Brandon LiandClaude Opus 5
035f93d220
The dashboard-hosting stack from the previous commit is gone; it was answering a question nobody asked. What was actually needed is Chrome's real update channel, which an unpacked extension does not have and cannot be given. So the extension is now signed into a CRX with an update manifest beside it, served from the droplet, and installed on the trading machines by policy (ExtensionInstallForcelist). From there Chrome installs it, updates it on its own schedule, and puts it back if it goes missing. The manifest gained the `key` that fixes the extension id, so an unpacked development load keeps the same identity as the published build. The self-update check now branches on how it was installed: policy installs ask Chrome to check the update server now rather than waiting out its five-hour cycle, and unpacked loads keep the reload-from-disk path. chrome.management .getSelf() tells the two apart and needs no permission to do it. The signing key lives at /opt/autofirmer-updates/key.pem on the droplet and nowhere else. It is the extension's identity: a different key is a different extension, and no browser would take it as an update. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
19 lines
871 B
Bash
19 lines
871 B
Bash
# The hostname the update server answers on. It has to match the `update_url` in
|
|
# extension/manifest.json — Chrome checks the one baked into the extension, not
|
|
# this — and needs an A record pointing at the droplet before bootstrap-tls.sh
|
|
# can get a certificate for it.
|
|
EXT_HOST=ext.example.com
|
|
|
|
# Where the signing key and the served files live. Outside the checkout on
|
|
# purpose: the private key must never be committed, and a release should survive
|
|
# `git clean`.
|
|
UPDATES_DIR=/opt/autofirmer-updates
|
|
|
|
# Where the autotrader stack lives. Its nginx is the shared ingress, its certbot
|
|
# issues the certificates, and its compose project owns the network this joins.
|
|
SHARED_STACK=/opt/autotrader/deploy
|
|
|
|
# The docker network that stack created. Only set this if you renamed the
|
|
# project — the default matches `docker network ls`.
|
|
SHARED_NETWORK=autotrader-vps_web
|