timescale.info
Sign inSign up

How OpenChronology was built

Every merged pull request of openchronology/timeline-app, its first week of commits and its releases; and before them the 2020 PureScript editor, from snapshots of its deleted repositories in the Wayback Machine. Written to this server through the HTTP API.

327 moments · 2020-03-09T00:15:08Z CE – 2026-11-02T20:11:21Z CE · by @athan · @athan

#80 · Explain platform startup failures and allow HTTP on private networks

  • timeline-app
  • pull request

## Problem A `.deb` install configured with `APP_ORIGIN=http://timeline.clark.arpa:5173` serves the pages, but every API route (`/api/session`, `/api/plugins`, `/api/timelines`, `/healthz`) returns an **empty 500**. The packaged launcher always sets `NODE_ENV=production`, and `platformServices()` then throws *"Public production deployments require HTTPS."* Next.js turns that into a bodiless 500, so the website shows "Plugin library isn't available", "Timeline browse isn't available", and "Failed to execute 'json' on 'Response': Unexpected end of JSON input". ## Changes - **Readable startup failures:** `dispatchNextRequest` and `/api/live` now answer **503 JSON** when the platform can't start, and log the cause. Settings the platform can't start with throw a new `ConfigurationError`, whose message is shown (`Server misconfigured: …`); any other error stays generic (`The server is unavailable.`), so database details don't leak. - **`PLUGIN_LIBRARY`:** a missing or invalid file is now a configuration error, with no file path in the message. - **`ALLOW_INSECURE_ORIGIN=1`:** allows a plain-HTTP `APP_ORIGIN` on a trusted private network. Cookies already drop `Secure`/`__Host-` for http origins, so nothing else needed to change. Added to the `.deb` env template (the upgrade notice lists it automatically), `compose.yml`, README.Debian and docs/docker.md. - **`platform/lib/api.js`:** when a response isn't JSON, the client reports `Request failed (HTTP n).` instead of the JSON parse exception. ## Testing - New test in `test/next-route.test.mjs`: with production and an http origin, requests get a 503 JSON response naming the problem; with the opt-in set, `/api/session` returns 200. - `node --test test/*.test.mjs`: 202/202 pass. `typecheck` and prettier pass. - Ran the built standalone platform with `APP_ORIGIN=http://timeline.lan:5173`. Without the opt-in, `/api/session`, `/api/plugins`, `/healthz` and `/api/live` return the 503 message. With `ALLOW_INSECURE_ORIGIN=1`, they return 200, except `/api/live`, which correctly needs a database.

Sources

Open #80 · Explain platform startup failures and allow HTTP on private networks in the timeline