From 6933ec28be3dac0dc17cd634c663db3b4818caad Mon Sep 17 00:00:00 2001
From: Doan Luu Duc Tai <doan@luuduct.ai>
Date: Fri, 30 Oct 2026 22:36:11 -0500
Subject: Centralize deployment settings in the root environment file

Document public domains, ports, upstreams, chat binding, and backup defaults alongside private settings. Validate shared configuration and render Caddy, cgit, and website links from an explicit public allowlist while preserving one installation environment file.
---
 crates/chat-server/src/http.rs | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

(limited to 'crates/chat-server/src/http.rs')

diff --git a/crates/chat-server/src/http.rs b/crates/chat-server/src/http.rs
index bb618d9..1c7286f 100644
--- a/crates/chat-server/src/http.rs
+++ b/crates/chat-server/src/http.rs
@@ -33,6 +33,7 @@ struct App {
     permits: Arc<Semaphore>,
     root: PathBuf,
     origin: String,
+    public: std::collections::BTreeMap<String, String>,
 }
 
 fn secured(mut response: Response) -> Response {
@@ -129,22 +130,33 @@ async fn asset(State(app): State<App>, uri: axum::http::Uri) -> Response {
         "/LICENSE" => ("LICENSE", "text/plain; charset=utf-8"),
         _ => return secured(StatusCode::NOT_FOUND.into_response()),
     };
-    tokio::fs::read(app.root.join(path)).await.map_or_else(
-        |_| secured(StatusCode::NOT_FOUND.into_response()),
-        |bytes| secured(([("content-type", mime)], bytes).into_response()),
-    )
+    let Ok(bytes) = tokio::fs::read(app.root.join(path)).await else {
+        return secured(StatusCode::NOT_FOUND.into_response());
+    };
+    if matches!(uri.path(), "/" | "/javascript.html") {
+        let rendered = String::from_utf8(bytes)
+            .map_err(anyhow::Error::from)
+            .and_then(|source| stack_config::render(&source, &app.public));
+        return rendered.map_or_else(
+            |_| secured(StatusCode::INTERNAL_SERVER_ERROR.into_response()),
+            |html| secured(([("content-type", mime)], html).into_response()),
+        );
+    }
+    secured(([("content-type", mime)], bytes).into_response())
 }
 
 pub(crate) async fn serve(
     listener: tokio::net::TcpListener,
     service: Service,
     root: &Path,
+    public: std::collections::BTreeMap<String, String>,
 ) -> Result<()> {
     let app = App {
         origin: service.origin.clone(),
         service: Arc::new(Mutex::new(service)),
         permits: Arc::new(Semaphore::new(4)),
         root: root.to_path_buf(),
+        public,
     };
     let routes = Router::new()
         .route("/api", post(api))
-- 
cgit v1.2.3