Say that single sign-on links by address only when turned on, and the db container's .env
Linking by email address is off by default since 0.6.0 (postulo/postulo#892), with the
start-up warning for an instance that has a provider and has not chosen; and the PostgreSQL
profile's database container is handed the whole .env, which Hardening now states and says how
to close (#791).
Refs postulo/postulo#892, postulo/postulo#791
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Installing, Configuration, Hardening: the PostgreSQL file, the worker, the :0.3 image, one upgrade path per install
The PostgreSQL install reads POSTGRES_PASSWORD from the root .env and has a worker of its own;
every command names the file the instance was started with. The image pin is :0.3 and the
registry and source-build upgrade paths are told apart and never combined. Your own email starts
on STARTTLS and refuses a password in the clear; the operator's host exemption is for the
instance's own transport only; a redirect on a pinned request keeps the site's name; a stop
signal ends the worker and a killed worker's errands are failed after a day.
Refs postulo/postulo#581postulo/postulo#582postulo/postulo#403postulo/postulo#358
Refs postulo/postulo#360postulo/postulo#363postulo/postulo#474postulo/postulo#539
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Hardening, Configuration, Installing: what the server dials, and the GeoNames switch
Capture is no longer called the only outbound request; Hardening lists what the core dials and
what turns each off; Configuration gains POSTULO_SKIP_GEONAMES and says the entrypoint follows
POSTULO_GEOLOCATIONS_DIR.
Refs postulo/postulo#366
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Say what an administrator is trusted with, and what Django's admin holds
An administrator sees accounts and never anyone's records in Server settings, but is
trusted with the instance because they install plugins. Appointing one no longer makes
them a superuser, and the admin holds accounts, invitations and token metadata only.
Adds the command that clears the flag from administrators appointed earlier.
Refs postulo/postulo#368
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Say that the log does not hold where outbound requests went
And that a log kept by an earlier version still does, until it rotates
out.
Refs postulo/postulo#548
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Hardening lists what the cache counts. Failed sign-ins are counted per address
they come from and per account: five in five minutes, whether the account was
named by its username or by one of its addresses, in capitals or not, and
under whichever name the instance was reached.
Refs postulo/postulo#489
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Where an operator mounts the admin, it sends whoever is not signed in to
Postulo's sign-in and brings them back afterwards. So an administrator is
asked for their code, needs a confirmed address, and is held to the same
limits on failed attempts as everybody else. Three pages said its login was
rate-limited, which described a form that is gone: Hardening, Accounts and
invitations, and the `POSTULO_ADMIN_URL` row of Configuration.
Refs postulo/postulo#367
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A language code is a BCP 47 tag in its canonical form, said where one is met
Postulo writes `pt-BR` wherever it writes a language, and Serbian is `sr-Cyrl`.
The pages that show or describe a code say so where a reader meets one: the
webhook payload, the API's `language` and `record_language`, what a notifier
and a store are handed, and the catalogue directories of a plugin, which are
gettext's names and the one place an underscore is written.
*Writing a plugin* names the four calls that are on the surface for it:
`language_tag`, `is_language_tag`, `language_match` and `language_matches`,
Postulo's own writer, shape check and comparison, so that a plugin does not
grow its own way of lower-casing a code.
Also: what an older archive's codes become when it is put back, that a
language menu keeps a language it does not list, that Django's admin says its
own language in lower case, and the working catalogues in the design rules.
Refs postulo/postulo#337
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Say what a fetch refuses, how long it waits, and what an import does with a username
Addresses that carry a private one are refused; a page, its robots.txt
and a logo are held to a whole-download time as well as a size; only
gzip and deflate are unpacked; an archive's username is taken only when
the rules allow it; and Python 3.12.4 is the oldest Python.
Refs postulo/postulo#321
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Say what the foot of every page shows, and what it no longer tells a stranger
Configuration gains the two settings the footer reads (where its source
code is, and a legal notice when there is one) and a section on what
the foot of every page holds. Hardening gains *What a stranger is
told*: the version is shown only to people signed in, and `/healthz`
still reports it for monitoring. Installing Postulo and Troubleshooting
stop saying the version is in the footer for everybody, and Installing
says a modified Postulo should point `POSTULO_SOURCE_URL` at its code.
Refs postulo/postulo#212
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Say how a capture keeps the page it was read from, and what keeps that page harmless
Capturing postings gains *Keeping the page*: the source and a
rendering, both off until an administrator and then the person switch
them on, where the kept page is, how long it stays and the account's
ceiling. Its two sentences that still called the browser extension
planned now point at the one that exists.
The capture API documents `keep` and the `page` member of a capture,
the `PUT` that sends a rendering with its answers, the three problem
types it adds, the `413` a request too large for the API now gets, and
what the extensions send today. Configuration lists the six settings
and why keeping is off by default; Hardening says why a kept page never
runs as the stranger's code; the metrics page counts kept pages.
Refs postulo/postulo#256
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Say how one person's own record is taken out as a file and read back
Your career record gains the section on the candidate file: what it
holds and leaves out, the two steps of putting one back, the rule that
it merges and never replaces, what makes two entries the same entry,
and what it refuses. Its two headings that repeated the Europass
section's are worded apart, so each keeps its own anchor.
Backups and your data points to it from taking everything out, from
bringing a career record in, and from putting an archive back, which
that page does not read. Hardening lists the file's 1 MB cap beside
the other upload caps, and Roadmap keeps the whole-archive importer as
still wanted.
Refs postulo/postulo#181
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Say what a cached build means for the image's packages
Hardening said a fresh build takes whatever Debian has published, and
that rebuilding is how an instance gets patched. Both are true of a
build that runs the layer, and a machine that has built before does not
run it: Docker hands back the layer it kept, with the packages of that
day. The page now says so, shows the build argument that makes the
layer run again, and what the layer prints either way.
Installing Postulo's upgrade recipe builds with the argument, where it
had `up -d --build`, which is the cached build.
Refs postulo/postulo#300
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Take the pages over from postulo/wiki, which this repository now replaces
Until now this was a copy of postulo/wiki, refreshed by postulo's
scripts/publish-wiki.sh whenever somebody remembered to run it. The last
time was 5 September (postulo@9645ee1). This brings it to postulo@b6cfb8f7:
- the four pages that never arrived: Accessibility, Hardening, Listings
and Reports;
- the seventeen that had changed since;
- the images, which the script never copied because it copied *.md and
nothing else, so Home has shown its logo and its Buy me a coffee button
broken since the day they were added.
Nothing here was lost: every earlier commit is a publish, and the pages
they left matched postulo/wiki at 9645ee1 exactly.
From here pages are written in this repository and nowhere else.
Refs postulo/postulo#169
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
