - Fix documentation error: filter limit 5000→500 - Document Phase 2 deferral decision (per-IP enforcement) Addresses primary DoS vector (connection exhaustion) with minimal code. Per-IP rate limiting deferred until abuse detected in production. Related: issue ff38 (git endpoint throttling - separate concern)

fix(nix): convert boolean env vars to "true"/"false" strings instead of "1"/"0"

2026-01-12T22:53:05+00:00

The archiveAll and archiveReadOnly options were using toString which converts booleans to "1"/"0", but the CLI expects "true"/"false" strings. This caused startup errors like: error: invalid value '1' for '--archive-all' [possible values: true, false] Changed both to use explicit if/then/else conversion to match CLI expectations.

Change default port from 8080 to 7334 (NGIT on phone keypad)

2026-01-12T22:51:43+00:00

- Update default bind address in src/config.rs to 127.0.0.1:7334 - Update all four critical config sources per AGENTS.md: - src/config.rs (code default and tests) - .env.example (development template) - docs/reference/configuration.md (user documentation) - nix/module.nix (NixOS deployment) - Update all documentation examples and references: - README.md (with note about phone keypad mnemonic) - docs/how-to/*.md (deploy, prometheus-setup, test-compliance) - docs/explanation/*.md (architecture, comparison) - docs/learnings/grasp-audit.md Port 7334 spells NGIT on a phone keypad, making it memorable and project-specific. All tests pass (336 lib tests + 51 integration tests).