Running tranquil with `just run-dev` using `pds.test` seems to be broken due to a recent change that blocks requests to private ips. Inside the compose network `pds.test` resolves to the traefik container's private IP. So it can't make requests to stuff like `https://pds.test/oauth-client-metadata.json` or the local plc.
Introduces a new flag, default off, that allows connecting to private IPs, set to true for the dev compose.
Bluesky started sending `x-bsky-is-beta-user` for some users on XRPC requests, but tranquil has a strict allowlist of CORS headers. The spec doesn't (?) specify any requirements around CORS headers, so we can avoid trouble when Bluesky make changes by just allowing all headers.
This PR replaces the allowlist with the request mirror behavior, where any headers sent on a CORS request are echoed back. This also matches the reference PDS.
is_valid_uri required a literal "://", but the atproto uri string
format follows RFC 3986's generic URI grammar, which also allows
"scheme:opaque-part" forms with no authority (e.g. urn:isbn:...).
Records using such values were rejected once production lexicons
enable strict validation.
Reported as #130.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1. Set the max connections to 20, I frequently see
db-1 | 2026-08-23 08:57:02.784 UTC [12641] FATAL: sorry, too many clients already
2. Add a wildcard route in Traefik to serve DID documents locally.
3. Expose the PLC port locally so I can point an app at `http://localhost:2582` and be able to do full OAuth flows.
- eliminates panic opportunity on receiving email
- strict enum
- added unit test for ensuring that atmos headers don't leak onto
directmx
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a defaulted to off option to add the `X-Atmos-Category` headers
to emails sent via smarthost, for proper categorization by comail.
Category breakdown is as follows:
verification: EmailVerification, ChannelVerification, ChannelVerified,
MigrationVerification, LegacyLoginAlert, EmailUpdate, PlcOperation,
AccountDeletion
password-reset: PasswordReset, PasskeyRecovery
mfa-otp: TwoFactorCode
bulk: Welcome
untagged: AdminEmail
Remove the requirement that the user's did can be controlled by the
server rotation key and signing key. This was preventing users who
didn't want to trust the PDS with their rotation keys from activating
their accounts. Errors are removed but we issue debug messages.
TrezyandTangled
Johanna LarssonandTangled
Jack PlattenandTangled
blooym.devandTangled
Matan KushnerandTangled
Louis EscherandTangled
LewisandTangled
Edmund EdgarandTangled
nelind
LewisandTangled