1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
|
Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
FILE MAP
Public tree: every tracked file, including this map.
Static inventory; update when public paths change. Root: stack/.
Private/generated trees below list roles only; contents stay unlisted.
stack/ Personal service source, build recipes and recovery tooling.
|-- .cargo/ Cargo command aliases.
| `-- config.toml Cargo stack alias.
|-- crates/ Workspace application/configuration crates.
| |-- chat-crypto/ Fixed-suite Rust and browser cryptography.
| | |-- browser/ Browser crypto types and WASI adapter.
| | | |-- protocol.d.ts Shared typed API, crypto, worker, WASI message contracts.
| | | `-- wasi.ts Browser WASI host: memory, I/O, entropy, command execution.
| | |-- src/ Rust crypto library and executable.
| | | |-- application.rs Protected identities, authentication proofs, message encryption/decryption.
| | | |-- lib.rs Public crypto API and fixed-suite compatibility round trip.
| | | `-- main.rs Native/WASI executable: request input and crypto result output.
| | |-- tests/ Real-browser crypto compatibility tests.
| | | `-- browser.ts Real-browser crypto probe, entropy-failure and network-isolation checks.
| | |-- Cargo.toml Crypto library/probe targets, fixed backend features, dependencies.
| | `-- README.txt Crypto suite, native/WASI build, compatibility checks.
| |-- chat-server/ Private-chat backend and browser client.
| | |-- src/ Rust HTTP server and maintenance entry.
| | | |-- app/ Server argument, HTTP, service and storage modules.
| | | | |-- cli.rs Server flags, listener defaults, maintenance argument conflicts.
| | | | |-- http.rs HTTP routes, packaged assets, response security headers.
| | | | |-- maintenance.rs Server file lock, owner fingerprint, destructive owner reset.
| | | | |-- service.rs Authentication challenges/sessions, authorization, chat operations.
| | | | `-- store.rs SQLite owner metadata, conversations, ciphertext history persistence.
| | | |-- app.rs Server initialization, origin/listener checks, command dispatch.
| | | `-- main.rs Chat server executable entry point.
| | |-- tests/ Chat browser integration and loading-state tests.
| | | |-- browser.ts Chat browser flows, owner/visitor access, packaged backup/restore.
| | | `-- progress.ts Crypto-download progress, unknown length, failure and LibreJS checks.
| | |-- web/ Chat markup, styling and TypeScript client.
| | | |-- app.ts Chat browser UI, credentials, API calls, encrypted conversations.
| | | |-- index.html Chat page markup and public-origin template.
| | | |-- javascript.html Browser JavaScript license/source listing.
| | | |-- style.css Chat page layout, controls, status and conversation styling.
| | | `-- worker.ts One-operation crypto worker; returns result/error, then closes.
| | |-- Cargo.toml Chat HTTP server dependencies and workspace lint inheritance.
| | `-- README.txt Server purpose, local startup, browser-test entry.
| |-- config/ Shared environment/configuration crate.
| | |-- src/ Validated configuration and public-rendering implementation.
| | | `-- lib.rs Root .env parsing/validation, defaults, public-only template values.
| | |-- Cargo.toml Shared configuration crate dependencies and lint inheritance.
| | `-- README.txt Configuration crate responsibilities and public rendering boundary.
| `-- README.txt Workspace crate roles and shared policy.
|-- docs/ Plaintext setup, policy, security and recovery guides.
| |-- CHAT-APPLICATION.txt Chat setup, protected files, user flows, recovery, security limits.
| |-- CHAT-OPENSSL-MIGRATION.txt OpenSSL crypto migration evidence, dependencies, reviewed exceptions.
| |-- CHAT-PRODUCTION.txt Chat release packaging, HTTPS activation, owner setup, production recovery.
| |-- CONFIGURATION.txt Supported root settings, validation, public/private state boundaries.
| |-- LINTING.txt Strict Rust/browser checks, generated-code limits, justified exceptions.
| |-- MAP.txt This public-file tree and private/runtime directory roles.
| |-- OPERATIONS.txt Stack development, encrypted backup/restore, host setup, deployment.
| |-- POLICY.txt License/header, source-comment, configuration, strictness and portability rules.
| `-- TYPESCRIPT.txt Typed browser/worker/test builds, ESLint policy, compiler/test commands.
|-- infra/ Service definitions, host integration and build recipes.
| |-- chat/ Native/WASI/TypeScript/source build scripts.
| | |-- build-browser.sh Link Rust/OpenSSL browser crypto command into WASI WebAssembly.
| | |-- build-native.sh Build static musl management/server commands and native crypto probe.
| | |-- build-openssl-wasi.sh Fetch verified SDK/OpenSSL sources; build browser crypto library.
| | |-- build-source.sh Archive corresponding source, vendored Rust crates and OpenSSL source.
| | |-- build-typescript.sh Install locked dev dependencies; run typed checks and emit browser JS.
| | `-- openssl-wasi.conf OpenSSL build target settings for WASI.
| |-- containers/ Container build contexts.
| | |-- cgit/ cgit image and its nginx/FastCGI process configuration.
| | | |-- .containerignore Restrict cgit build context to required container files.
| | | |-- Containerfile Build pinned Debian cgit/nginx/FastCGI/supervisor image.
| | | |-- cgitrc cgit repository listing, paths and presentation template.
| | | |-- entrypoint.sh Prepare cgit container runtime and start its supervisor.
| | | |-- nginx.conf Serve cgit HTTP/static assets; route CGI through fcgiwrap.
| | | `-- supervisord.conf Run nginx and fcgiwrap inside the cgit container.
| | `-- chat/ Prebuilt chat image recipe.
| | `-- Containerfile Package prebuilt static chat server and web/crypto assets.
| |-- searxng/ Search service configuration.
| | `-- settings.yml SearXNG defaults: private instance, rate limiting, HTML search.
| |-- Caddyfile Production domain routing, HTTPS, WKD and service reverse proxies.
| |-- Caddyfile.local Loopback development routing without public certificate requests.
| |-- host-setup.sh Debian ops-user Podman packages, UID/GID checks, low ports and linger.
| |-- podman.conf Legacy Podman override selecting slirp4netns rootless networking.
| |-- services.toml Service images, mounts, environment allowlists, security and health probes.
| `-- stack.service Systemd user boot unit for ~/stack start/stop.
|-- src/ Management executable source.
| |-- app/ Management command implementation modules.
| | |-- archive.rs Consistent snapshots, encrypted exports and validated directory restores.
| | |-- chat.rs Chat build/package artifacts, container settings and owner administration.
| | |-- cli.rs Management subcommands, flags and argument validation.
| | |-- files.rs Safe filesystem/archive operations, manifests and hashes.
| | |-- images.rs Export/import exact container images; enforce platform and content locks.
| | |-- process.rs Run child processes; capture output and report failures/status.
| | |-- project.rs Discover/lock project; settings, Podman commands, service lifecycle.
| | |-- release.rs Build checked release archives; validate/install production artifacts.
| | `-- render.rs Render per-mode Caddy, website and cgit configuration.
| |-- app.rs Management command dispatch, check pipeline and license generation.
| `-- main.rs Management executable entry point.
|-- tests/ Shared first-party browser-test helpers.
| `-- browser-support.ts Shared browser-test response validators, server and browser cleanup helpers.
|-- web/ Main-site template, styles, licenses and public key discovery.
| |-- .well-known/ Standard public discovery endpoints.
| | `-- openpgpkey/ WKD public-key discovery tree.
| | |-- hu/ Direct WKD hashed-user key files.
| | | `-- t76q8xqkeassgy1kr38re1ppj6cpc1dp Owner public key for direct WKD lookup.
| | |-- luuduct.ai/ Advanced WKD namespace for luuduct.ai.
| | | |-- hu/ Advanced WKD hashed-user key files.
| | | | `-- t76q8xqkeassgy1kr38re1ppj6cpc1dp Same owner public key for advanced luuduct.ai WKD lookup.
| | | `-- policy Advanced WKD policy marker for luuduct.ai.
| | `-- policy Direct WKD policy marker.
| |-- THIRD-PARTY-LICENSES.html Generated Rust dependency attribution and full license texts.
| |-- index.html Main-site public links, identity and service-origin template.
| `-- styles.css Main-site visual layout, links and tooltips.
|-- .env.example Public settings template; private-value placeholders.
|-- .gitattributes Whitespace handling for generated third-party license HTML.
|-- .gitignore Exclude secrets, runtime state, dependencies, build output.
|-- Cargo.lock Exact Rust dependency versions and source checksums.
|-- Cargo.toml Management binary, workspace members, dependencies, strict lints.
|-- LICENSE Unmodified GNU AGPLv3 license text; sources allow later versions.
|-- README.txt Project entry: setup, commands, checks, documentation links.
|-- about.hbs HTML template for generated Rust dependency licenses.
|-- about.toml License-page acceptance list and private-package handling.
|-- clippy.toml Reviewed duplicate-crate exceptions for Clippy.
|-- deny.toml Dependency advisory, license, source and duplicate-version policy.
|-- eslint.config.ts Typed ESLint rules and per-environment file scopes.
|-- package-lock.json Exact npm dev dependency versions, integrity and dependency graph.
|-- package.json Browser tooling dependencies and npm check/build/test commands.
|-- rust-toolchain.toml Pinned Rust version, formatting/lint components and target triples.
|-- tsconfig.browser.json Browser main-thread and WASI-host compiler scope.
|-- tsconfig.json Shared strict TypeScript compiler options.
|-- tsconfig.tests.json Node browser-automation compiler scope.
|-- tsconfig.tools.json Node ESLint configuration compiler scope.
`-- tsconfig.worker.json Web-worker compiler scope, separate from DOM globals.
PRIVATE AND GENERATED PATHS — NOT PUBLIC SOURCE
.env Sole private root configuration; never commit.
.git/ Local Git objects, refs, hooks and repository settings.
.tools/ Downloaded toolchains, build tools, sources and caches.
bin/ Prebuilt management/chat commands and packaged chat assets.
dist/ Locally built release tarballs and checksum files.
node_modules/ Locked npm development dependencies; recreated by npm ci.
target/ Cargo build output, WASM targets and generated rustdoc.
var/ Private/generated project state; excluded from Git.
backups/ Imported backup archives and recovery test destinations.
build/ Generated TypeScript, source/vendor bundles and build work.
data/ Persistent application databases, TLS keys and Git repos.
caddy/ ACME account/certificate keys, Caddy data/configuration.
chat/ Production chat database: owner identity and ciphertext.
chat-local/ Isolated local chat database and server state.
repos/ Served bare Git repositories; separate from root .git/.
searxng/ Runtime search configuration and persistent service files.
exports/ Encrypted application backups and checksum files.
incoming/ Copied release archives and temporary deployment bootstrap.
podman/ Recreated container storage/run state; never transfer as backup.
graphify/ Public-source graph index, visual map and extraction artifacts.
Other var/ paths may hold generated fixtures or temporary work. This map does
not enumerate private files. Backups must keep .env and var/data; public Git
alone cannot recover services. See OPERATIONS.txt.
|
