coinosv3-server.git/compose.yml, branch master

Bun 1.3.14 → 1.4.3, from ghcr.io/coinos/bun (oven/bun without the emSign ECC Root CA - G3, CVE-2026-111943)

2026-10-21T13:06:54Z

names, nwcpush, blossom, the vmedia image (and live with it) and the hook's bun install. Co-Authored-By: Claude Opus 5.5

live: /live/turn — ICE servers for the app's calls (Cloudflare TURN credentials good for 4 h, to a NIP-98-signed ask; 30 an hour per key, 60 per IP; STUN alone if TURN can't be had). The key comes from $STATE/live/config.json.

2026-10-18T15:31:40Z

Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_013ZDf1cyCQLkfjftYhymZAg

live: live streams sent from the app — the browser's recording over a WebSocket (on 443, through Cloudflare: no ports to open), ffmpeg to 2 s HLS (H.264 720p, AAC), a live window and the whole stream (its recording), viewers counted, a dropped sender resuming the same stream, NIP-98 + coinos-name owners only, 3 at once, 4 h each, recordings kept a week.

2026-10-18T15:14:20Z

Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_013ZDf1cyCQLkfjftYhymZAg

Make this the coinosv3-server repo: the services, with coinosv3 pinned

2026-10-16T19:57:19Z

Carved out of coinosv3 (names, feed, nwcpush, blossom, vmedia, bridge and their tests, with history). The shared wallet code they import (src/ark, noffer, bolt12, popular-feed) now comes from a coinosv3 submodule pinned at 082fc2e, the commit the services have actually run on, so moving here changes no behaviour; bumping it is its own commit. The two text helpers translation uses arrived on the server later than that commit and are vendored under names/vendor at the versions deployed, until the pin moves past them. Root package.json pins the npm versions installed on the server. compose.yml runs names, nwcpush and blossom from this checkout (read-only) with configs and state under $STATE, outside the repo, and pins the Bun image. Co-Authored-By: Claude Opus 5.5