Commit `965c060dca`

965c060dca284edb285cbb4e7ecd2e251fa39fc0

parent: bdbc11e860

Verified · cmc

cmc <hello@cleberg.net> · 2026-04-11 18:19 UTC

chore: harden repo defaults for secrets, deployment, and logging

Layout: unified · split

.dockerignore added +26

@@ -0,0 +1,26 @@
	1	.git
	2	.gitignore
	3	.env
	4	.env.*
	5	!.env.example
	6	.venv/
	7	venv/
	8	__pycache__/
	9	*.py[cod]
	10	*.db
	11	*.sqlite
	12	*.sqlite3
	13	.pytest_cache/
	14	.mypy_cache/
	15	.ruff_cache/
	16	.hypothesis/
	17	.coverage
	18	.coverage.*
	19	htmlcov/
	20	build/
	21	dist/
	22	*.egg-info/
	23	.eggs/
	24	.DS_Store
	25	.idea/
	26	.vscode/

.env.example +3 −3

	@@ -4,11 +4,11 @@ SRHT_TOKEN=replace-me
4	TODO_SRHT_ENDPOINT=https://todo.sr.ht/query	4	TODO_SRHT_ENDPOINT=https://todo.sr.ht/query
5	GIT_SRHT_ENDPOINT=https://git.sr.ht/query	5	GIT_SRHT_ENDPOINT=https://git.sr.ht/query
6	DATABASE_URL=sqlite:///./srht_contrib.db	6	DATABASE_URL=sqlite:///./srht_contrib.db
7	DEFAULT_ACTOR=~ccleberg	7	DEFAULT_ACTOR=~your-user
8	POLL_INTERVAL_SECONDS=900	8	POLL_INTERVAL_SECONDS=900
9	# Optional JSON object. Example:	9	# Optional JSON object. Example:
10	# {"~ccleberg":["cmc@example.com","Chris Cleberg"]}	10	# {"~your-user":["you@example.com","Your Name"]}
11	ACTOR_ALIASES_JSON={}	11	ACTOR_ALIASES_JSON={}
12	# Optional JSON array. Example:	12	# Optional JSON array. Example:
13	# ["Hutch","~ccleberg/cleberg.net"]	13	# ["your-repo","~your-user/your-site"]
14	GIT_TRACKED_REPOSITORIES=[]	14	GIT_TRACKED_REPOSITORIES=[]

README.md +20 −14

 TODO_SRHT_ENDPOINT=https://todo.sr.ht/query
 GIT_SRHT_ENDPOINT=https://git.sr.ht/query
 DATABASE_URL=sqlite:///./srht_contrib.db
-DEFAULT_ACTOR=~ccleberg
+DEFAULT_ACTOR=~your-user
 POLL_INTERVAL_SECONDS=900
-ACTOR_ALIASES_JSON={"~ccleberg":["cmc@example.com","Chris Cleberg"]}
+ACTOR_ALIASES_JSON={"~your-user":["you@example.com","Your Name"]}
-GIT_TRACKED_REPOSITORIES=["Hutch","~ccleberg/cleberg.net"]
+GIT_TRACKED_REPOSITORIES=["your-repo","~your-user/your-site"]
 ```
 ## Local Run Instructions
 Manual polling is exposed as an API endpoint:
 ```bash
-curl -X POST "http://127.0.0.1:8000/api/contributions/poll?actor=~ccleberg" \
+curl -X POST "http://127.0.0.1:8000/api/contributions/poll?actor=~your-user" \
   -H "X-API-Key: replace-me"
 ```
 ```json
 {
-  "actor": "~ccleberg",
+  "actor": "~your-user",
   "inserted_events": 3,
   "services": ["todo", "git"]
 }
 For `git.sr.ht`, tracked repositories are configured via `GIT_TRACKED_REPOSITORIES`. Entries may be either:
 - `"Hutch"` for a repository owned by `DEFAULT_ACTOR`
-- `"~ccleberg/cleberg.net"` for an explicit owner/repository pair
+- `"~your-user/your-site"` for an explicit owner/repository pair
 ## API Endpoints
 ### Contribution Calendar by Year
 ```bash
-curl "http://127.0.0.1:8000/api/contributions/~ccleberg?year=2026"
+curl "http://127.0.0.1:8000/api/contributions/~your-user?year=2026"
 ```
 ### Contribution Calendar by Date Range
 ```bash
-curl "http://127.0.0.1:8000/api/contributions/~ccleberg?from=2026-01-01&to=2026-03-30"
+curl "http://127.0.0.1:8000/api/contributions/~your-user?from=2026-01-01&to=2026-03-30"
 ```
 Example response:
 ```json
 {
-  "actor": "~ccleberg",
+  "actor": "~your-user",
   "from": "2026-01-01",
   "to": "2026-03-30",
   "days": [
 ### Contribution Stats
 ```bash
-curl "http://127.0.0.1:8000/api/contributions/~ccleberg/stats?year=2026"
+curl "http://127.0.0.1:8000/api/contributions/~your-user/stats?year=2026"
 ```
 Example response:
 ```json
 {
-  "actor": "~ccleberg",
+  "actor": "~your-user",
   "from": "2026-01-01",
   "to": "2026-12-31",
   "total_events": 42,
 List tracked repositories:
 ```bash
-curl "http://127.0.0.1:8000/api/repositories?actor=~ccleberg" \
+curl "http://127.0.0.1:8000/api/repositories?actor=~your-user" \
   -H "X-API-Key: replace-me"
 ```
 curl -X POST "http://127.0.0.1:8000/api/repositories" \
   -H "X-API-Key: replace-me" \
   -H "Content-Type: application/json" \
-  -d '{"actor":"~ccleberg","repo_name":"Hutch"}'
+  -d '{"actor":"~your-user","repo_name":"your-repo"}'
 ```
 Get, update, and delete a tracked repository:
 curl -X PATCH "http://127.0.0.1:8000/api/repositories/1" \
   -H "X-API-Key: replace-me" \
   -H "Content-Type: application/json" \
-  -d '{"repo_name":"~ccleberg/cleberg.net"}'
+  -d '{"repo_name":"~your-user/your-site"}'
 curl -X DELETE "http://127.0.0.1:8000/api/repositories/1" \
   -H "X-API-Key: replace-me"
 - alias management is config-driven; there is no alias CRUD API yet
 - current deployment model is trusted-operator V1, not a public multi-tenant service
+## Deployment Notes
+- Add a `.dockerignore` when building container images so local secrets and SQLite files are never sent to the build context.
+- For production, prefer exposing the service behind a reverse proxy instead of publishing the application port directly to the internet.
+- Set `ENABLE_SCHEDULER=true` only for single-instance deployments where this service should own polling.
 ## Recommended Next Steps
 1. Add alias-management APIs or seed files for stronger actor identity mapping.

compose.yml +3 −3

	@@ -2,12 +2,12 @@ services:
2	hutch-stats:	2	hutch-stats:
3	build:	3	build:
4	context: .	4	context: .
5	container_name: hutch-stats	5	container_name: ${COMPOSE_PROJECT_NAME:-hutch-stats}
6	ports:	6	ports:
7	- "8000:8000"	7	- "${HOST_PORT:-8000}:8000"
8	environment:	8	environment:
9	API_KEY: ${API_KEY}	9	API_KEY: ${API_KEY}
10	ENABLE_SCHEDULER: "true"	10	ENABLE_SCHEDULER: ${ENABLE_SCHEDULER:-false}
11	SRHT_TOKEN: ${SRHT_TOKEN}	11	SRHT_TOKEN: ${SRHT_TOKEN}
12	TODO_SRHT_ENDPOINT: ${TODO_SRHT_ENDPOINT:-https://todo.sr.ht/query}	12	TODO_SRHT_ENDPOINT: ${TODO_SRHT_ENDPOINT:-https://todo.sr.ht/query}
13	GIT_SRHT_ENDPOINT: ${GIT_SRHT_ENDPOINT:-https://git.sr.ht/query}	13	GIT_SRHT_ENDPOINT: ${GIT_SRHT_ENDPOINT:-https://git.sr.ht/query}

src/srht_contrib/services/srht_client.py +16 −7

     """Raised when a SourceHut GraphQL request fails."""
+def _graphql_error_summary(errors: Any) -> str:
+    if not isinstance(errors, list):
+        return "unexpected error payload"
+    return f"{len(errors)} GraphQL error(s)"
 class SourceHutGraphQLClient:
     def __init__(
         self,
                 response.raise_for_status()
                 body = response.json()
             except httpx.HTTPStatusError as exc:
-                response_text = exc.response.text[:500]
                 logger.warning(
-                    "SourceHut HTTP failure from %s on attempt %s/%s: %s %s",
+                    "SourceHut HTTP failure from %s on attempt %s/%s: status=%s",
                     self.endpoint,
                     attempt,
                     attempts,
                     exc.response.status_code,
-                    response_text,
                 )
                 if exc.response.status_code >= 500 and attempt < attempts:
                     continue
-                raise SourceHutClientError(
+                raise SourceHutClientError(f"HTTP error from SourceHut: {exc.response.status_code}") from exc
-                    f"HTTP error from SourceHut: {exc.response.status_code} {response_text}".strip()
-                ) from exc
             except httpx.HTTPError as exc:
                 logger.warning(
                     "SourceHut network failure from %s on attempt %s/%s",
                 raise SourceHutClientError("Network error while contacting SourceHut") from exc
             if "errors" in body:
-                raise SourceHutClientError(f"GraphQL errors returned by SourceHut: {body['errors']}")
+                logger.warning(
+                    "SourceHut GraphQL failure from %s: %s",
+                    self.endpoint,
+                    _graphql_error_summary(body["errors"]),
+                )
+                raise SourceHutClientError(
+                    f"GraphQL errors returned by SourceHut: {_graphql_error_summary(body['errors'])}"
+                )
             return body.get("data", {})
         raise SourceHutClientError("SourceHut request exhausted retries")

Commit 965c060dca

Commit `965c060dca`