sec: remove certs/cookie from tracking, parameterize LiveKit secrets, add .env.example

SameSite=None requires Secure=true or modern browsers silently reject
the Set-Cookie header. Since the site is served over HTTPS via Caddy,
this was causing login to succeed (200) but the session cookie to be
dropped, making the subsequent /auth/me call fail with 401.

SameSite=Lax is the correct setting for same-origin session cookies.

.env.example

@@ -1,25 +1,23 @@
-# App
+# dumpsterChat Environment Configuration
-DUMPSTER_HOST=localhost
+# Copy this file to .env and fill in your values.
-DUMPSTER_PORT=8080
+
-DUMPSTER_SECRET=*** Database
+# Server
-POSTGRES_HOST=localhost
+DUMPSTER_HOST=dumpster.dustin.coffee
-POSTGRES_PORT=5432
+DUMPSTER_SECRET=generate-a-random-secret-here
+
+# Database
 POSTGRES_USER=dumpster
-POSTGRES_PASSWORD=dumpster
+POSTGRES_PASSWORD=generate-a-random-password-here
-POSTGRES_SSLMODE=disable
+POSTGRES_DB=dumpster
-# Valkey
+
-VALKEY_URL=redis://localhost:***@example.com
+# MinIO (optional — omit for local filesystem)
-# MinIO
+MINIO_ENDPOINT=
-MINIO_ENDPOINT=minio:9000
+MINIO_ACCESS_KEY=
-MINIO_ACCESS_KEY=<generated>
+MINIO_SECRET_KEY=
-MINIO_SECRET_KEY=<gener...n
+
-# LiveKit
+# LiveKit (WebRTC / voice)
-LIVEKIT_URL=wss://livekit.your.domain
+LIVEKIT_API_KEY=generate-a-random-key-here
-LIVEKIT_API_KEY=<generated>
+LIVEKIT_API_SECRET=generate-a-random-secret-here
-LIVEKIT_API_SECRET=<gener...n
+
-# Web Push
+# Giphy (optional — for GIF search)
-VAPID_PUBLIC_KEY=<generated>
+GIPHY_API_KEY=
-VAPID_PRIVATE_KEY=<generated>
-VAPID_SUBJECT=admin@your.domain
-# Integrations
-GIPHY_API_KEY=your_giphy_api_key_here

.gitignore

@@ -46,3 +46,7 @@ steamfree
 # Tauri Android keystore (contains signing passwords)
 web/src-tauri/gen/android/keystore.properties
 
+# Secrets and certificates
+/certs/
+cookie.txt
+

certs/turn.crt

@@ -1,81 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDkTCCAxegAwIBAgISBQjShZO8+oxeU80iyTOUKHhdMAoGCCqGSM49BAMDMDMx
-CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZ
-RTIwHhcNMjYwNzA2MDEzMDM1WhcNMjYxMDA0MDEzMDM0WjAdMRswGQYDVQQDExJ0
-dXJuLmR1c3Rpbi5jb2ZmZWUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATB70bx
-IRjXyxdwR/3k56AkiFRKwApxq/h7xNXK5/I5xZ+5+HCLMHjEmFOIUtUj87DpcPHs
-rAfJZcH19gQIt7Xlo4ICHzCCAhswDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoG
-CCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFE8HllwR3SN9Ay0rvVLX
-9mOsdJ0UMB8GA1UdIwQYMBaAFLlZ8o7PIvCG0zdI/3YUGLqC2FWHMDMGCCsGAQUF
-BwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMi5pLmxlbmNyLm9yZy8wHQYD
-VR0RBBYwFIISdHVybi5kdXN0aW4uY29mZmVlMBMGA1UdIAQMMAowCAYGZ4EMAQIB
-MC4GA1UdHwQnMCUwI6AhoB+GHWh0dHA6Ly95ZTIuYy5sZW5jci5vcmcvOTQuY3Js
-MIIBCwYKKwYBBAHWeQIEAgSB/ASB+QD3AHUAwjF+V0UZo0XufzjespBB68fCIVoi
-v3/Vta12mtkOUs0AAAGfNUH9yAAABAMARjBEAiBUIFA17umU+cAdlBJlkjhivt7h
-4f1HF7kdlQtt0hURaAIgRWAiqclKJy3QikfbGF7EFK3sNRyf/PZNBLtjJeieP1IA
-fgAm42RuWGkhI7w0P0ckNZs3ks0kWojYFdOTM/2ZGKtHIwAAAZ81QfvIAAgAAAUA
-JeWwugQDAEcwRQIhAJ9gzEj26/VOpYO0HkS2ZcItIhoBf7bDfzt9gpIK2RH2AiA2
-66DvuRKPYthZ4AFBXbVtSX4rf4aX2IvgQIWTudJMlDAKBggqhkjOPQQDAwNoADBl
-AjANu3rbmE/SqrfsMNGEv7rl+qvblv0btupKZ2qHg87079XD4gTh3Sqyl+Z4RnHq
-JkkCMQDI3q5ZQ6GVF3geVTbNvLlJ+R35eB+EIcoX0Cbs20S5k9N/SiWS2BlQzlUM
-QpPxaok=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICjDCCAhGgAwIBAgIQTfOxXdbAeExQfNN7WObxFTAKBggqhkjOPQQDAzAuMQsw
-CQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0y
-NTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYD
-VQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTIwdjAQBgcqhkjOPQIBBgUr
-gQQAIgNiAARxmrQzkdbEEL3MqXt3dJQttYc47axkdDTHud5TPqM2z5uSD5cmk0Wr
-HlWXvnlvqBLqiB34kluxIbmMyAiq3/YD6e80/vV259K8XQIdjFXloYOa0mIU71f7
-HQ09PvYDlw+jge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUF
-BwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLlZ8o7PIvCG0zdI/3YU
-GLqC2FWHMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUF
-BwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNV
-HSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5s
-ZW5jci5vcmcvMAoGCCqGSM49BAMDA2kAMGYCMQDIcnw5dcZLN9ffynXnnkLD/itS
-JEycJPb3sRkzeqBowup7vOsAwaqoCnNn/jh9wycCMQCJM6CPlaOC4pQYYbJtVPYb
-DKrIb2EKk5NpOpE6/XttQYZV/3gilB9l+Cc/DOVwmyg=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzEL
-MAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNo
-IEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcN
-MzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4G
-A1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo
-+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2
-b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNV
-HQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB
-/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKW
-rt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZo
-dHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1Ud
-HwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMD
-aQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYK
-Ax54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC2
-6hSW1/IWaas6dg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP
-MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
-Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa
-Fw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l
-dCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy
-MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H
-ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7
-AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd
-BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd
-BgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2
-5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw
-Oi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg
-MB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD
-ggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e
-/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo
-shMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS
-2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95
-IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN
-/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0
-upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc
-MS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV
-pcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ
-cEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p
-TT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R
------END CERTIFICATE-----

certs/turn.key

@@ -1,5 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQggnJOfQM8flEJFULr
-8vvHwWRlXlJ1a0sI5Jw/Y6KRQeGhRANCAATB70bxIRjXyxdwR/3k56AkiFRKwApx
-q/h7xNXK5/I5xZ+5+HCLMHjEmFOIUtUj87DpcPHsrAfJZcH19gQIt7Xl
------END PRIVATE KEY-----

cookie.txt

@@ -1,5 +0,0 @@
-# Netscape HTTP Cookie File
-# https://curl.se/docs/http-cookies.html
-# This file was generated by libcurl! Edit at your own risk.
-
-#HttpOnly_localhost	FALSE	/	TRUE	1785435515	dumpster_session	720a3aad74029e6c8e0c4b93f8db0b48381afc5355e1c1345143a0f5e3d5ae34

docker/livekit.yaml

@@ -9,9 +9,9 @@ rtc:
     - host: turn.dustin.coffee
       port: 443
       protocol: tls
-      username: V8S6EWOU1Lqp
+      username: "${LIVEKIT_API_KEY}"
-      credential: jQRJztgWbqDn9vjMUhHZg1ooxuhiBjhk
+      credential: "${LIVEKIT_API_SECRET}"
 turn:
   enabled: false
 keys:
-  V8S6EWOU1Lqp: jQRJztgWbqDn9vjMUhHZg1ooxuhiBjhk
+  "${LIVEKIT_API_KEY}": "${LIVEKIT_API_SECRET}"

web/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
   "productName": "dumpsterChat",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "identifier": "coffee.dustin.dumpster",
   "build": {
     "frontendDist": "../dist",

web/src/components/Layout.tsx

@@ -104,7 +104,7 @@ export function Layout() {
     <div className="h-full w-full bg-gb-bg text-gb-fg font-mono flex flex-col">
       {/* Outer terminal frame with safe area */}
       <div className="flex-1 terminal-border bg-gb-bg-h flex flex-col min-h-0"
-        style={{ padding: 'max(env(safe-area-inset-top), 1.5rem) max(env(safe-area-inset-right), 0) max(env(safe-area-inset-bottom), 0.75rem) max(env(safe-area-inset-left), 0)' }}>
+        style={{ padding: 'var(--safe-top, 0.25rem) var(--safe-right, 0) var(--safe-bottom, 0) var(--safe-left, 0)' }}>
 
         {/* Top bar — minimal on mobile */}
         <div className="flex items-center justify-between px-2 md:px-3 py-1 border-b border-gb-bg-t bg-gb-bg-s gap-1">
@@ -237,7 +237,7 @@ function MobileBottomNav({
 
   return (
     <div className="md:hidden flex items-center bg-gb-bg-h border-t border-gb-bg-t shrink-0"
-      style={{ paddingBottom: 'env(safe-area-inset-bottom)' }}>
+      style={{ paddingBottom: 'var(--safe-bottom)' }}>
       <NavTab active={mobileView === 'sidebar'} onClick={() => onViewChange('sidebar')}>
         [SERVERS]
       </NavTab>

web/src/components/MobileNav.tsx

@@ -47,7 +47,7 @@ export function MobileNav({ activeTab, onTabChange, onToggleDrawer }: MobileNavP
         <ThemeToggle />
       </div>
       {/* Safe area for phones with bottom notch */}
-      <div className="h-[env(safe-area-inset-bottom)]" />
+      <div className="h-[var(--safe-bottom)]" />
     </div>
   );
 }

web/src/main.tsx

@@ -5,6 +5,20 @@ import App from './App.tsx';
 
 const isTauri = 'window' in globalThis && '__TAURI_INTERNALS__' in window;
 if (isTauri) {
+  // WebView safe-area fallbacks: Android doesn't support CSS env(), and
+  // Linux WebKitGTK chokes on env() inside var(). Set explicit values via JS.
+  if (navigator.userAgent.includes('Android')) {
+    document.documentElement.style.setProperty('--safe-top', '1.5rem');
+    document.documentElement.style.setProperty('--safe-bottom', '0.75rem');
+    document.documentElement.style.setProperty('--safe-left', '0px');
+    document.documentElement.style.setProperty('--safe-right', '0px');
+  } else {
+    // Linux / macOS Tauri — no notch, but body has default padding already
+    document.documentElement.style.setProperty('--safe-top', '0px');
+    document.documentElement.style.setProperty('--safe-bottom', '0px');
+    document.documentElement.style.setProperty('--safe-left', '0px');
+    document.documentElement.style.setProperty('--safe-right', '0px');
+  }
   const TARGET = 'https://dumpster.dustin.coffee';
   const WS_TARGET = 'wss://dumpster.dustin.coffee';
   
@@ -65,7 +79,8 @@ if (isTauri) {
     
     return ws;
   } as unknown as typeof WebSocket;
-  window.WebSocket.prototype = OriginalWebSocket.prototype;
+  // ponytail: WebKitGTK may have read-only prototype — guard against throw
+  try { window.WebSocket.prototype = OriginalWebSocket.prototype; } catch { /* readonly, fine */ }
 }
 
 createRoot(document.getElementById('root')!).render(