Documents the architecture for PVM's managed digital signage system:
Orange Pi 5 as leaf node (local backend, screen management API, video
pipeline), Radxa ROCK 4D as thin-client display nodes (kiosk Chromium,
CEC control, mDNS auto-discovery). API-first design for web and tablet
management clients. libsql on leaf, PostgreSQL on core.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add token refresh logic in Auth.js JWT callback with 60s expiry buffer
- Fix JWKS cache thundering herd with Mutex + double-checked locking
- Make trustHost conditional (dev-only) via SvelteKit's $app/environment
- Make devMode conditional on ZITADEL_PRODUCTION env var in setup script
- Replace fragile grep/cut JSON parsing with jq in setup-zitadel.sh
- Add OIDC_GRANT_TYPE_REFRESH_TOKEN to Zitadel OIDC app grant types
- Update TODO_SECURITY.md: mark resolved items, add RefreshAccessTokenError frontend handling
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add setup-zitadel.sh: idempotent script that creates PVM project
and OIDC app via Zitadel Management API using machine user PAT
- Add machine user + PAT auto-generation to docker-compose via
FIRSTINSTANCE env vars with bind-mounted machinekey directory
- Add SMTP configuration for email sending (verification, password reset)
- Fix JWT algorithm confusion attack: restrict to RS256/384/512 only
- Add docs/TODO_SECURITY.md tracking review findings
- Update .env.example files with correct local dev URLs
- Add docker/machinekey/ to .gitignore
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Comprehensive evaluation of 11 auth frameworks for PVM's
split-brain architecture. Recommends self-hosted Zitadel v3
for its Rust crate, OIDC JWKS for offline JWT validation on
RPi5 nodes, and zero-cost self-hosting on existing Hetzner PVE.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Resolve all open questions from tech stack review:
- Self-hosted on Hetzner PVE (LXC + Docker)
- Event-based sync via NATS JetStream
- Generic display system with Android client (no Cast SDK dep)
- Docker-based RPi5 provisioning
- No money handling, 72h offline limit, REST + OpenAPI
- PVM signup-first for player accounts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1,190-line research covering all 18 technology areas for PVM:
Rust/Axum backend, SvelteKit frontend, Postgres + libSQL databases,
NATS + JetStream messaging, DragonflyDB caching, and more.
Includes recommended stack summary and open questions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Establish PVM (Poker Venue Manager) project with product vision
document covering all feature domains and a clean README with
project overview.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
