📡 Services

25 Compose services across 5 tiers: 24 running services and the successfully exited seaweedfs-init job in the exercised upgrade. Every deployed image reference is immutable. Tables identify the selected build versions, not mutable tags to pull; the deployment Compose file holds the exact digests. Supporting-store versions were preserved.

---

🌐 Edge Tier

Service	Image	Role
caddy	Caddy 2.10, installed digest preserved	Internal path router, loopback 127.0.0.1:50130
app-proxy	Fluxer 2026.927.191816 + native SSO source patch, local image-ID pin	SPA frontend, discovery bootstrap, automatic native SSO entry
static-proxy	fluxer-static 2026.918.165027	Bundled fonts, emoji, badges, desktop assets

⚙️ Application Tier

Service	Image	Role
api	fluxer-api 2026.927.192649	Compiled REST server (Hono), port 8080, health /_health
worker	Same pinned API image	node dist/WorkerEntrypoint.js; cron and voice reconciliation
gateway	fluxer-gateway 2026.927.183931	Erlang/OTP WebSocket engine, presence
media-proxy	fluxer-media-proxy 2026.918.140053	Upload relay, S3 bridge, image processing; native healthcheck
admin	fluxer-admin 2026.927.191814	Admin panel at /admin, native OAuth-protected

📡 Microservices Tier (Router + Shard)

Service	Image	Role
snowflakes / snowflakes-shard	fluxer-snowflakes 2026.913.154309	Distributed Snowflake ID generation
messages / messages-shard	fluxer-messages 2026.918.140044	Message persistence, PG-dependent
users / users-shard	fluxer-users 2026.913.154317	User state management
gifs / gifs-shard	fluxer-gifs 2026.913.154309	GIF search/integration engine
unfurl / unfurl-shard	fluxer-unfurl 2026.913.154247	URL preview/embed extraction

• Each pair: router (receives NATS requests) + shard (processes for shard ID 0)
• All depend on NATS for inter-service communication
• Scale by adding shard replicas with incremented FLUXER_SVC_SHARD_ID

💾 Data Tier

Service	Image	Role
postgres	PostgreSQL 16, installed digest preserved	Relational store, health pg_isready
valkey	Valkey 8.1, installed digest preserved	KV cache, no persistence (--save "" --appendonly no)
nats	NATS 2.14, installed digest preserved	Message broker, JetStream enabled (-js)
meilisearch	Meilisearch 1.12, installed digest preserved	Full-text search, analytics disabled
seaweedfs	SeaweedFS 4.34, installed digest preserved	S3-compatible object storage
seaweedfs-init	Same SeaweedFS digest	One-shot bucket creator (5 buckets)

🎙️ Real-Time Tier

Service	Image	Role
livekit	LiveKit 1.12.0, installed digest preserved	WebRTC SFU, TCP 7881 signaling, UDP 7882 media

---

🔗 Startup Dependency Chain

• API and worker initialize in parallel, not as an API → worker dependency.
• Both require healthy PostgreSQL/Valkey and successful bucket initialization, with the configured NATS/shard start dependencies.
• App-proxy and admin wait for API health. App-proxy also waits for Caddy to start.
• Caddy routes to the app services; the deployment Compose file is authoritative for each exact dependency condition.
• No optional push service was added. The upgraded native configuration leaves that rollout disabled and retains the existing gateway delivery path.

Native SSO functional proof

In the original 2026-09-27 browser proof, native Fluxer user pxl entered through the already-authenticated Authelia session without another password. The actual UI created the new D190 SSO Test community and its ssosync-test text channel, then sent exactly one labeled message: D190-SSOSYNC-aedc8b8a: pxl native Authelia SSO test message.

The native POST returned 200; reload and native GET retrieved message 1553917750978543616, authored by pxl. That same message survived the final frontend assets before logout. The global ACL remained empty and public flags remained 0; the new community’s owner crown is not global administration. These intentional artifacts are retained, and no existing community was modified.

On the final frontend at 2026-09-28 04:31–04:32 UTC, native logout returned 204, the old token returned 401, and both logout and actual callback-error Back to sign-in remained token-free on /login?local=1. Root reentry at 04:33 UTC reached the IdP form without a password submission; cause unestablished. Preserve those recovery passes and the failed-before silent-reentry evidence. After the authorized final login, 2026-09-29 07:21:53.957 UTC automatic root entry recovered native pxl 1553906872304533504 (200) and existing message 1553917750978543616 (200) with its exact text/author. browser/flxr-final-session-readback.json and genuine screenshot prove final native reentry and same-message readback PASS, without a duplicate send.

The amendment2 mission covers Fluxer, Lobe, chat, Most, and WCHT, then Rocket.Chat and Zulip; only Code and Open Notebook are excluded. Gatekeeper batch3 applied at 2026-09-28 22:57 UTC. The parent performed the one authorized final additional first-factor login at 2026-09-29 07:19:22.199 UTC and reused it, with no password afterward. Keep that event separate from the original login. final-oidc-issuance-redemption.json matches Fluxer’s one final issued code to one access-token row. The mission remains BLOCKED with partial success because chat, Rocket.Chat, and Zulip have separate native prerequisites; Fluxer acceptance is not a blanket all-app or wiki-publication claim. See the mission evidence boundaries.

Second-user configuration proof found no existing matching loca account or subject binding. The native precedence is provider-plus-subject, verified email, then ordinary provisioning; expected new loca receives no global administrator ACL. A live loca login remains the user’s own first click. See the mission identity boundary for source-pinned mapping and the separate native-session/IdP-session distinction.

📊 Resource Notes

• Valkey is ephemeral; native auth sessions also persist in PostgreSQL and can be reloaded on a cache miss.
• SeaweedFS buckets: fluxer, fluxer-uploads, fluxer-downloads, fluxer-reports, fluxer-harvests
• API health check: 30 retries, 10s interval, 90s start period. First-upgrade native index migrations can take longer.
• Long-running services restart unless-stopped; seaweedfs-init is the one-shot exception. Runtime bridge network: fluxer_fluxer.

---