Add admin VPS console, HTTPS health, tips persistence, admin/UX improvements, and deployment hardening

[gamblecodezcom]

User description

Motivation

• Harden production deployment and observability by adding HTTPS-capable health checks, health endpoint validation, and more robust prod-run.sh checks and permissions.
• Improve admin operator experience by adding a lightweight VPS console (/sshv), persistent admin/user menus and admin-mode toggles for safer testing.
• Make helpful messages (tips) manageable and persistent with import/export capabilities and safer posting to target groups.
• Tighten path/file handling and Mini App verification to reduce attack surface and avoid path traversal or unsigned WebApp payloads.

Description

• Introduces a large set of runtime features in index.js: /sshv lightweight VPS console with session persistence (data/sshv-sessions.json), editor mode, command confirmation/whitelisting, GC for sessions, and associated admin callbacks and keyboards.
• Adds safe path handling (validateSafePath and resolveTlsCertPathIfAllowed), uses it for JSON loads/writes and media streaming, and switches Mini App verification to use WEBAPP_HMAC_KEY env var in verifyWebAppInitData.
• Upgrades health server to optionally serve HTTPS using HTTPS_KEY_PATH/HTTPS_CERT_PATH, a request helper requestHealthPayload, and changed startHealthServer to create HTTPS server when certs are present.
• Enhances tips/helpful-message system with persistence (helpful_messages.json), import/overwrite via JSON in /tipadd and /tipedit, dedup logic to avoid reposting the last tip, and permission checks before posting to group.
• Improves admin UX: persistent user/admin menus, ephemeral promo prompt auto-delete, admin-mode persistence (persistAdminMode), stricter requireAdmin handling, registered command set validation, and many callback/action key renames and consistency fixes.
• Deployment and repo hygiene: remove Dockerfile, add LICENSE and SECURITY.md, update README.md, tweak .env.example, and rewrite .gitignore; update prod-run.sh to create service user, ensure runtime dirs/files, perform health checks (HTTP/HTTPS), manage permissions, and enhance systemd/service/logrotate handling.
• Update runewager.service reference file to use runewager user and hardened systemd options (ReadWritePaths, ProtectSystem, PrivateTmp, NoNewPrivileges).

Testing

• Performed a module load smoke test with CI=true node index.js to ensure the file can be required under CI guard without starting the runtime, and it completed successfully.
• Verified shell syntax for deployment script with bash -n prod-run.sh to detect script errors, and the check passed.
• Ran prod-run.sh preflight checks locally (git fetch/reset, ensure directories, touch files) in a non-destructive mode and confirmed expected log/file creation and permission steps succeeded.

---

Codex Task

---

CodeAnt-AI Description

Add persistent admin VPS console, HTTPS-capable health checks, and persistent/manageable helpful messages

What Changed

• Admins can open a lightweight VPS console (/sshv) in DM: run commands, edit files, lock/unlock, refresh and restore sessions; console state persists across restarts and is auto-pruned after inactivity.
• Health endpoint now supports HTTPS when TLS cert/key are configured; health checks use HTTPS when available and the runner script and in-bot checks validate the endpoint and report failures.
• Helpful messages (tips) are persisted to disk, can be imported/overwritten via JSON in /tipadd and /tipedit, avoid reposting the same tip twice, and the bot verifies it can post to the target group before sending.
• Admin UX: "admin view" toggles now control visible admin UI (on/off) without changing identity/permissions; persistent admin/user menus auto-hide the other menu; onboarding promo prompt auto-deletes after 15s to reduce chat clutter.
• Safer file and TLS handling: file reads/writes and cert paths are validated to prevent path traversal; WebApp init-data verification requires a WEBAPP_HMAC_KEY env var.
• Deployment hardening: prod-run creates/uses a non-root runewager service user, ensures runtime file ownership and permissions, checks health endpoint (HTTP/HTTPS) during deployment, and runewager.service updated to run as the dedicated user.

Impact

✅ Persistent VPS console sessions for admins
✅ HTTPS health checks when TLS is provided
✅ Fewer duplicate or missing helpful messages

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 12 minutes and 25 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 99bd3ea and d1db1c9.

📒 Files selected for processing (1)

• prod-run.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/configure-git-and-update-project-files-6zsucn

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Disabled cert verification check_health_endpoint always uses curl -k for HTTPS, disabling TLS verification. Even though the health URL targets 127.0.0.1, this weakens assurance and may hide MITM or misconfiguration. Prefer verifying against the provided cert (or making verification explicit and controlled). Service user fallback behavior ensure_service_user falls back to using the current user when not root. The script then runs ensure_service_user || true and later chowns only if the service user exists. This can result in inconsistent ownership and permission handling across runs (non-root == no system user created, files owned by the current user, later run as root changes ownership). Validate the intended behavior and add clearer guards/notes or enforce a consistent ownership strategy. Log ownership & rotation The script creates log and data files and sets permissive modes but uses the current process UID/GID when generating the logrotate 'create' line and chmods files. If the service runs as a different user (or when the script runs as root), this can lead to permission mismatches (service can't write logs, or logs owned by root). Ensure files/directories are chowned to the service user and logrotate uses the service user's numeric uid/gid, not the invoking user. Created files lack ownership step deploy.sh now touches data/sshv-sessions.json and data/admin-events.log after npm install but does not set ownership. If deploy runs under a different user than the service user, the created files may be owned by the deploy actor and the service may lack write access. Port-listening detection fragility is_port_listening only tries ss and returns failure otherwise. On systems without ss it returns 1 (not-listening), which may be a false negative. Consider adding netstat fallback, or parse /proc/net/tcp as a robust fallback. Secrets in EnvironmentFile The unit loads /var/www/html/Runewager/.env via EnvironmentFile. Confirm .env file ownership and file mode (e.g. 600) so secrets aren't exposed to other users/processes. Consider restricting read access and listing it in appropriate systemd path protections. Service user & runtime dirs The unit now runs as runewager (non-root). Ensure the system service user exists and owned permissions for runtime/state/log/data directories are created and correct before start. Prefer using systemd RuntimeDirectory/StateDirectory to avoid TOCTOU or manual setup mistakes. Sandboxing vs required access ProtectSystem, ProtectHome, PrivateTmp and ReadWritePaths tighten the sandbox. Verify the service still has read access to code/config files it needs and that only intended paths are writable. Missing read-only whitelisting for the application tree may cause runtime failures or unintended write privileges.

[codeant-ai]

CodeAnt AI finished reviewing your PR.