blinkers
A simple self-host service providing API keys for tightly scoped alterations to your atproto records blinkers.dev
atproto api
Star 3
Fork 0
Watch
153 4 5
Files
.beans
.changeset
.githooks
.railway
.tangled
ci
docs
lexicons
records
src
tests
wasm
web
.beans.yml
.dockerignore
.gitignore
.vale-ste.yml
at-sdp.json
Cargo.lock
Cargo.toml
CHANGELOG.md
CLAUDE.md
Dockerfile
knope.toml
PRODUCT.md
README.md
README.md

Blinkers #

An atproto app password can do anything to an account. Blinkers holds the password and hands out narrow API keys instead. Each key can read and change only the records, and the parts of those records, that a lens allows. The lens is a dev.blinkers.lens record in your own repo, so the policy is public and versioned; keys and passwords stay in the server's environment.

The docs and a guided setup are at blinkers.dev.

Releasing #

Describe each change that users would notice as you make it, and commit the file this writes to .changeset/:

knope document-change

After each push to main passes its checks, CI turns the pending changesets into a release PR, or adds a round to the one that's open. Merging that PR bumps the version in Cargo.toml and Cargo.lock and adds the changes to CHANGELOG.md. The next run on main sees an untagged version, so it pushes an annotated v<version> tag. The tag starts one workflow per target, because building them all in one would overrun Tangled's time limit. Each workflow builds its binary and attaches it to the tag. The Linux ones also push an image for their arch to seamark.cr as <version>-amd64 or <version>-arm64, and whichever finishes second joins the two into the multi-arch <version> and latest. ci/release.sh does each step, and .tangled/workflows/ says when.

When .railway/railway.ts changes, update the Railway template to match.

CI secrets #

Set these in the repo's pipeline settings on Tangled:

Secret Meaning
REPO_OWNER_APP_PASSWORD An app password for the account that owns this repo. CI uses it to write the release PR and the tag's artifacts to that account's PDS, to push the image, and to publish the site to wisp.place.
RELEASE_SSH_KEY A private SSH key that can push to this repo: the line between its PEM's BEGIN and END lines, or the whole PEM. CI pushes release tags with it.
AT_SDP_PRIVATE_KEY The private key at-sdp init printed. CI signs the site's static PDS commits with it.

Tangled caps secrets at 200 characters, which is too short for an OpenSSH-format key, so make an Ed25519 key in PKCS #8 form with OpenSSL 3. The second command prints the public key to add to the owner's SSH keys on Tangled, and the third prints the line to use as the secret:

openssl genpkey -algorithm ed25519 -out release-ssh-key.pem
echo "ssh-ed25519 $({ printf '\0\0\0\vssh-ed25519\0\0\0 '; openssl pkey -in release-ssh-key.pem -pubout -outform DER | tail -c 32; } | base64)"
sed -n 2p release-ssh-key.pem

Blinkers' logo was based on work by P Thanga Vignesh (CC BY 3.0).