# Current > Keep this file short. One active step, one ordered backlog. Completed work moves to > [progress.md](progress.md). If this file starts reading like a changelog, it has > drifted — that's exactly what went wrong last time. ## Active: Milestone 5b — Deployable by anyone **Goal:** a stranger can install Steid on a fresh Linux box in one command and reach it over HTTPS, and the author can publish an instance and push Steid's own source to it. Distributed as **a binary plus its assets**, not a container. **Out of scope:** push-to-release and any CI/CD (8+ — see [ROADMAP.md](ROADMAP.md#milestone-ladder)), multi-user registration (7), and hosting release artefacts on Steid itself, which it has no feature for. ### Steps - [x] Release build producing `steid--.tar.gz` — binary, `assets/`, README — and verified to boot from a clean extraction - [x] `install.sh` — download, systemd unit, Caddy with automatic HTTPS, idempotent - [x] `README.md` — the repo has none, and it is the front door of a portfolio project - [x] Operability: `/healthz`, graceful shutdown on SIGTERM - [x] `STEID_SETUP_TOKEN` as an optional override, so claiming is not a race with `journalctl` - [x] Rate limiting on `/auth/login` and `/auth/setup` - [x] Backup and restore, documented — two paths, rsync is enough ### Done when `curl … | sh -s -- --domain git.example.com` on a fresh VPS yields a working HTTPS instance, and Steid's own source is pushed to it and browsable there. ### Settled - **A binary plus `assets/`, not a container.** Topcoat can embed the asset *manifest* (`Manifest::parse` + `include_str!`, for WASM) but not the asset *bytes* — that path pairs with `AssetConfig::hosted_at`, which expects a CDN. A single self-contained file would mean fighting the framework, so the artifact is a directory. The Dockerfile stays as a secondary path. - **A TLS proxy is mandatory, not conventional.** Topcoat 0.5 has no TLS: no rustls, no ACME, no HTTPS listener — checked, not assumed. Since git authenticates over HTTP Basic, without TLS a personal access token crosses the network in cleartext on every push. Caddy is chosen because automatic certificates are its headline feature and the config is two lines. - **glibc, built on Debian bullseye — not static musl.** Two reasons, the second decisive. musl failed on `ring` (Debian's `musl-gcc` wrapper rejects `-m64`) and would need a real cross toolchain. But **musl's whole point is a binary with no runtime dependencies, and Steid hard-requires `git` on `PATH`** — anyone installing it already has a package manager, so the portability musl buys cannot be used. Building on bullseye pins the glibc floor at 2.31, covering Debian 11+ and Ubuntu 20.04+; building on bookworm would need 2.36 and silently exclude Ubuntu 22.04, which is still everywhere. Verified: a release build in `rust:1.97-slim-bullseye` succeeds, 11.5 MB. - **The runtime binary links a TLS stack it never uses.** `ring` ← `rustls` ← `ureq` ← Topcoat's `icon-iconify`/`tailwind` features, whose `ureq` exists to download the Tailwind CLI *at build time*. Those features are enabled on the normal dependency as well as the build one, so the crypto comes along for the ride. Moving them to build-dependencies only would shrink the binary and drop an unused dependency from the attack surface — worth trying, not yet attempted, and it is what made the musl attempt fail where it did. - **Rsync is the deployment mechanism for now**, and that is enough while the artifact is two paths. Push-to-release is the eventual answer and is parked at 8+. ### Open - **Whether to add `STEID_TRUSTED_PROXY`.** The rate limiter keys on `X-Forwarded-For` because **Topcoat 0.5 discards the peer address at accept time and never exposes it** — a handler sees headers and nothing else. Behind a proxy that is fine. Exposed directly, a caller can vary the header for a fresh budget, leaving only the global cap. An explicit "trust forwarded headers" flag defaulting to off would close it, at the cost of one more thing an operator must get right. Not picked. - **`MAX_RAW_BYTES` is 10 MiB**, chosen rather than derived. It bounds what one raw request can hold in memory, because `GitQuery` reads bytes rather than streaming them. Raising it means a handful of concurrent requests can hold that much each. - **Renaming a repository** is still impossible, and now needs its own use case plus an answer for moving the directory under every existing clone. - **The profile has no links.** `Organization` carries a display name and a bio and nothing else, so the design's links row is not backed by data and was left out rather than faked. A `links` field plus a settings control is the small feature that fixes it. - **`create_repo` and `serve_git` read the clock internally** rather than taking a `now`, which is what `issue_token` does. Two call-site edits, or a `Clock` port if a third case appears. - **A push touches `updated_at` twice** — once for the advertisement, once for the RPC. Harmless, same second, but two writes per push. - **A licence.** A public portfolio repository probably wants one, and the README deliberately says nothing about licensing rather than guessing. - ~~Blocked on a domain transfer~~ — **transferred 2026-08-29**, so Phases 1–6 of the deployment runbook are unblocked. - **(historic) Blocked on a domain transfer** (noted 2026-08-29). `jpgill.dev` is the intended host for both the instance and the release downloads; the transfer is in flight. Phases 1–6 of the deployment runbook cannot start until DNS resolves, because Caddy requests a certificate on startup. Nothing else is blocked by it — the artifact is built and verified, and `install.sh` still needs its container dry-run. - **A domain.** Caddy needs a real hostname to obtain a certificate. This is the one blocker that is DNS rather than code. ### Carried over — small, unblocked - **A client that disappears mid-request leaves the body-copy task waiting.** The copy into git's stdin runs in its own task and nothing cancels it if the connection drops. Bounded by the backend exiting and closing the pipe, but not by anything deliberate. - **`REMOTE_USER` is not set on the backend**, so a push is recorded in the repository's reflog without naming who made it. Steid knows the actor by then; it simply is not passed through. Small, and worth doing before anything reads reflogs. - **No automated test asserts the security headers.** There is no HTTP-level test harness, so losing the CSP would be silent. The likeliest regression is someone using `insert()` instead of `or_insert()` and flattening the raw endpoint's stricter policy. - **`cargo audit` has never been run**, and the dependency tree has not been reviewed. - **No rate limiting on token authentication.** A token is 256 bits so guessing is not the worry; unbounded hashing on an open endpoint is. - **Tokens have no expiry and no last-used timestamp.** Both deliberate omissions for now — see [0007](decisions/0007-tokens-over-http-basic.md) — but a token list with no "last used" makes it hard to know which are safe to revoke. - **A subprocess per git request.** Unlike Milestone 3's once-per-creation, this is on a hot path and has not been measured. Milestone 5 is where that bill comes due. - **Streaming is by construction, not by measurement.** The response body is never collected, but no clone large enough to prove it has been run. - **An orphaned repo directory is possible** if the process dies between the record write and the filesystem write, and it then blocks re-creating that name. The durable fix is a reconciliation sweep on boot ([architecture.md](architecture.md#db-plus-filesystem-writes)); clearing one is a manual `rm` today, since repo deletion does not exist. - **The duplicate-name check races.** The loser is caught by `init_bare` or the unique constraint, but surfaces as an opaque storage error rather than "name taken". - **Bare repos created on macOS carry `ignorecase = true`.** A migration gotcha if the data directory ever moves to Linux. - **Light mode is still untested**, and now there is much more surface to get it wrong on — the file tree, the blob view and the log all shipped without anyone looking at them in light mode. - **Submodule rendering was never seen**, only compiled: no fixture contained one. - **The `/log` page's switcher opens with nothing marked current** when no revision is in the URL, because `repo_log` still does not report the revision it resolved. Now more visible than before, since there is a switcher to look wrong. - **Task-list items keep their bullet** and footnotes render in place rather than collected at the end. Both cosmetic. - **A per-file last-commit column is still absent**, deliberately — see [0006](decisions/0006-git-binary-behind-narrow-ports.md#amendment--20260829-the-milestone-5-read-path). Wanting it is the trigger to move to a kept-alive `cat-file --batch`, not to reopen `gix`. - **Fonts are not loaded.** The theme names Geist and IBM Plex Mono; both fall back today. Topcoat's `font-fontsource` feature handles it. - **Light mode is untested.** The palette defines it; nobody has looked at it. - **No rate limiting** on `/auth/login` or `/auth/setup`. - **`sweep_expired` is never called**, so expired session rows accumulate. Expiry is enforced on read, so this is tidiness, not a hole. - **CSRF.** `SameSite=Lax` covers the common case. Forms now exist, so this is decidable rather than hypothetical. ## Backlog Ordered. Pull from the top. 1. **Milestone 6 — Writing.** Posts, markdown, `/{handle}/posts/{slug}`. Open when it starts: which markdown crate, and whether raw HTML in markdown is trusted — safe for a single author, a stored-XSS hole the moment Milestone 7 adds a second user. A repository's README rendering on its page falls out of the same pipeline. ## Open questions - **Topcoat is early** (v0.5.0, first released 2026-07-22, breaking changes expected by its own authors). Expect churn that isn't feature work. - Topcoat ships Tailwind without Node, which reopens the design system attempt #1 dropped purely to avoid an npm build step — see [ui.md](ui.md). ## Routing findings (Milestone 0) - **Topcoat 0.5 requires rustc ≥ 1.95.** On an older toolchain `cargo add topcoat` silently resolves to an empty `topcoat v0.0.0` placeholder instead of failing. Local stable is now 1.97.1. - `Router::builder().discover()` collects `#[page]`-annotated items **at link time**, so pages can live in any module. Layering is our choice, not the framework's. - `module_router!` derives each URL from the module tree rather than a path string. Still deferred. Application routes now group cleanly (`auth/login`, `api/me`), but handles sit at the root ([0004](decisions/0004-root-handles-grouped-routes.md)), so a parameterised root segment still has to coexist with static ones. Worth checking how `module_router!` handles that before committing to it. - Path and query params are read from `Cx` via `path_param!` / `#[query_params]`, not injected as handler arguments. Parses are memoized per request. - Layouts wrap by path prefix and nest outermost-first, and a layout can catch a page's `NotFoundError` to render a branded 404. - `HOST` / `PORT` configure the bind address, so `STEID_LISTEN_ADDR` is gone. - `Body` is a boxed `http_body::Body` used for both requests and responses, with `into_data_stream()` to read and `Body::new()` to wrap a stream — pack data can stream both directions without buffering. This is what makes Milestone 4 viable.