chore: cleanup and last minute bug fixes before prod push

.gitignore

···
 CLAUDE.local.md
 Cargo.lock
 /keys.json
-/.vscode/launch.json
+/.vscode/launch.json
+.*.env
+.env

Cargo.toml

···
 name = "smokesignal"
 version = "0.1.0"
 edition = "2021"
-rust-version = "1.86"
+rust-version = "1.83"
 authors = ["Nick Gerakines <[e-mail]>"]
 description = "An event and RSVP management application."
 readme = "README.md"
···
 cookie = "0.18"
 ammonia = "4"
 rust-embed = "8.5"
-sqlx = { version = "0.8", default-features = false, features = ["derive", "macros", "migrate", "json", "runtime-tokio", "postgres", "chrono", "tls-rustls"] }
+sqlx = { version = "0.8", default-features = false, features = ["derive", "macros", "migrate", "json", "runtime-tokio", "postgres", "chrono", "tls-rustls-ring-native-roots"] }
 elliptic-curve = { version = "0.13.8", features = ["pem", "pkcs8", "sec1", "std", "alloc", "digest", "ecdh", "jwk", "bits"] }
 p256 = { version = "0.13.2", features = ["ecdsa-core", "jwk", "serde", "ecdh"] }
 ordermap = "0.5"
···
 fluent-bundle = "0.15"
 fluent-syntax = "0.11"
 sha2 = "0.10.8"
-redis = { version = "0.28", features = ["connection-manager", "r2d2", "tokio-comp"] }
+redis = { version = "0.28", features = ["tokio-comp", "tokio-rustls-comp"] }
 itertools = "0.14.0"
 deadpool = "0.12.2"
-deadpool-redis = "0.20.0"
+deadpool-redis = {version = "0.20.0", features = ["connection-manager", "tokio-comp", "tokio-rustls-comp"] }
 crockford = "1.2.1"
 tokio-websockets = { version = "0.11.3", features = ["client", "rand", "ring", "rustls-native-roots"] }
 zstd = "0.13.3"

Dockerfile

···
 # syntax=docker/dockerfile:1.4
-FROM rust:1-bookworm AS build
+FROM rust:latest AS build
 
 RUN cargo install sqlx-cli@0.8.2 --no-default-features --features postgres
 RUN cargo install sccache --version ^0.8
···
 cargo build --locked --release --bin smokesignal --target-dir . --no-default-features -F embed
 EOF
 
-FROM debian:bookworm-slim
+RUN groupadd -g 1500 -r smokesignal && useradd -u 1501 -r -g smokesignal -d /var/lib/smokesignal -m smokesignal
+RUN chown -R smokesignal:smokesignal /app/release/smokesignal
+
+FROM gcr.io/distroless/cc
 
 LABEL org.opencontainers.image.title="Smoke Signal"
 LABEL org.opencontainers.image.description="An event and RSVP management application."
···
 LABEL org.opencontainers.image.authors="Nick Gerakines <[e-mail]>"
 LABEL org.opencontainers.image.source="https://tangled.sh/@smokesignal.events/smokesignal"
 
-RUN set -x \
-    && apt-get update \
-    && apt-get install ca-certificates -y
-
-RUN groupadd -g 1500 -r smokesignal && useradd -u 1501 -r -g smokesignal -d /var/lib/smokesignal -m  smokesignal
-
-ENV RUST_LOG=info
-ENV RUST_BACKTRACE=full
+WORKDIR /var/lib/smokesignal
+USER smokesignal:smokesignal
 
+COPY --from=build /etc/passwd /etc/passwd
+COPY --from=build /etc/group /etc/group
 COPY --from=build /app/release/smokesignal /var/lib/smokesignal/
+COPY static /var/lib/smokesignal/static
 
-RUN chown -R smokesignal:smokesignal /var/lib/smokesignal
+ENV HTTP_STATIC_PATH=/var/lib/smokesignal/static
 
-WORKDIR /var/lib/smokesignal
+ENV RUST_LOG=info
+ENV RUST_BACKTRACE=full
 
-USER smokesignal
-ENTRYPOINT ["sh", "-c", "/var/lib/smokesignal/smokesignal"]
+ENTRYPOINT ["/var/lib/smokesignal/smokesignal"]

src/atproto/uri.rs

···
 use anyhow::Result;
 
-use crate::atproto::errors::UriError;
+use crate::{atproto::errors::UriError, validation::is_valid_hostname};
 
 // Constants for maximum lengths
 const MAX_REPOSITORY_LENGTH: usize = 253; // DNS name length limit
···
     // Check for invalid characters
     if !repository
         .chars()
-        .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '.')
+        .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '.' || c == ':')
     {
         return false;
     }
 
-    // Check for consecutive periods
-    if repository.contains("..") {
-        return false;
+    // TODO: If starts with "did:plc:" then validate encoded string and length
+    if repository.starts_with("did:plc:") {
+        return true;
     }
 
-    // Check for path traversal attempts
-    if repository.contains("../") || repository == ".." {
-        return false;
+    // TODO: If starts with "did:web:" then validate hostname and parts
+    if repository.starts_with("did:web:") {
+        return true;
     }
 
-    // Check start/end characters
-    let starts_with_valid = repository
-        .chars()
-        .next()
-        .map(|c| c.is_ascii_alphanumeric())
-        .unwrap_or(false);
-
-    let ends_with_valid = repository
-        .chars()
-        .last()
-        .map(|c| c.is_ascii_alphanumeric())
-        .unwrap_or(false);
-
-    starts_with_valid && ends_with_valid
+    is_valid_hostname(repository)
 }
 
 /// Validates a collection name for AT Protocol URIs

src/config.rs

···
 use rand::seq::SliceRandom;
 
 use crate::config_errors::ConfigError;
+use crate::encoding_errors::EncodingError;
 use crate::jose::jwk::WrappedJsonWebKeySet;
 
 #[derive(Clone)]
···
     pub version: String,
     pub http_port: HttpPort,
     pub http_cookie_key: HttpCookieKey,
+    pub http_static_path: String,
     pub external_base: String,
     pub certificate_bundles: CertificateBundles,
     pub user_agent: String,
···
         let http_cookie_key: HttpCookieKey =
             require_env("HTTP_COOKIE_KEY").and_then(|value| value.try_into())?;
 
+        let http_static_path = default_env("HTTP_STATIC_PATH", "static").try_into()?;
+
         let external_base = require_env("EXTERNAL_BASE")?;
 
         let certificate_bundles: CertificateBundles =
···
         Ok(Self {
             version: version()?,
             http_port,
+            http_static_path,
             external_base,
             certificate_bundles,
             user_agent,
···
 impl TryFrom<String> for SigningKeys {
     type Error = anyhow::Error;
     fn try_from(value: String) -> Result<Self, Self::Error> {
-        // Verify file exists before reading
-        if !std::path::Path::new(&value).exists() {
-            return Err(ConfigError::SigningKeysFileNotFound(value).into());
-        }
-
-        // Read file with proper error handling
-        let content = std::fs::read(&value).map_err(ConfigError::ReadSigningKeysFailed)?;
+        let content = {
+            if value.starts_with("/") {
+                // Verify file exists before reading
+                if !std::path::Path::new(&value).exists() {
+                    return Err(ConfigError::SigningKeysFileNotFound(value).into());
+                }
+                std::fs::read(&value).map_err(ConfigError::ReadSigningKeysFailed)?
+            } else {
+                general_purpose::STANDARD
+                    .decode(&value)
+                    .map_err(EncodingError::Base64DecodingFailed)?
+            }
+        };
 
         // Validate content is not empty
         if content.is_empty() {

src/http/handle_index.rs

···
         .iter()
         .filter_map(|event_view| {
             let organizer_maybe = organizer_handlers.get(&event_view.event.did);
-            EventView::try_from((auth.0.as_ref(), organizer_maybe, &event_view.event)).ok()
+            let event_view =
+                EventView::try_from((auth.0.as_ref(), organizer_maybe, &event_view.event));
+
+            match event_view {
+                Ok(event_view) => Some(event_view),
+                Err(err) => {
+                    tracing::warn!(err = ?err, "error converting event view");
+                    None
+                }
+            }
         })
         .collect::<Vec<EventView>>();
 

src/http/server.rs

···
 };
 
 pub fn build_router(web_context: WebContext) -> Router {
-    let serve_dir = ServeDir::new("static");
+    let serve_dir = ServeDir::new(web_context.config.http_static_path.clone());
 
     Router::new()
         .route("/", get(handle_index))