Primary buttons, selected segments and context chips use accent-fill, as on
the web, so their labels meet WCAG AA contrast.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An axe-core audit of every screen in both themes found low contrast on white
text over the accent and on caption text, track rows using row roles without
cells, and unlabelled progress bars. Accent fills now use a darker token,
caption text meets 4.5:1, track lists are lists and progress bars are labelled.
The queue drawer slides in from the right as designed, takes focus, closes on
Escape and notes that the wave never ends.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Day-to-day operation after install: users and roles, storages and scans, the
upload queue, wave metrics and training, updates, backups and restore,
monitoring and common situations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Three minutes of wave sessions with stream starts, play events and next batches
alongside a steady suggest load; thresholds follow the documented p95 targets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A backup container dumps the database every night, keeps 14 daily and 8 weekly
copies and once a week restores a copy into a scratch database to check tables
and row counts. update.sh takes a copy before updating, restore.sh brings one
back and keeps the old database aside. CI runs the dump, verify and restore
cycle on the database the end-to-end journey filled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The library page compares listen-through, early-skip and like rates per
impression model version, so v1 and the trained ranker can be compared online.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Suggest fetches three times as many candidates and reranks them in the API:
what the user plays, finishes and likes moves up a few positions and what they
dislike moves down, with Meilisearch relevance still the base order.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deleting a missing <uid>_next index is accepted with 202 and fails inside the
task with index_not_found. That error was not treated as not-found, so the first
reindex aborted and search stayed unavailable until indexes existed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The wave logs each served candidate's feature vector to rec_impression_features.
Nightly training joins them with impression outcomes, validates on the last week
and activates the model only when it beats the v1 order and the active model.
The service loads the active ranker and uses its order in place of the v1 score.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- GET /onboarding offers the library's top artists (with album covers)
and genres and says whether to show it (not done and < 10 plays);
PUT /me/onboarding stores the choice or a skip (migration 00009).
- The recommender seeds the taste from it while the user has fewer than
30 scored tracks: chosen artists' tracks +1, chosen genres +0.5.
- Web: onboarding replaces the wave on the home page until done or
skipped; artist grid with covers, genre chips, at least 3 artists.
- e2e journey and the recommender DB test cover it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nightly Beta(α, β) per user and source from wave impressions (reward:
complete or like, ×0.99 daily decay) stored in user_profiles_rec.bandit;
the wave adds 0.2·(θ − 0.5) per candidate source, sources without data
stay neutral. The user's exploration share now follows how well `fresh`
does against the other sources.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v0.7.3 crawled for 35 minutes at the 6 GB cap and was killed without a
log. The container now gets 7 GB, the Gradle heap is 2 GB, the Metro
node process is capped at 1.5 GB and the job times out after 60 minutes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Imported tracks are created directly under their final name with
O_EXCL (never overwriting; " (2)" on conflict), fsync'ed and checked
against SHA-256 — no hidden .pipu-tmp file next to them any more.
- On any failure the agent removes its own partial file and the empty
directories it created for it.
- The write check uses access(W_OK) and the read-only mount flag instead
of creating and deleting .pipu-write-test in the storage root.
- Tests assert the storage tree holds only audio files after successful
and failed writes and after the write check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Changing the activity or mood used to keep the current track playing
and only replace the upcoming ones, so nothing seemed to happen. Now the
first track of the new batch starts immediately (web and Android). The
interrupted track is not reported to the wave as a skip and is recorded
in history only if it played for at least 30 s, so a context change does
not teach the recommender a false dislike.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A hard reboot of the runner VM mid-build left broken transform metadata
in the persistent Gradle cache ("Could not read workspace metadata").
The APK step now detects it, drops the transforms cache and retries the
build once.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The APK job container now runs with --cpus=3 --memory=6g and no swap;
CMake / ninja for the React Native native code are limited to 2 jobs
(they used every core), and Gradle runs under nice / ionice. Notes for
hypervisor-hosted runners (Proxmox) are in docs/ci-cd.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- newApp (extracted from main) is the exact production wiring; the
`ci / db` job now also runs it on PostgreSQL, Redis and Meilisearch
and walks the main user flows over HTTP: first admin sign-in and
credential change, local source and scan, search, album / artist /
top tracks, signed stream, events and history, likes, fallback wave,
playback state, upload queue up to review.
- ALS on a small library produced fewer than 64 factors and the insert
into vector(64) failed; vectors are now zero-padded to the column size.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New `ci / db` job with a pgvector service: Go applies all migrations,
rolls them back to zero and applies them again, then runs the scanner,
fingerprint, write-template, top-tracks and upload-queue store queries;
Python runs the analysis worker, catalog / profile loading and a full
ALS training run against the same schema. Until now this SQL ran
nowhere before reaching a real server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Ambient background in the app shell: three drifting blurred blobs,
the third one tinted with the current track's cover; can be turned off
in settings and stays still with reduced motion.
- Island player variant (floating glass panel) next to the bar, chosen
in settings; player source line ("Album · …", "My Wave"), reactions
around the transport controls, queue drawer.
- Sidebar: like / dislike counters, pending uploads badge on Queue,
admin Settings page holding the upload queue limits.
- Collection: header tile with kicker, underline tabs, time / number
lead column with an equalizer for the current track, album column,
dimmed dislikes with undo, Play all / Shuffle pills.
- Album: cover-tinted header and Play / Shuffle; artist: artist wave,
Play and popular tracks (new GET /artists/{id}/top-tracks).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Implicit scores from play events and reactions per the signals table
(90-day half-life, weaker skips outside the wave, dislikes override).
- numpy ALS for implicit feedback; time-split evaluation on the last
7 days (NDCG@10, Recall@50) against a popularity baseline; a new model
is activated only if NDCG@10 does not regress by more than 2%.
- Vectors are written to track_embeddings.cf and user_profiles_rec.taste_cf,
versions to model_versions; NightlyTrainer runs at TRAIN_HOUR and on
first start, `pipu-rec train` runs it manually.
- Wave: cf and item_cf candidate sources and a 0.10 cf term in the v1
score; impressions are tagged heuristic-v1+cf.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Suggest tracks: drag-and-drop of files and folders with relative
paths, streaming SHA-256 in a Web Worker (hash-wasm), duplicate
precheck, batch reservation and tus-js-client upload (8 MB chunks,
4 in parallel, token refresh on 401, resume of failed files).
- My uploads: statuses, rejection reasons, withdraw, quota meter.
- Upload queue (admin): status tabs, possible-duplicate filter, batches,
metadata and storage editing, bulk approve / reject with a reason,
import retry, and the queue settings form.
- Sidebar section for moderators and admins; ru / en strings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Migration 00008: upload_batches, upload_files, upload_quota.
- Quota reserved under a row lock when a batch is created; every status
change goes through one transition that frees space in the same
transaction. SHA-256 duplicates are rejected before any upload.
- tus 1.0.0 core (HEAD/PATCH) for the author only; offset is the real
staging file size, data beyond the declared size is refused (ADR-015).
- Processing worker: ffprobe checks, SHA-256 verification, exact and
Chromaprint duplicates against library and queue, metadata from tags
or the dropped folder path, possible_duplicate on metadata match, and
the target path from write_template reusing existing folder spelling.
- Import worker: edited tags written with ffmpeg stream copy, file
written by storage-agent, point scan of the new file, imported status;
idempotent and resumed after restart. Stale uploads expire after 24 h,
orphan staging files are removed at startup.
- API: quota, precheck, batches, my uploads, withdraw, admin list,
metadata edit, bulk review, retry and queue settings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- storage-agent: POST /internal/files copies a staged file into a source
(temp file, fsync, SHA-256 check, hard link so nothing is overwritten,
" (2)" suffix on conflict, owner PIPU_FILE_UID/GID) and
POST /internal/files/test. NFS sources that accept uploads are mounted
rw in an agent-only /library-rw and bind-mounted read-only for others;
local sources are written through /library-host-rw.
- meta: write templates ({track:02}, {disc:1-}, [optional]) with name
sanitising and length limits, suggestion from the source's regexes
and a reversibility check against 50 catalogue tracks.
- API and admin UI: accepts_uploads / write_template on sources,
write-template suggest and check endpoints, write test result.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A background Fingerprinter runs after every scan and at startup, one file
at a time, filling media_files.sha256 and track_fingerprints (fpcalc raw,
first 120 s). Without fpcalc only SHA-256 is computed and files stay
queued for Chromaprint. Changing a file's content resets its prints.
Similarity() compares raw prints with a ±80-point alignment search; it is
the basis for duplicate detection in the upload queue.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- My Wave is rendered with react-native-skia on the UI thread; physics
and colour helpers moved to @pipu/core (wave-anim) and shared with web.
- Full-screen player honours ui_prefs.mobile_player (cover / wave).
- Theme switching (dark / light / system) via a theme context and
useColors() across all screens.
- Profile: theme, wave variant, player view, sound quality sheet
(Wi-Fi / mobile / downloads), recent-tracks cache clearing on next
cold start, and a change-password sheet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Likes and dislikes without a network are kept in a pending_reactions
table (last reaction per track wins) and sent when the connection
returns, instead of being rolled back. Downloaded track DTOs pick up the
new reaction so the offline wave and Downloads reflect it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Downloads queue (2 parallel, Wi-Fi only by default) stores files under
the app's document directory and track metadata in SQLite; Collection
gets a Downloads tab, album and player screens get download buttons.
- Player plays downloaded files and local covers; My Wave falls back to
a shuffle of downloaded tracks when the server is unreachable.
- Playback events that fail on the network are kept in SQLite and sent
when the connection returns.
- AuthSession can open offline with the cached user and fetches an
access token before the first request once online.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Checks the server for a newer release at most every 6 hours and on
demand in Profile, shows release notes, downloads the APK with progress,
verifies SHA-256 in 1 MB chunks and hands it to the system installer.
Updates below min_supported cannot be dismissed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GET /api/v1/app/android/latest reads the latest Gitea release with the
server token (cached for 10 minutes); the download endpoint caches the
APK under /updates, verifies its SHA-256 and serves it with Range.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- expo-router app in src/app: connect (server check, recent servers),
login, mandatory credential / password change, tabs Home / Search /
Collection / Profile, album and artist pages, full-screen player
- AuthSession per server with the refresh token in expo-secure-store
(Android Keystore); language from the profile
- player on react-native-track-player: ExoPlayer queue with a
notification and lock-screen controls via a playback service, 500 MB
stream cache, quality by network (Wi-Fi high, cellular medium),
play events with played time, reactions, playback state restore and
the endless My Wave with feedback
- home: pulsing wave circle driven by BPM / energy in the cover
palette, activity and mood chips that switch the wave on the fly
- New Architecture is off until react-native-track-player supports it;
the release build runs codegen only when it is on; query-string is a
direct dependency because expo-router 5.1 imports it undeclared
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- WaveButton: TypeScript port of the prototype's canvas animation
(orb and liquid), breathing at rest, pulsing to the track's BPM and
energy in the cover palette, following the cursor, pressing with a
spring; reduced motion and hidden tabs slow or stop it
- home: the wave in the centre with activity and mood chips; changing
them while playing rebuilds the upcoming tracks without stopping
- player wave mode: asks for the next batch when two tracks are left,
sends complete / skip / early skip / like / dislike as feedback and
refreshes the queue right after a reaction or an early skip
- tracks expose bpm, energy and loudness once analysed; library page
shows analysis progress and 7-day wave metrics; wave style setting
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- /wave/options, POST /wave/sessions (activity, mood, seed),
/next with reactions, PATCH to switch the context on the fly, DELETE
- the recommender is called with an 800 ms budget; on failure the api
serves a fallback wave of likes, favourite artists and random
available tracks with the same dislike / recent / served filters
- every served track is an impression with its source and model; wave
events (context_type wave) set its outcome, reactions win
- library status shows the analysis queue and 7-day wave metrics:
listen-through, early skip and like rate
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- migration 00006: track features and embeddings (pgvector, HNSW),
analysis queue filled by a trigger on new tracks, wave sessions and
impressions, recommender profiles, model versions
- analyzer basic-1 (ADR-014): ffmpeg decode, three 30 s excerpts,
256-d timbre/rhythm embedding, tempo by onset autocorrelation, key,
loudness, energy, danceability, acousticness, intro length; worker
with SKIP LOCKED claims, retries and re-analysis on version change
- wave engine v1: candidates (session/taste similarity, fresh,
liked artists, rediscover, popular, exploration, seed), filters
(dislikes, played in 3 h, already served), heuristic score, activity
and mood fit from contexts.yaml with relaxing thresholds, MMR with
one track per artist, exploration share, session vector updated by
reactions and a change of course after three skips
- POST /internal/wave/batch with the catalog index cached in memory
and the session kept in Redis
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- player bar with cover, like and dislike, previous / play / next,
shuffle, repeat, seek bar and volume; PlayerProvider lives with the
signed-in shell and restores the last track and position paused
- clicking a row (or Enter) plays the list from that track with its
context (album, search, history, collection); the current track is
highlighted and rows have a like button; a reaction refreshes lists
- Collection: history grouped by day with clearing, likes with "play
all" and dislikes, all with paging; sidebar section
- events and playback state are flushed when the page is hidden;
player timers survive StrictMode remounts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- core: PlayQueue with shuffle and repeat, PlayAttempt counting only
time actually played, EventBuffer with batching and backoff, uuidv7
- web: Player over HTMLAudioElement with Media Session, preload of the
next track, expired-link refresh, local and server playback state,
hotkeys; PlayerProvider is not wired into the shell yet
- ru/en strings and icons for the player and Collection
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- tracks carry a stream_url signed for the user for 12 h and the
user's reaction; /stream checks the signature, expiry and that the
user is not blocked, then hands the file to nginx by X-Accel-Redirect
(or serves it with Range support when X_ACCEL=false)
- original by default; formats browsers can't play and explicit
high/medium/low go through Opus transcoding, never upwards: a lossy
source under the target bitrate stays original; transcodes are
cached per file and size, deduplicated in flight, limited by
TRANSCODE_CONCURRENCY and trimmed hourly by LRU to the size limit
- /events takes up to 500 events with client UUIDs, drops repeats and
events older than 30 days, counts plays (≥ half or 4 min, or
finished), early skips and history entries (≥ 30 s)
- history with clearing, likes and dislikes with cursors and totals,
track reactions, playback state with last-write-wins, tracks batch
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- covers are taken from the embedded picture of the first track or a
cover/folder/front image in the album folder, converted by ffmpeg to
WebP 64/300/1200 and named by content hash, so albums sharing a cover
share the files; a full scan looks again for albums without one
- a 3-colour palette (dominant, second, most saturated accent) from a
deterministic k-means feeds placeholders, page tints and the wave
- /covers/{id} is public but HMAC-signed and immutable; nginx serves
the file via X-Accel-Redirect, X_ACCEL=false serves it from api
- the web client picks the size by display size and pixel density
- install.sh and update.sh generate STREAM_SIGNING_KEY
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Storage admin: local folders with a folder picker and NFS sources,
connection test, scan and full scan with live progress, enable,
disable, delete
- path pattern editor with reorder, examples and a preview table that
shows which pattern matched and what came from tags; compile errors
land under the broken pattern
- Library page with counters, scans and unreadable files; search
reindex for admins
- search box in the top bar: combobox with keyboard navigation, 150 ms
debounce, cancelled stale requests, "/" and Ctrl+K, layout fix hint
- search page with tabs and paging, artist and album pages, album
cards and track lists; unavailable tracks are dimmed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- artists, albums and tracks indexes are rebuilt from PostgreSQL next
to the live ones and swapped in, so search keeps working; a rebuild
runs on start, after every scan and when a source is removed
- transliteration fields (Кино ↔ kino) and a retry in the other
keyboard layout (ghbdtn → привет) reported as corrected_query
- /search/suggest (3 artists, 3 albums, 5 tracks), /search by type
with cursor pages, /admin/search/reindex; Meilisearch is part of
/readyz
- found ids are hydrated from the catalog, so a lagging index never
returns deleted entries
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- schema for sources, path patterns, media files, artists, albums,
tracks, genres (migration 00003)
- path patterns (RE2 with named groups, skip), merge with tags by
source priority, fallbacks from the file name and folder, name
normalization and multi-artist split
- scanner: walk, skip unchanged files by size and mtime, ffprobe in 8
workers with a single catalog writer, renames by content hash keep
the track, duplicates fold into one track with the best file as
primary, missing files are kept 30 days
- storage-agent mounts NFS with validated server, export and an option
whitelist, no shell; test mount counts audio files
- admin API: sources CRUD, connection test, patterns with preview,
scan, library status, file errors, host folder picker; scheduled
scans and health checks; mounts are restored on start
- catalog API: artist, artist albums, album with tracks, track
- api image is alpine with ffmpeg for ffprobe
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- core: AuthSession keeps the access token in memory, refreshes it
once for all parallel requests (single-flight) and retries them;
refresh races between tabs are retried, reuse signs out; ApiError
carries problem+json codes and field errors
- web: TanStack Router with guards — guests go to /login, the bootstrap
admin to /setup/admin, temporary passwords to /setup/password, admin
pages by role
- login, setup screens, Classic shell (top bar, role-based sidebar,
empty player), settings: name, theme, language, password, devices
- users admin: search, role filter, create with a one-time temporary
password, reset, block, role change, delete as the policy allows;
audit log for admins
- ru/en strings for auth, admin and error codes; language and theme
are saved in the profile
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- /admin/users: list with search, role filter and cursor pages; create
with a one-time temporary password; rename, change role, block;
reset password; delete
- every change is checked against the role policy, a forbidden field
rejects the whole patch; the last active admin is locked in the
transaction and cannot be demoted, blocked or deleted
- role change and blocking revoke access tokens at once; blocking and
password reset also end all sessions
- /admin/audit: newest-first journal with actor names
- path and query parameter errors are problem+json now
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- users, refresh_tokens and audit_log schema (migration 00002)
- argon2id passwords with rehash on login, password policy, lockout
with exponential back-off and a per-IP rate limit in Redis
- Ed25519 JWT access tokens with kid-based key rotation; rotating
refresh tokens with reuse detection (cookie for web, body for Android)
- bootstrap admin on first start; must_change_credentials and
must_change_password gate every other endpoint
- /auth/login, /auth/refresh, /auth/logout(-all), /me, /me/password,
/me/bootstrap-credentials, /me/sessions; server-info reports
bootstrap_required
- role policy from docs/auth-and-roles.md with table tests
- problem+json errors with field errors; ru/en translations of the codes
- install.sh and update.sh generate JWT_PRIVATE_KEY
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
In the alpine nginx image localhost resolves to ::1 first while nginx
listens on IPv4 only, so the readiness wait never succeeded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Upload import is not implemented yet, so nothing needs write access to
LIBRARY_HOST. Write access will come back together with the import.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scripts were committed without the executable bit, so ./install.sh failed
with "command not found" on a fresh clone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With a container block act runs steps through sh, which rejected the bash
array in the build step (v0.1.13: Syntax error: "(" unexpected).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The app's CMake configure reads JNI sources generated by library codegen
(react-native-edge-to-edge), but the RN Gradle plugin does not declare that
dependency. With a warm Gradle cache configureCMake started before codegen
and v0.1.12 failed. Run generateCodegenArtifactsFromSchema in a separate
Gradle call first; both calls share one daemon.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lintVital runs Google Play pre-release checks on every module (~1 min);
the APK is only published to Gitea releases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
"Free space" no longer described them: the pre-build step now also prints
memory and the size of the persistent Gradle/Android caches, and the
failure step reports disk, memory and OOM kills.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- ci-ts restores the local turbo cache, so unchanged packages skip
typecheck, test and build
- ci-mobile caches the npx copy of expo-doctor and Metro's transform cache
- the web image copies only workspace manifests before pnpm install, so the
dependency layer survives code changes (CI docker job and update.sh)
- docs: table of what is cached where
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The job reaches the Gitea API at its internal address, so html_url in the
response pointed at http://10.10.1.129:3000 and every link in the notes was
unreachable from outside. Build links from PUBLIC_URL (repo variable,
defaults to https://gitea.hsrv.site). A cancelled Android build now shows
"cancelled" instead of staying at "building".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- ci.yml becomes ci-api, ci-contract, ci-recommender, ci-ts, ci-mobile and
docker workflows, each filtered by paths; docs-only commits run nothing
- docker builds all four images in one job with plain docker build on the
runner host, so the layer cache survives between runs
- release no longer re-runs the test suite (the tagged commit already passed
CI on main); version and release notes are one job
- the android job mounts persistent Gradle and Android SDK caches from
/opt/ci-cache (when the runner allows the volumes) and uses --build-cache
- RELEASE_TOKEN is optional: fall back to the built-in job token
- docs: CI layout and act_runner settings (capacity, cache, valid_volumes)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Successful in 51s
The release job now creates the Gitea release right after verification with
generated notes: Android build status, changes grouped by Conventional Commit
type with commit links, server update steps and APK install/check notes.
The android job attaches the APK and .sha256 and rewrites only the status
block (building / built with size, versionCode and SHA-256 / failed with a
log link). scripts/release.mjs is idempotent on re-runs and unit-tested.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Canceled after 0s
expo-doctor rejects expo-modules-autolinking as a direct dependency, which
failed the CI mobile job. Expose it through publicHoistPattern so Expo can
still require it from the apps/mobile/node_modules/expo symlink and the
autolinking import stays expo.modules.ExpoModulesPackage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Successful in 53s
pnpm 11 ignores node-linker=hoisted in .npmrc, so node_modules uses the
isolated layout. Expo evaluates expo's react-native.config.js through the
apps/mobile/node_modules/expo symlink, where require('expo-modules-autolinking')
fails silently; autolinking then guessed the import from the Gradle namespace
(expo.core.ExpoModulesPackage) and the release Java compile failed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Canceled after 0s
v0.1.5 got past Metro, but the Gradle daemon was killed mid-bundle on the
8 GB runner. Compile Kotlin inside the Gradle JVM instead of a second
daemon, limit Gradle and Metro to two workers, set the heap explicitly and
print free/dmesg when the build fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Successful in 48s
Gradle builds native modules in place, under node_modules/<pkg>/android/
{build,.cxx,.gradle}. The root node_modules is a watch folder, so Metro still
crawled and hashed those artifacts and the release bundle step stalled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Canceled after 0s
Add an install step for mounting the music disk via fstab and wire it into
the stack: LIBRARY_HOST in .env points at the host folder, compose mounts it
as /library-host (read-only for api, nginx and analyzer; writable only for
storage-agent), nginx serves it through X-Accel, and install.sh validates the
path and records it in .env.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Successful in 53s
Expo's monorepo config watches all of apps/mobile, so during the release
build Metro crawled and hashed gigabytes of Gradle/CMake intermediates in
android/ and the createBundleReleaseJsAndAssets task appeared to hang.
Run the release build with CI=1 (no file watcher) and NODE_ENV=production.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Successful in 1m20s
The v0.1.2 release ran out of disk while Gradle unpacked the NDK; building
React Native's native code for four ABIs needs several more GB. Print df
before the build and after a failure to make the next shortage obvious.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Canceled after 0s
Security and robustness:
- storage-agent rejects an empty INTERNAL_TOKEN (config notEmpty + middleware)
- api takes the client IP only from X-Real-IP (chi RealIP trusted True-Client-IP)
- /readyz reports ok/fail and logs the cause; checks run in parallel with a timeout
- storage-agent shuts down gracefully; shared httpx.NewServer/Serve with IdleTimeout
- goose migrations take a Postgres advisory lock
- recommender readyz: per-check timeout, redis socket timeouts
Clients:
- Android release allows cleartext HTTP for LAN servers (expo-build-properties)
- checkServer times out after 10s; connect button is disabled while checking
Deploy and CI:
- install.sh hands cache/uploads/updates/models to the non-root service users
- update.sh refuses downgrades unless PIPU_ALLOW_DOWNGRADE=1
- recommender/analyzer get only the env they need; required secrets fail fast
- nginx security headers and CSP; strip True-Client-IP
- dev compose binds ports to 127.0.0.1; postgres/redis images pinned
- version.mjs fails on a malformed explicit tag instead of releasing 0.0.0-dev
- contract check catches untracked generated files
- final releases fail without a release keystore; changelog skips rc tags
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Successful in 50s
The default `tools` package no longer exists in the SDK repository, so
sdkmanager failed and the v0.1.1 release job never built the APK.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci / docker (образы собираются — их сервер собирает сам при обновлении) (services/api/Dockerfile, storage-agent, storage-agent) (push) Successful in 52s
- deploy/compose.yaml: every app service has `build:` (repo root context),
local tags pipu-music-<service>:<version>
- deploy/update.sh: git fetch → checkout tag (latest release by default,
or vX.Y.Z / main) → docker compose build --pull → up -d → prune → /readyz;
re-executes from a temp copy because checkout may replace the script
- install.sh / .env.example: no REGISTRY, PIPU_VERSION set by update.sh,
.env owned by the invoking user
- release.yml: drop image publishing; release ships APK + sha256 only
- ci.yml: new `docker` job builds all images without push
- docs: install guide uses git clone, deployment/ci-cd updated, ADR-013
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- docs/install-guide.md: step-by-step server setup (DNS, Docker, install.sh,
.env, launch, checks), web and Android client setup, own reverse proxy
variant, updates, backups and troubleshooting
- deploy/compose.tls.yaml + Caddyfile: optional Caddy with automatic
Let's Encrypt in front of nginx (enabled via COMPOSE_FILE in .env)
- nginx: honour X-Forwarded-Proto/For from private networks
- .env.example: DOMAIN, ACME_EMAIL, COMPOSE_FILE, bootstrap admin vars
- install.sh: create caddy data dirs; release.yml: ship TLS files as assets
- deployment.md, docs index and README link to the guide
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
