Browse Source
This commit allows skipping authentication, permission checks, and certain filters (e.g., deletions, expirations) when the ACL mode is set to "none" (open relay mode). It also introduces a configuration option to disable query caching to reduce memory usage. These changes improve operational flexibility for open relay setups and resource-constrained environments.main
mleku
1 month ago
19 changed files with 201 additions and 285 deletions
@ -1,190 +1,21 @@
@@ -1,190 +1,21 @@
|
||||
{ |
||||
"permissions": { |
||||
"allow": [ |
||||
"Skill(skill-creator)", |
||||
"Bash(cat:*)", |
||||
"Bash(python3:*)", |
||||
"Bash(find:*)", |
||||
"Skill(nostr-websocket)", |
||||
"Bash:*", |
||||
"Edit:*", |
||||
"Glob:*", |
||||
"Grep:*", |
||||
"Read:*", |
||||
"Skill:*", |
||||
"WebFetch:*", |
||||
"WebSearch:*", |
||||
"Write:*", |
||||
"Bash(go build:*)", |
||||
"Bash(chmod:*)", |
||||
"Bash(journalctl:*)", |
||||
"Bash(timeout 5 bash -c 'echo [\"\"REQ\"\",\"\"test123\"\",{\"\"kinds\"\":[1],\"\"limit\"\":1}] | websocat ws://localhost:3334':*)", |
||||
"Bash(pkill:*)", |
||||
"Bash(timeout 5 bash:*)", |
||||
"Bash(md5sum:*)", |
||||
"Bash(timeout 3 bash -c 'echo [\\\"\"REQ\\\"\",\\\"\"test456\\\"\",{\\\"\"kinds\\\"\":[1],\\\"\"limit\\\"\":10}] | websocat ws://localhost:3334')", |
||||
"Bash(printf:*)", |
||||
"Bash(websocat:*)", |
||||
"Bash(go test:*)", |
||||
"Bash(timeout 180 go test:*)", |
||||
"WebFetch(domain:github.com)", |
||||
"WebFetch(domain:raw.githubusercontent.com)", |
||||
"Bash(/tmp/find help)", |
||||
"Bash(/tmp/find verify-name example.com)", |
||||
"Skill(golang)", |
||||
"Bash(/tmp/find verify-name Bitcoin.Nostr)", |
||||
"Bash(/tmp/find generate-key)", |
||||
"Bash(git ls-tree:*)", |
||||
"Bash(CGO_ENABLED=0 go build:*)", |
||||
"Bash(CGO_ENABLED=0 go test:*)", |
||||
"Bash(app/web/dist/index.html)", |
||||
"Bash(export CGO_ENABLED=0)", |
||||
"Bash(bash:*)", |
||||
"Bash(CGO_ENABLED=0 ORLY_LOG_LEVEL=debug go test:*)", |
||||
"Bash(/tmp/test-policy-script.sh)", |
||||
"Bash(docker --version:*)", |
||||
"Bash(mkdir:*)", |
||||
"Bash(./test-docker-policy/test-policy.sh:*)", |
||||
"Bash(docker-compose:*)", |
||||
"Bash(tee:*)", |
||||
"Bash(docker logs:*)", |
||||
"Bash(timeout 5 websocat:*)", |
||||
"Bash(docker exec:*)", |
||||
"Bash(TESTSIG=\"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\":*)", |
||||
"Bash(echo:*)", |
||||
"Bash(git rm:*)", |
||||
"Bash(git add:*)", |
||||
"Bash(./test-policy.sh:*)", |
||||
"Bash(docker rm:*)", |
||||
"Bash(./scripts/docker-policy/test-policy.sh:*)", |
||||
"Bash(./policytest:*)", |
||||
"WebSearch", |
||||
"WebFetch(domain:blog.scottlogic.com)", |
||||
"WebFetch(domain:eli.thegreenplace.net)", |
||||
"WebFetch(domain:learn-wasm.dev)", |
||||
"Bash(curl:*)", |
||||
"Bash(./build.sh)", |
||||
"Bash(./pkg/wasm/shell/run.sh:*)", |
||||
"Bash(./run.sh echo.wasm)", |
||||
"Bash(./test.sh)", |
||||
"Bash(ORLY_PPROF=cpu ORLY_LOG_LEVEL=info ORLY_LISTEN=0.0.0.0 ORLY_PORT=3334 ORLY_ADMINS=npub1fjqqy4a93z5zsjwsfxqhc2764kvykfdyttvldkkkdera8dr78vhsmmleku ORLY_OWNERS=npub1fjqqy4a93z5zsjwsfxqhc2764kvykfdyttvldkkkdera8dr78vhsmmleku ORLY_ACL_MODE=follows ORLY_SPIDER_MODE=follows timeout 120 go run:*)", |
||||
"Bash(go tool pprof:*)", |
||||
"Bash(go get:*)", |
||||
"Bash(go mod tidy:*)", |
||||
"Bash(go list:*)", |
||||
"Bash(timeout 180 go build:*)", |
||||
"Bash(timeout 240 go build:*)", |
||||
"Bash(timeout 300 go build:*)", |
||||
"Bash(/tmp/orly:*)", |
||||
"Bash(./orly version:*)", |
||||
"Bash(git checkout:*)", |
||||
"Bash(docker ps:*)", |
||||
"Bash(./run-profile.sh:*)", |
||||
"Bash(sudo rm:*)", |
||||
"Bash(docker compose:*)", |
||||
"Bash(./run-benchmark.sh:*)", |
||||
"Bash(docker run:*)", |
||||
"Bash(docker inspect:*)", |
||||
"Bash(./run-benchmark-clean.sh:*)", |
||||
"Bash(cd:*)", |
||||
"Bash(CGO_ENABLED=0 timeout 180 go build:*)", |
||||
"Bash(/home/mleku/src/next.orly.dev/pkg/dgraph/dgraph.go)", |
||||
"Bash(ORLY_LOG_LEVEL=debug timeout 60 ./orly:*)", |
||||
"Bash(ORLY_LOG_LEVEL=debug timeout 30 ./orly:*)", |
||||
"Bash(killall:*)", |
||||
"Bash(kill:*)", |
||||
"Bash(gh repo list:*)", |
||||
"Bash(gh auth:*)", |
||||
"Bash(/tmp/backup-github-repos.sh)", |
||||
"Bash(./benchmark:*)", |
||||
"Bash(env)", |
||||
"Bash(./run-badger-benchmark.sh:*)", |
||||
"Bash(./update-github-vpn.sh:*)", |
||||
"Bash(dmesg:*)", |
||||
"Bash(export:*)", |
||||
"Bash(timeout 60 /tmp/benchmark-fixed:*)", |
||||
"Bash(/tmp/test-auth-event.sh)", |
||||
"Bash(CGO_ENABLED=0 timeout 180 go test:*)", |
||||
"Bash(/tmp/benchmark-real-events:*)", |
||||
"Bash(CGO_ENABLED=0 timeout 240 go build:*)", |
||||
"Bash(/tmp/benchmark-final --events 500 --workers 2 --datadir /tmp/test-real-final)", |
||||
"Bash(timeout 60 /tmp/benchmark-final:*)", |
||||
"Bash(timeout 120 ./benchmark:*)", |
||||
"Bash(timeout 60 ./benchmark:*)", |
||||
"Bash(timeout 30 ./benchmark:*)", |
||||
"Bash(timeout 15 ./benchmark:*)", |
||||
"Bash(docker build:*)", |
||||
"Bash(xargs:*)", |
||||
"Bash(timeout 30 sh:*)", |
||||
"Bash(timeout 60 go test:*)", |
||||
"Bash(timeout 120 go test:*)", |
||||
"Bash(timeout 180 ./scripts/test.sh:*)", |
||||
"Bash(CGO_ENABLED=0 timeout 60 go test:*)", |
||||
"Bash(CGO_ENABLED=1 go build:*)", |
||||
"Bash(lynx:*)", |
||||
"Bash(sed:*)", |
||||
"Bash(docker stop:*)", |
||||
"Bash(grep:*)", |
||||
"Bash(timeout 30 go test:*)", |
||||
"Bash(tree:*)", |
||||
"Bash(timeout 180 ./migrate-imports.sh:*)", |
||||
"Bash(./migrate-fast.sh:*)", |
||||
"Bash(git restore:*)", |
||||
"Bash(go mod download:*)", |
||||
"Bash(go clean:*)", |
||||
"Bash(GOSUMDB=off CGO_ENABLED=0 timeout 240 go build:*)", |
||||
"Bash(CGO_ENABLED=0 GOFLAGS=-mod=mod timeout 240 go build:*)", |
||||
"Bash(CGO_ENABLED=0 timeout 120 go test:*)", |
||||
"Bash(./cmd/blossomtest/blossomtest:*)", |
||||
"Bash(sudo journalctl:*)", |
||||
"Bash(systemctl:*)", |
||||
"Bash(systemctl show:*)", |
||||
"Bash(ssh relay1:*)", |
||||
"Bash(done)", |
||||
"Bash(go run:*)", |
||||
"Bash(go doc:*)", |
||||
"Bash(/tmp/orly-test help:*)", |
||||
"Bash(go version:*)", |
||||
"Bash(ss:*)", |
||||
"Bash(CGO_ENABLED=0 go clean:*)", |
||||
"Bash(CGO_ENABLED=0 timeout 30 go test:*)", |
||||
"Bash(~/.local/bin/tea issue 6 --repo mleku/next.orly.dev --remote https://git.nostrdev.com)", |
||||
"Bash(tea issue:*)", |
||||
"Bash(tea issues view:*)", |
||||
"Bash(tea issue view:*)", |
||||
"Bash(tea issues:*)", |
||||
"Bash(bun run build:*)", |
||||
"Bash(git tag:*)", |
||||
"Bash(/tmp/orly-test version:*)", |
||||
"Bash(git log:*)", |
||||
"Bash(git show:*)", |
||||
"Bash(git config:*)", |
||||
"Bash(git check-ignore:*)", |
||||
"Bash(git commit:*)", |
||||
"WebFetch(domain:www.npmjs.com)", |
||||
"Bash(git stash:*)", |
||||
"WebFetch(domain:arxiv.org)", |
||||
"WebFetch(domain:hal.science)", |
||||
"WebFetch(domain:pkg.go.dev)", |
||||
"Bash(GOOS=js GOARCH=wasm CGO_ENABLED=0 go build:*)", |
||||
"Bash(GOOS=js GOARCH=wasm go doc:*)", |
||||
"Bash(GOOS=js GOARCH=wasm CGO_ENABLED=0 go test:*)", |
||||
"Bash(node --version:*)", |
||||
"Bash(npm install)", |
||||
"Bash(node run_wasm_tests.mjs:*)", |
||||
"Bash(go env:*)", |
||||
"Bash(GOROOT=/home/mleku/go node run_wasm_tests.mjs:*)", |
||||
"Bash(./orly:*)", |
||||
"Bash(./orly -version:*)", |
||||
"Bash(./orly --version:*)", |
||||
"Bash(GOOS=js GOARCH=wasm go test:*)", |
||||
"Bash(ls:*)", |
||||
"Bash(GOROOT=/home/mleku/go node:*)", |
||||
"Bash(GOOS=js GOARCH=wasm go build:*)", |
||||
"Bash(go mod graph:*)", |
||||
"Bash(xxd:*)", |
||||
"Bash(CGO_ENABLED=0 go mod tidy:*)", |
||||
"WebFetch(domain:git.mleku.dev)", |
||||
"Bash(CGO_ENABLED=0 LOG_LEVEL=trace go test:*)", |
||||
"Bash(go vet:*)", |
||||
"Bash(gofmt:*)", |
||||
"Skill(cypher)", |
||||
"Bash(git mv:*)", |
||||
"Bash(CGO_ENABLED=0 go run:*)" |
||||
"Bash(./scripts/test.sh:*)" |
||||
], |
||||
"deny": [], |
||||
"ask": [] |
||||
}, |
||||
"outputStyle": "Explanatory" |
||||
"outputStyle": "Default" |
||||
} |
||||
|
||||
@ -0,0 +1,18 @@
@@ -0,0 +1,18 @@
|
||||
// Package mode provides a global ACL mode indicator that can be read by
|
||||
// packages that need to know the current access control mode without creating
|
||||
// circular dependencies.
|
||||
package mode |
||||
|
||||
import "next.orly.dev/pkg/utils/atomic" |
||||
|
||||
// ACLMode holds the current ACL mode as a string.
|
||||
// This is set by the ACL package when configured and can be read by other
|
||||
// packages (like database) to adjust their behavior.
|
||||
var ACLMode atomic.String |
||||
|
||||
// IsOpen returns true if the ACL mode is "none" (open relay mode).
|
||||
// In open mode, security filtering (expiration, deletion, privileged events)
|
||||
// should be disabled.
|
||||
func IsOpen() bool { |
||||
return ACLMode.Load() == "none" |
||||
} |
||||
Loading…
Reference in new issue