TODO #

Restrict the server to watch installations #

Today the server answers every client. Public scrapers can reach the board and search endpoints. Add an access control so that only Stibble installations can use the API.

Possible design:

• The phone app requests an install token from the server one time. The server signs the token and stores no state.
• The app sends this token as a header with each board request.
• The server rejects requests without a valid token.
• The config page stays open, because the phone opens it in a plain webview. Rate limit the config and search endpoints at Traefik.

A shared secret in the app package is not strong protection. The goal is to stop casual scraping, not a determined attacker.

Back up the server database off-host #

The SQLite database and its WAL survive process restarts, but they remain on one host or persistent volume. Losing that storage loses the committed provider snapshots, projections, and retained facts. Add a consistent, encrypted off-host backup and a tested restore procedure.

Possible design:

• Produce a consistent SQLite backup without copying a live database and WAL independently.
• Upload versioned backups to storage outside the server host and define retention there.
• Restore into a fresh directory, load the configured SpatiaLite extension, and verify /readyz plus every board endpoint before declaring the procedure usable.
• Set recovery-point and recovery-time targets only after a scheduled backup and restore drill measures them.