Add the Helia feedback relay

laurence commented

2026-10-19 20:32:20 +01:00

Owner

Adds the feedback relay: the small public service the Helia app posts feedback to, which files it as an issue on laurence/helia through a restricted bot account (Forgejo registration is closed, so the public cannot open issues themselves).

Closes #1. Deployment and the decisions behind it are tracked in laurence/ankh-morpork-infra#563.

What it does:

GET /api/v1/challenge and POST /api/v1/feedback as described in docs/PROTOCOL.md.
Proof of work with HMAC-signed single-use challenges, behind a ClientAuth trait so a future client-certificate mode can slot in without changing the report format.
Per-client and global rate limits, strict validation, screenshot decode and re-encode (drops EXIF and every other chunk), highlight rectangles drawn on a copy, spam heuristic that labels rather than drops, kill switch.
Prometheus metrics on a separate internal port, JSON logs with no addresses.
deploy/push-image.py builds a FROM scratch image around the static musl binary and pushes it without a Docker daemon.

Automated testing:

22 unit tests (protocol validation, proof of work, rate limits, imaging, spam, metrics, issue body).
5 end-to-end tests over real HTTP against a mock Forgejo: happy path with screenshot, reused and bad proof of work, 413, 415, 429 with Retry-After, 503 kill switch, spam labelling, and that health and metrics are not on the public port.
clippy (pedantic, warnings denied), rustfmt, cargo-deny, header check and a static musl release build run in CI.

Adds the feedback relay: the small public service the Helia app posts feedback to, which files it as an issue on laurence/helia through a restricted bot account (Forgejo registration is closed, so the public cannot open issues themselves). Closes #1. Deployment and the decisions behind it are tracked in laurence/ankh-morpork-infra#563. What it does: - `GET /api/v1/challenge` and `POST /api/v1/feedback` as described in `docs/PROTOCOL.md`. - Proof of work with HMAC-signed single-use challenges, behind a `ClientAuth` trait so a future client-certificate mode can slot in without changing the report format. - Per-client and global rate limits, strict validation, screenshot decode and re-encode (drops EXIF and every other chunk), highlight rectangles drawn on a copy, spam heuristic that labels rather than drops, kill switch. - Prometheus metrics on a separate internal port, JSON logs with no addresses. - `deploy/push-image.py` builds a FROM scratch image around the static musl binary and pushes it without a Docker daemon. Automated testing: - 22 unit tests (protocol validation, proof of work, rate limits, imaging, spam, metrics, issue body). - 5 end-to-end tests over real HTTP against a mock Forgejo: happy path with screenshot, reused and bad proof of work, 413, 415, 429 with Retry-After, 503 kill switch, spam labelling, and that health and metrics are not on the public port. - clippy (pedantic, warnings denied), rustfmt, cargo-deny, header check and a static musl release build run in CI.

laurence added the

labels

2026-10-19 20:32:20 +01:00

laurence added 1 commit

2026-10-19 20:32:20 +01:00