bonheur15/tech-in-rwanda

Just criticing tech n rwanda # Rwanda Free Space Rwanda Free Space is a same-origin publishing platform for constructive criticism of technology in Rwanda. Astro SSR owns public rendering and the React/TipTap writing workspace. Go owns authentication, authorization, editorial state, media, comments, persistence, and operational tooling. There are deliberately no passwords, JWTs, analytics libraries, page-view records, or reader-behavior tracking. ## Local development ```sh npm install cp .env.example .env make bootstrap-superadmin EMAIL=editor@example.com HANDLE=editor NAME="First Editor" make dev ``` Open `127.0.0.1` for the publication and `/workspace/` for staff. Development OTP codes are printed only by the Go terminal mailer. The terminal sender is rejected when `APP_ENV=production`. `make dev` starts Astro on 4321 and Go on 8787 with coordinated shutdown. Astro proxies `/api/*` and `/media/*`, so browsers always use a same-origin API. Local data lives under `.data/`. ## Data and security model - SQLite enables WAL, foreign keys, a five-second busy timeout, bounded connections, and embedded forward-only migrations. - Staff and reader tokens are opaque. Only HMAC-SHA256 digests are stored. - Production requires HTTPS, secure `__Host-` cookies, SMTP, real Turnstile credentials, and independent 32-character or longer session and OTP peppers. - Reader Turnstile tokens are verified server-side and are never trusted from client state. - Published pages read immutable versions through `published_version_id`; autosave can never alter the live article. - Uploads accept decoded JPEG/PNG only, enforce 15 MiB and 30 MP limits, strip metadata by re-encoding, and create four responsive derivatives. Run `make check` for generated-client drift, formatting, vet, race tests, frontend tests, Astro checks, and production builds. Run `make smoke` for the compiled two-process topology. ## Operations ```sh make migrate-status make backup FILE=rfs-backup.tar.gz make verify-backup FILE=rfs- …