- Create scripts/install.sh that auto-generates Ed25519 signing key,
JWT secret, Postgres and MinIO passwords from .env.example placeholders
- Add startup validation in server to reject placeholder secrets
- Add 401 interceptor in console API client to clear stale JWT tokens
- Update README Quick Start to use ./scripts/install.sh
- Update .env.example with GENERATE_ME placeholders for all secrets
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Ensures self-hosted deployments pass the correct API server URL
(from NEXT_PUBLIC_API_BASE_URL) to CLI install commands, SDK client
constructors, and verification endpoints instead of hardcoded defaults.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The console imports types from @elydora/shared which maps to
../server/src/shared via tsconfig paths. Changed Docker build
context to repo root so server shared types are accessible
during the Next.js build.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Full self-hosted port of the Elydora tamper-evident audit protocol:
- Hono API server with PostgreSQL, Redis, MinIO adapters
- Ed25519 signed operations, chain hashing, Merkle epoch rollups
- PBKDF2 password hashing, HMAC-SHA256 JWT, 5-role RBAC
- Next.js management console
- Node.js, Python, and Go SDKs
- Docker Compose for local deployment
- Helm chart for Kubernetes
- Comprehensive security hardening and audit fixes applied
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ZacharyZhang-NYandClaude Opus 4.6