Monorepo for Tangled
appview,localinfra: use bare ssh host and guard dev oauth loopback host
Niels Mokkenstorm
(Jul 22, 2026, 1:46 PM +0200)
0ded6dd7
a564d458
+16
-1
+10
appview/config/config.go
+10
appview/config/config.go
···
3
3
import (
4
4
"context"
5
5
"fmt"
6
+
"net"
6
7
"net/url"
7
8
"strings"
8
9
"time"
···
38
39
return "https://" + c.AppviewHost
39
40
}
40
41
return "http://" + c.AppviewHost
42
+
}
43
+
44
+
// Hostname returns AppviewHost with any port stripped, for consumers that need
45
+
// a bare host (e.g. an ssh destination) rather than a URL authority.
46
+
func (c *CoreConfig) Hostname() string {
47
+
if host, _, err := net.SplitHostPort(c.AppviewHost); err == nil {
48
+
return host
49
+
}
50
+
return c.AppviewHost
41
51
}
42
52
43
53
type OAuthConfig struct {
+3
appview/oauth/oauth.go
+3
appview/oauth/oauth.go
···
105
105
clientUri := config.Core.BaseUrl()
106
106
callbackUri := clientUri + "/oauth/callback"
107
107
if config.Core.Dev {
108
+
if config.Core.Hostname() == "localhost" {
109
+
logger.Warn("dev OAuth requires a loopback IP host; use 127.0.0.1 instead of 'localhost'", "host", config.Core.AppviewHost)
110
+
}
108
111
oauthConfig = oauth.NewLocalhostConfig(callbackUri, TangledScopes)
109
112
} else {
110
113
clientId := fmt.Sprintf("%s/oauth/client-metadata.json", clientUri)
+1
-1
appview/pipelines/pipelines.go
+1
-1
appview/pipelines/pipelines.go
···
241
241
if err != nil || port == "" {
242
242
return ""
243
243
}
244
-
return fmt.Sprintf("ssh -t -p %s %s %s %s", port, p.config.Core.AppviewHost, repoDid, sha)
244
+
return fmt.Sprintf("ssh -t -p %s %s %s %s", port, p.config.Core.Hostname(), repoDid, sha)
245
245
}
246
246
247
247
var upgrader = websocket.Upgrader{
+2
localinfra/readme.md
+2
localinfra/readme.md
···
51
51
This writes the image directory under `out/localinfra-spindle-images`.
52
52
5. `docker compose up`
53
53
6. AppView will be running on `127.0.0.1:3000` with two test users: `alice.pds.tngl.boltless.dev` and `bob.pds.tngl.boltless.dev`. Both with password `password`.
54
+
55
+
`TANGLED_APPVIEW_HOST` must be a loopback IP with the mapped port (`127.0.0.1:3000`), not `localhost`: atproto's dev OAuth client requires a loopback IP for the redirect URI. If you remap the published appview port, update `TANGLED_APPVIEW_HOST` in `docker-compose.yml` to match.