Two follow-ups from a fresh PageSpeed Insights run (mobile 87/100/100/100):
1. next.config.ts: enable experimental.inlineCss. Removes a ~342ms
render-blocking CSS request (globals.css, ~21.6 KiB gzip -- shared by
every route since Tailwind bundles the whole app's utilities into one
file). Officially documented, dependency-free, and explicitly
recommended for small atomic-CSS bundles like ours. Applies globally
(can't be scoped per route), so hard/full page loads lose cross-page
CSS caching -- soft client-side navigations are unaffected.
2. page.tsx hero image: `priority` was deprecated in Next.js 16 in favor
of `fetchPriority`/`loading` as separate props -- it still emitted a
<link rel=preload> but no longer set fetchpriority="high" on the <img>
itself. Replaced with loading="eager" fetchPriority="high" per the
bundled Next.js 16 docs.
SpeedUp-Plan, Gitea #28.
Confirmed via extensive isolated reproduction (docker run, plain BuildKit
RUN step, and Node child_process.spawn -- all three succeed) that TLS and
the sentry-cli invocation itself are fine; GlitchTip's releases API
rejects the authenticated request with "CSRF check Failed" (403) even
with clean token auth and no cookies. That's a server-side GlitchTip
issue (separate Docker stack), not something fixable from this repo.
Keeping ca-certificates/SSL_CERT_FILE since they're correct regardless.
- connect-src: allow *.fastly.mux.com (Mux HLS chunks/manifests via Fastly
edge, dynamic regional subdomains) and *.litix.io (Mux Data beacon uses
inferred.litix.io, not covered by the exact litix.io entry)
- media-src: allow image.mux.com (storyboard.vtt thumbnail track)
- next.config.ts: silent:true -> silent:false + debug:true so the next
Docker build surfaces what the Sentry/GlitchTip sourcemap upload plugin
actually does (still minified stacktraces in GlitchTip despite the
build-arg fix in b469389)
Rate-limiting on messages.send, reports.create, reactions.toggle,
follows.create, reposts.create. Unique constraints on Report to stop
report-flooding. Mux webhook now fails hard in production without a
signing secret instead of skipping verification. Admin-panel outline
buttons fixed on 4 more pages (same white-on-dark bug as the Users page).
Timing-safe comparison for ADMIN_SECRET/CRON_SECRET. Fixed duplicate HSTS
header (Cloudflare's stronger one was being shadowed by the app's own).
tRPC now returns clean JSON 401s instead of HTML redirects when
unauthenticated, and no longer blocks public procedures for logged-out
visitors. 14 previously-silent catch blocks now log to GlitchTip.
invite/page.tsx and EmergencyVetSection.tsx fully localized (were 100%
hardcoded German). Stale TODO comments removed, auth.test.ts scaffold
rewritten to match the actual lazy-upsert pattern instead of a Clerk
webhook flow that was never built.
Replaces the dead hand-rolled buildCsp() draft in next.config.ts (never
wired in — its script-src had no 'unsafe-inline'/nonce, which blocked
Next.js's own hydration script and blanked the whole app when tested
live on 2026-08-10) with Clerk's official contentSecurityPolicy option
on clerkMiddleware(). This is Clerk's documented workaround: its default
directives already include the permissive script-src Next.js App Router
needs, merged with our app-specific img-src/connect-src/media-src/
font-src/frame-ancestors/object-src/base-uri additions (Supabase, Mux,
litix).
Ships as Content-Security-Policy-Report-Only (reportOnly: true) with
both reporting mechanisms wired to a new /api/csp-report route handler:
Clerk's reportTo (Reporting API) and a classic report-uri (for browsers
without Reporting API support). The route normalizes both report shapes,
rate-limits by IP, and forwards violations to Sentry/GlitchTip as
warnings — never blocks the request.
Deliberately NOT enforced yet — move to reportOnly: false only after a
clean observation period with zero unexpected violations.
Gitea #5
Server, edge, and client instrumentation wired up via SENTRY_DSN /
NEXT_PUBLIC_SENTRY_DSN. Fully inert without a DSN configured (verified
with a clean local build + full test suite) — safe to ship ahead of
actually having a Sentry project. Source-map upload is opt-in via
SENTRY_AUTH_TOKEN (kept out of the Docker build-arg chain since build
args land in image layer history; only the public DSN is a build arg).
Enforcing it blanked the whole app in production (ClerkProvider wraps
the tree in layout.tsx; a blocked resource during Clerk's client init
throws uncaught). Adding wss://clerk.pawfeed.org to connect-src did not
fix it. Next attempt: ship as Content-Security-Policy-Report-Only first
to see real violation reports before enforcing again. All other
security headers (HSTS, X-Frame-Options, etc.) and rate limiting stay
active and are unaffected.
Clerk's client SDK opens a WebSocket to the frontend API for session
sync; the CSP only allowed https:// to that origin, silently breaking
login (blank page, "Connection closed" exception) once enforced.
Public go-live hardening: Redis-backed rate limiting on the previously
invite-gated public surface (explore browsing, post/comment creation,
invite-cookie routes) plus CSP, HSTS, and standard security headers on
every response, now that the invite gate no longer filters traffic.
- Install next-intl@4 with cookie-based locale switching (NEXT_LOCALE)
- Add LanguageSwitcher component in Sidebar footer
- Translate Nav, PostTypeSheet, Feed, Explore, WelcomeCard, PetForm,
AvatarUpload, and Onboarding pages (EN + DE)
- Add SpeciesTranslation and BreedTranslation DB models for locale-aware
taxonomy; listSpecies and listBreeds accept optional locale param
- Seed German translations for all 3 species and 45 breeds
- Add SQL migration script for Supabase (add_i18n_translations.sql)
- fix(invite): secure cookie flag and set-invite route for HTTPS
- pets/[petId]/page.tsx: replace /api/avatar stub with NEXT_PUBLIC_R2_PUBLIC_URL CDN URL
- pets/[petId]/edit/page.tsx: pass initialAvatarKey to PetForm so AvatarUpload shows current photo
- Sidebar.tsx: add avatarKey to Pet type; show AvatarImage from CDN for active pet and dropdown list
- MobileNav.tsx: same CDN avatar pattern for mobile pet switcher
- next.config.ts: add images.remotePatterns for R2 CDN hostname (T-4-04 safeguard)
admin