mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-14 22:21:10 +02:00
This commit bundles two unrelated changes that were swept together by an
accidental `git add -A` in another working session. Documented here so the
history reflects what's actually inside.
═══════════════════════════════════════════════════════════════════════
1. fix(mana-auth): /api/v1/auth/login mints JWT via auth.handler instead
of api.signInEmail
═══════════════════════════════════════════════════════════════════════
Previous attempt (commit 55cc75e7d) tried to fix the broken JWT mint in
/api/v1/auth/login by switching the cookie name from `mana.session_token`
to `__Secure-mana.session_token` for production. That was necessary but
not sufficient: Better Auth's session cookie value isn't just the raw
session token, it's `<token>.<HMAC>` where the HMAC is derived from the
better-auth secret. Reconstructing the cookie from auth.api.signInEmail's
JSON response only gave us the raw token, so /api/auth/token's
get-session middleware still couldn't validate it and the JWT mint kept
silently failing.
Real fix: do the sign-in via auth.handler (the HTTP path) rather than
auth.api.signInEmail (the SDK path). The handler returns a real fetch
Response with a Set-Cookie header containing the fully signed cookie
envelope. We capture that header verbatim and forward it as the cookie
on the /api/auth/token request, which now passes validation and mints
the JWT correctly.
Verified end-to-end on auth.mana.how:
$ curl -X POST https://auth.mana.how/api/v1/auth/login \
-d '{"email":"...","password":"..."}'
{
"user": {...},
"token": "<session token>",
"accessToken": "eyJhbGciOiJFZERTQSI...", ← real JWT now
"refreshToken": "<session token>"
}
Side benefits:
- Email-not-verified path is now handled by checking
signInResponse.status === 403 directly, no more catching APIError
with the comment-noted async-stream footgun.
- X-Forwarded-For is forwarded explicitly so Better Auth's rate limiter
and our security log see the real client IP.
- The leftover catch block now only handles unexpected exceptions
(network errors etc); the FORBIDDEN-checking logic in it is dead but
harmless and left in for defense in depth.
═══════════════════════════════════════════════════════════════════════
2. chore: remove the entire self-hosted Matrix stack (Synapse, Element,
Manalink, mana-matrix-bot)
═══════════════════════════════════════════════════════════════════════
The Matrix subsystem ran parallel to the main Mana product without any
load-bearing integration: the unified web app never imported matrix-js-sdk,
the chat module uses mana-sync (local-first), and mana-matrix-bot's
plugins duplicated features the unified app already ships natively.
Keeping it alive cost a Synapse + Element + matrix-web + bot container
quartet, three Cloudflare routes, an OIDC provider plugin in mana-auth,
and a steady drip of devlog/dependency churn.
Removed:
- apps/matrix (Manalink web + mobile, ~150 files)
- services/mana-matrix-bot (Go bot with ~20 plugins)
- docker/matrix configs (Synapse + Element)
- synapse/element-web/matrix-web/mana-matrix-bot services in
docker-compose.macmini.yml
- matrix.mana.how/element.mana.how/link.mana.how Cloudflare tunnel routes
- OIDC provider plugin + matrix-synapse trustedClient + matrixUserLinks
table from mana-auth (oauth_* schema definitions also removed)
- MatrixService import path in mana-media (importFromMatrix endpoint)
- Matrix notification channel in mana-notify (worker, metrics, config,
channel_type enum, MatrixOptions handler)
- Matrix entries from shared-branding (mana-apps + app-icons),
notify-client, the i18n bundle, the observatory map, the credits
app-label list, the landing footer/apps page, the prometheus + alerts
+ promtail tier mappings, and the matrix-related deploy paths in
cd-macmini.yml + ci.yml
Devlog/manascore/blueprint entries that mention Matrix are left intact
as historical record. The oauth_* + matrix_user_links Postgres tables
stay on existing prod databases — code can no longer write to them, drop
them in a follow-up migration if you want them gone for real.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
123 lines
4.9 KiB
Bash
Executable file
123 lines
4.9 KiB
Bash
Executable file
#!/bin/bash
|
|
# Memory Baseline Script
|
|
# Run on the Mac Mini to measure actual container memory usage
|
|
# Usage: ./scripts/mac-mini/memory-baseline.sh [--watch]
|
|
|
|
set -euo pipefail
|
|
|
|
DOCKER="${DOCKER_CMD:-/usr/local/bin/docker}"
|
|
|
|
BOLD="\033[1m"
|
|
GREEN="\033[0;32m"
|
|
YELLOW="\033[0;33m"
|
|
RED="\033[0;31m"
|
|
CYAN="\033[0;36m"
|
|
RESET="\033[0m"
|
|
|
|
echo -e "${BOLD}╔══════════════════════════════════════════════════╗${RESET}"
|
|
echo -e "${BOLD}║ Mana Docker Memory Baseline Report ║${RESET}"
|
|
echo -e "${BOLD}╚══════════════════════════════════════════════════╝${RESET}"
|
|
echo ""
|
|
echo -e "${CYAN}Timestamp:${RESET} $(date '+%Y-%m-%d %H:%M:%S')"
|
|
echo ""
|
|
|
|
# Get Colima VM memory
|
|
COLIMA_MEM=$(colima list -j 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(d[0].get('memory',0))" 2>/dev/null || echo "unknown")
|
|
if [ "$COLIMA_MEM" != "unknown" ] && [ "$COLIMA_MEM" -gt 0 ] 2>/dev/null; then
|
|
COLIMA_MEM_GB=$(echo "scale=1; $COLIMA_MEM / 1073741824" | bc 2>/dev/null || echo "$COLIMA_MEM")
|
|
echo -e "${CYAN}Colima VM Memory:${RESET} ${COLIMA_MEM_GB} GB"
|
|
else
|
|
echo -e "${CYAN}Colima VM Memory:${RESET} (run 'colima list' to check)"
|
|
fi
|
|
echo ""
|
|
|
|
# Docker stats snapshot (no-stream = one-shot)
|
|
echo -e "${BOLD}── Per-Container Memory Usage ──${RESET}"
|
|
echo ""
|
|
printf "${BOLD}%-40s %10s %10s %10s${RESET}\n" "CONTAINER" "MEM USAGE" "MEM LIMIT" "MEM %"
|
|
echo "────────────────────────────────────────────────────────────────────────"
|
|
|
|
# Collect stats and sort by memory usage (descending)
|
|
$DOCKER stats --no-stream --format "{{.Name}}\t{{.MemUsage}}\t{{.MemPerc}}" | \
|
|
sort -t$'\t' -k2 -h -r | \
|
|
while IFS=$'\t' read -r name usage perc; do
|
|
# Extract just the usage part (before " / ")
|
|
mem_used=$(echo "$usage" | cut -d'/' -f1 | xargs)
|
|
mem_limit=$(echo "$usage" | cut -d'/' -f2 | xargs)
|
|
perc_num=$(echo "$perc" | tr -d '%')
|
|
|
|
# Color based on percentage
|
|
if (( $(echo "$perc_num > 80" | bc -l 2>/dev/null || echo 0) )); then
|
|
COLOR=$RED
|
|
elif (( $(echo "$perc_num > 50" | bc -l 2>/dev/null || echo 0) )); then
|
|
COLOR=$YELLOW
|
|
else
|
|
COLOR=$GREEN
|
|
fi
|
|
|
|
printf "%-40s %10s %10s ${COLOR}%10s${RESET}\n" "$name" "$mem_used" "$mem_limit" "$perc"
|
|
done
|
|
|
|
echo ""
|
|
echo -e "${BOLD}── Category Summary ──${RESET}"
|
|
echo ""
|
|
|
|
# Category totals using $DOCKER stats
|
|
get_category_mem() {
|
|
local pattern="$1"
|
|
$DOCKER stats --no-stream --format "{{.Name}}\t{{.MemUsage}}" | \
|
|
grep "$pattern" | \
|
|
awk -F'\t' '{
|
|
split($2, a, "/");
|
|
gsub(/[[:space:]]/, "", a[1]);
|
|
val = a[1];
|
|
if (index(val, "GiB") > 0) { gsub(/GiB/, "", val); total += val * 1024; }
|
|
else if (index(val, "MiB") > 0) { gsub(/MiB/, "", val); total += val; }
|
|
else if (index(val, "KiB") > 0) { gsub(/KiB/, "", val); total += val / 1024; }
|
|
} END { printf "%.0f", total }'
|
|
}
|
|
|
|
infra=$(get_category_mem "mana-infra")
|
|
core=$(get_category_mem "mana-core\|mana-auth\|mana-credits\|mana-user\|mana-subscriptions\|mana-analytics\|mana-api-gateway\|mana-crawler\|mana-service")
|
|
apps=$(get_category_mem "mana-app")
|
|
monitoring=$(get_category_mem "mana-mon")
|
|
games=$(get_category_mem "mana-game")
|
|
auto=$(get_category_mem "mana-auto")
|
|
|
|
total=$((infra + core + apps + monitoring + games + auto))
|
|
|
|
printf "%-25s %8s MiB\n" "Infrastructure:" "$infra"
|
|
printf "%-25s %8s MiB\n" "Core Services:" "$core"
|
|
printf "%-25s %8s MiB\n" "Web Apps:" "$apps"
|
|
printf "%-25s %8s MiB\n" "Monitoring:" "$monitoring"
|
|
printf "%-25s %8s MiB\n" "Games:" "$games"
|
|
printf "%-25s %8s MiB\n" "Automation:" "$auto"
|
|
echo "─────────────────────────────────────"
|
|
printf "${BOLD}%-25s %8s MiB (%.1f GiB)${RESET}\n" "TOTAL:" "$total" "$(echo "scale=1; $total / 1024" | bc)"
|
|
|
|
echo ""
|
|
echo -e "${BOLD}── Container Count ──${RESET}"
|
|
echo ""
|
|
running=$($DOCKER ps -q | wc -l | xargs)
|
|
stopped=$($DOCKER ps -aq --filter "status=exited" | wc -l | xargs)
|
|
echo "Running: $running | Stopped: $stopped | Total: $((running + stopped))"
|
|
|
|
echo ""
|
|
echo -e "${BOLD}── Recommendations ──${RESET}"
|
|
echo ""
|
|
|
|
if [ "$total" -gt 10240 ]; then
|
|
echo -e "${RED}WARNING: Total usage exceeds 10 GiB — builds will struggle${RESET}"
|
|
elif [ "$total" -gt 8192 ]; then
|
|
echo -e "${YELLOW}NOTICE: Usage above 8 GiB — builds may need monitoring stopped${RESET}"
|
|
else
|
|
echo -e "${GREEN}OK: Usage under 8 GiB — sufficient headroom for builds${RESET}"
|
|
fi
|
|
|
|
# Watch mode
|
|
if [ "${1:-}" = "--watch" ]; then
|
|
echo ""
|
|
echo -e "${CYAN}Entering watch mode (Ctrl+C to exit)...${RESET}"
|
|
echo ""
|
|
$DOCKER stats --format "table {{.Name}}\t{{.MemUsage}}\t{{.MemPerc}}\t{{.CPUPerc}}"
|
|
fi
|