bypass requirement for nsfw model

The build stage needs to run pnpm install after copying packages
to ensure all dependencies like ioredis are properly resolved.

.dockerignore

@@ -37,9 +37,19 @@
 **/Thumbs.db
 **/yarn-debug.log*
 **/yarn-error.log*
-/fluxer_app/src/data/emojis.json
+# Original exclusions for emojis/locales commented out - needed for build
-/fluxer_app/src/locales/*/messages.js
+# /fluxer_app/src/data/emojis.json
+# /fluxer_app/src/locales/*/messages.js
 dev
 !fluxer_app/dist
 !fluxer_app/dist/**
 !fluxer_devops/cassandra/migrations
+# Explicitly allow critical build data (trailing slash means directory)
+!fluxer_app/src/data
+!fluxer_app/src/data/**
+!fluxer_app/src/locales
+!fluxer_app/src/locales/**
+!**/scripts/
+# Allow build scripts directory (not blocked by **/build pattern)
+!fluxer_app/scripts/build
+!fluxer_app/scripts/build/**

.github/workflows/ci.yaml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   typecheck:
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
       - name: Checkout code
@@ -32,7 +32,7 @@ jobs:
           TURBO_TEAM: team_fluxer
 
   test:
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
       - name: Checkout code
@@ -59,7 +59,7 @@ jobs:
           TURBO_TEAM: team_fluxer
 
   gateway:
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
       - name: Checkout code
@@ -93,7 +93,7 @@ jobs:
           FLUXER_CONFIG: ../config/config.test.json
 
   knip:
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
       - name: Checkout code
@@ -119,7 +119,7 @@ jobs:
           TURBO_TEAM: team_fluxer
 
   ci-scripts:
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
       - name: Checkout code

.github/workflows/release-server.yaml

@@ -2,7 +2,7 @@ name: release server
 
 on:
   push:
-    branches: [canary]
+    branches: [uwu]
     paths:
       - packages/**
       - fluxer_server/**
@@ -51,18 +51,18 @@ defaults:
     shell: bash
 
 env:
-  REGISTRY: ghcr.io
+  REGISTRY: git.i5.wtf
-  IMAGE_NAME_SERVER: ${{ github.repository_owner }}/fluxer-server
+  IMAGE_NAME_SERVER: fluxerapp/fluxer-server
   CHANNEL: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.channel) || 'nightly' }}
   SOURCE_REF: >-
     ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.ref)
       || ((github.event_name == 'workflow_dispatch' && github.event.inputs.channel == 'stable') && 'main')
-      || 'canary' }}
+      || 'uwu' }}
 
 jobs:
   meta:
     name: resolve build metadata
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 25
 
     outputs:
@@ -102,7 +102,7 @@ jobs:
     name: build fluxer server
     needs: meta
     if: needs.meta.outputs.build_server == 'true'
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 25
 
     outputs:
@@ -123,7 +123,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.registry_token }}
 
       - name: docker metadata
         id: docker_meta
@@ -146,7 +146,7 @@ jobs:
         with:
           context: .
           file: fluxer_server/Dockerfile
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
           push: true
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: |
@@ -165,26 +165,26 @@ jobs:
             BUILD_NUMBER=${{ needs.meta.outputs.build_number }}
             BUILD_TIMESTAMP=${{ needs.meta.outputs.timestamp }}
             RELEASE_CHANNEL=${{ needs.meta.outputs.channel }}
-          cache-from: type=gha,scope=server-${{ needs.meta.outputs.channel }}
+          # GitHub Actions cache not available in Gitea - disabled
-          cache-to: type=gha,mode=max,scope=server-${{ needs.meta.outputs.channel }}
+          # cache-from: type=gha,scope=server-${{ needs.meta.outputs.channel }}
-          provenance: true
+          # cache-to: type=gha,mode=max,scope=server-${{ needs.meta.outputs.channel }}
-          sbom: true
+          provenance: false
+          sbom: false
 
-      - name: attest
+      # GitHub-specific attestation - not available in Gitea
-        uses: actions/attest-build-provenance@v2
+      # - name: attest
-        with:
+      #   uses: actions/attest-build-provenance@v2
-          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_SERVER }}
+      #   with:
-          subject-digest: ${{ steps.build.outputs.digest }}
+      #     subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_SERVER }}
-          push-to-registry: true
+      #     subject-digest: ${{ steps.build.outputs.digest }}
+      #     push-to-registry: true
 
   create-release:
-    name: create release
+    name: create release (disabled for Gitea)
     needs: [meta, build-server]
-    if: |
+    # GitHub release API doesn't exist in Gitea - disabled
-      always() &&
+    if: false
-      needs.meta.outputs.version != '' &&
+    runs-on: ubuntu-latest
-      (needs.build-server.result == 'success' || needs.build-server.result == 'skipped')
-    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: checkout
@@ -250,7 +250,7 @@ jobs:
     name: release summary
     needs: [meta, build-server]
     if: always()
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 25
 
     steps:

.lfsconfig

@@ -1,2 +1,2 @@
 [lfs]
-	url = https://github.com/fluxerapp-old/fluxer-private.git/info/lfs
+	url = https://git.i5.wtf/fluxerapp/fluxer.git/info/lfs

NOTES.md

@@ -0,0 +1,130 @@
+# uwu.lc Self-Hosting Notes
+
+## Branch Setup
+
+**Current branch**: `uwu` (based on `refactor`)
+- **Tracks**: `origin/refactor` for rebasing upstream changes
+- **Pushes to**: `i5/uwu` on your Gitea instance at git.i5.wtf
+- **Current state**: 1 commit ahead (LFS config change)
+
+## Workflow
+
+### Pull upstream changes and rebase
+```bash
+git fetch origin
+git rebase origin/refactor
+```
+
+### Push your changes to Gitea
+```bash
+git push i5 uwu
+# If you've rebased, use: git push i5 uwu --force-with-lease
+```
+
+### View your changes
+```bash
+git log origin/refactor..uwu  # Show commits you've added
+```
+
+## Why track `refactor` branch?
+
+The `refactor` branch is a complete rewrite that:
+- Is simpler and lighter to self-host
+- Uses SQLite instead of complex database setup
+- Removes payment/Plutonium stuff for self-hosted deployments
+- Is much better documented
+- Is where active development happens
+
+The old `main`/`canary` branches have the legacy stack that's harder to self-host.
+
+## Configuration Changes Made
+
+1. **LFS Config** (`.lfsconfig`): Updated to point to Gitea instance
+   - Old: `https://github.com/fluxerapp-old/fluxer-private.git/info/lfs`
+   - New: `https://git.i5.wtf/fluxerapp/fluxer.git/info/lfs`
+
+2. **CI Workflows**: Updated for Gitea compatibility
+   - Changed all runners from `blacksmith-8vcpu-ubuntu-2404` to `ubuntu-latest`
+   - `ci.yaml`: Main CI workflow (typecheck, test, gateway, knip, ci-scripts)
+   - `release-server.yaml`: Docker build workflow
+     - Registry: `ghcr.io` → `git.i5.wtf`
+     - Image: `fluxerapp/fluxer-server`
+     - Trigger branch: `canary` → `uwu`
+     - Default source ref: `canary` → `uwu`
+
+## Gitea Setup Requirements
+
+### Container Registry Authentication
+
+The workflow tries to use `secrets.GITEA_TOKEN` or `github.token` for registry auth.
+
+**Required**: Create a Gitea Personal Access Token:
+1. Go to Gitea Settings → Applications → Generate New Token
+2. Name: `CI_Container_Registry`
+3. Permissions: Select `package` (write access)
+4. Add to repository secrets as `registry_token` (Note: Can't use GITEA_ or GITHUB_ prefix)
+
+**Alternative**: Update the workflow to use username/password:
+- Create a secret `REGISTRY_USERNAME` with your Gitea username
+- Create a secret `REGISTRY_PASSWORD` with a personal access token
+
+### Container Registry URL Format
+
+Gitea registry format is typically:
+- `git.i5.wtf/fluxerapp/fluxer-server:tag`
+
+If the registry requires a different format, check your Gitea container registry settings.
+
+## Docker Build Fixes Applied
+
+Successfully built fluxer-server Docker image! Fixes applied:
+1. ✅ Fixed package path (app → app_proxy)
+2. ✅ Added Rust/WASM toolchain for frontend
+3. ✅ Added ca-certificates
+4. ✅ Fixed .dockerignore (locale files, emoji data, build scripts)
+5. ✅ Set FLUXER_CONFIG environment variable
+6. ✅ Updated ENTRYPOINT to target @fluxer/server
+7. ✅ Removed redundant typecheck step
+8. ✅ Generated locale files before build (lingui:compile)
+9. ✅ Reinstalled dependencies after copying source
+10. ✅ Allowed scripts/build directory in .dockerignore
+
+**Built image tags:**
+- `git.i5.wtf/fluxerapp/fluxer-server:nightly`
+- `git.i5.wtf/fluxerapp/fluxer-server:nightly-20260301`
+- `git.i5.wtf/fluxer-server:sha-2e9010d`
+
+## TODO
+
+- [x] Modify GitHub Actions workflows for Gitea compatibility
+- [x] Fix container registry authentication
+- [x] Apply patches from third-party guide
+- [x] Build Docker image
+- [ ] Configure for uwu.lc domain
+- [ ] Deploy to production
+- [ ] Set up backing services (Valkey, NATS, Meilisearch, LiveKit)
+
+## Resources
+
+- **Third-party self-hosting guide**: https://gist.github.com/PaulMColeman/e7ef82e05035b24300d2ea1954527f10
+  - Documents 20 gotchas and fixes for building/deploying Fluxer
+  - Critical for successful Docker build
+- Domain: uwu.lc
+- Gitea: git.i5.wtf
+
+## Known Build Issues from Third-Party Guide
+
+The guide documents these critical Dockerfile fixes needed:
+1. ✅ Fix package path (app → app_proxy)
+2. ✅ Add Rust/WASM toolchain (frontend needs WebAssembly)
+3. ✅ Add ca-certificates (for rustup HTTPS download)
+4. ✅ Fix .dockerignore (unblock build scripts and locale files)
+5. ✅ Set FLUXER_CONFIG env var (rspack needs this)
+6. ✅ Copy config directory for build process
+7. ✅ Update ENTRYPOINT to target fluxer_server package
+
+Additional fixes that may be needed (will address if they come up):
+- Empty CDN endpoint handling (frontend code)
+- Content Security Policy adjustments
+- NATS configuration
+- LiveKit webhook configuration

fluxer_server/Dockerfile

@@ -7,10 +7,11 @@ FROM node:24-trixie-slim AS base
 
 WORKDIR /usr/src/app
 
-RUN corepack enable && corepack prepare pnpm@10.26.0 --activate
+RUN corepack enable && corepack prepare pnpm@10.29.3 --activate
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
 	curl \
+	ca-certificates \
 	python3 \
 	make \
 	g++ \
@@ -25,7 +26,7 @@ COPY patches/ ./patches/
 
 COPY packages/admin/package.json ./packages/admin/
 COPY packages/api/package.json ./packages/api/
-COPY packages/app/package.json ./packages/app/
+COPY packages/app_proxy/package.json ./packages/app_proxy/
 COPY packages/cache/package.json ./packages/cache/
 COPY packages/captcha/package.json ./packages/captcha/
 COPY packages/cassandra/package.json ./packages/cassandra/
@@ -68,14 +69,19 @@ FROM deps AS build
 COPY tsconfigs /usr/src/app/tsconfigs
 
 COPY packages/ ./packages/
-RUN pnpm --filter @fluxer/config generate
 COPY fluxer_server/ ./fluxer_server/
 
+# Reinstall to ensure all dependencies are properly linked after copying source
+RUN pnpm install --frozen-lockfile
+
+RUN pnpm --filter @fluxer/config generate
+
 RUN pnpm --filter @fluxer/marketing build:css
 
 COPY fluxer_media_proxy/data/model.onnx ./fluxer_media_proxy/data/model.onnx
 
-RUN cd fluxer_server && pnpm typecheck
+# Skip typecheck in Docker build - already validated in CI
+# RUN cd fluxer_server && pnpm typecheck
 
 FROM erlang:28-slim AS gateway-build
 
@@ -107,11 +113,26 @@ RUN LOGGER_LEVEL=${LOGGER_LEVEL} envsubst '${LOGGER_LEVEL}' < fluxer_gateway/con
 
 FROM deps AS app-build
 
+# Install Rust and WASM target for frontend WebAssembly compilation
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+ENV PATH="/root/.cargo/bin:${PATH}"
+RUN rustup target add wasm32-unknown-unknown
+
 COPY tsconfigs /usr/src/app/tsconfigs
+COPY config/ ./config/
 
 COPY packages/ ./packages/
 COPY fluxer_app/ ./fluxer_app/
 
+# Reinstall to ensure all dependencies are properly linked after copying source
+RUN pnpm install --frozen-lockfile
+
+# Set FLUXER_CONFIG for rspack to derive API endpoints
+ENV FLUXER_CONFIG=/usr/src/app/config/config.production.template.json
+
+# Generate locale message files before build (needed for TypeScript compilation)
+RUN cd fluxer_app && pnpm lingui:compile
+
 RUN cd fluxer_app && pnpm build
 
 FROM node:24-trixie-slim AS production
@@ -139,7 +160,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 	&& rm -rf /var/lib/apt/lists/*
 
 
-RUN corepack enable && corepack prepare pnpm@10.26.0 --activate
+RUN corepack enable && corepack prepare pnpm@10.29.3 --activate
 
 COPY --from=build /usr/src/app/node_modules ./node_modules
 COPY --from=build /usr/src/app/packages ./packages
@@ -196,4 +217,5 @@ ENV RELEASE_CHANNEL=${RELEASE_CHANNEL}
 HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
 	CMD curl -f http://localhost:8080/_health || exit 1
 
-ENTRYPOINT ["pnpm", "start"]
+# Target the fluxer_server package specifically
+ENTRYPOINT ["pnpm", "--filter", "fluxer_server", "start"]

packages/media_proxy/src/lib/NSFWDetectionService.tsx

@@ -49,6 +49,12 @@ export class NSFWDetectionService {
 	}
 
 	async initialize(): Promise<void> {
+		try {
+			await fs.access(this.modelPath);
+		} catch {
+			this.session = null;
+			return;
+		}
 		const modelBuffer = await fs.readFile(this.modelPath);
 		this.session = await ort.InferenceSession.create(modelBuffer);
 	}
@@ -60,7 +66,7 @@ export class NSFWDetectionService {
 
 	async checkNSFWBuffer(buffer: Buffer): Promise<NSFWCheckResult> {
 		if (!this.session) {
-			throw new Error('NSFW Detection service not initialized');
+			return {isNSFW: false, probability: 0};
 		}
 
 		const processedImage = await this.preprocessImage(buffer);