Everything on, phase 1: geolocation fetches itself, the deploy signs in as @thepra, the crawler is on, sign-up by invitation

Owner decisions (2026-10-04, recorded in docs/ROADMAP.md): production runs everything that is built, and nothing waits
on a person running a command.

- Geolocation updates itself. GeoUpdater, a hosted service, checks daily whether each DB-IP Lite database was built this
  month. If not, it fetches this month's, or last month's early in the month. It installs a file only once it opens as
  the right kind of database, then swaps it in atomically, and the locator reloads at once. Lookups now run under the
  lock, so a reload can no longer dispose a reader mid-lookup. The systemd timer, its script and their setup.sh lines
  are gone: the root step they needed never happened, and none is needed now. /stargazing names the database in use.
- The admin CLI runs after the app is built, with every service and nothing started.
  - `create-root <login> [--admin]` takes the password on stdin; it is how the first login is made while sign-up is
    closed.
  - `smoke <persona>` keeps the root `deploy-smoke` and an undiscoverable persona, and gives the root a new password
    on every run.
- The deploy signs in as @thepra. It runs the CLI, gets a token through the real OAuth flow (tools/smoke/oauth.sh,
  moved out of the pasture's privapub_token, which now uses it), checks the signed-in API and that @thepra is
  undiscoverable, then revokes the token. PRIVAPUB_SMOKE_TOKEN is gone.
- The deploy also fails when:
  - NodeInfo and the instance API disagree about registrations;
  - /stargazing does not say the crawler is on;
  - the geolocation databases are missing or more than 40 days old.
- The crawler is on in production, seeded with ten large servers of different kinds. FEDERATION.md now describes it
  and how to opt out.
- One registrations switch (Registrations:Mode, default Invitations; Open in tests and the pasture). It is read by
  open sign-up (403 when closed), NodeInfo `openRegistrations`, and v1 and v2 of the instance API, so they can no longer
  disagree. Before, NodeInfo said open and the instance API said closed. Group invitations always work, so
  invites_enabled is true.
- A persona edit through /clientapi no longer resets what the Mastodon API set (discoverable, locked, quote policy…):
  the theme is merged into the settings instead of replacing them.

650 tests pass. The deploy's smoke step was rehearsed against the pasture's PrivaPub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

tools/pasture/appsettings.Pasture.json

@@ -26,6 +26,8 @@
 	},
 	"Media": { "Root": "/tmp/privapub-media" },
 	"RateLimits": { "AccountsPerMinute": 1000 },
+	"Registrations": { "Mode": "Open" },
+	"Statistics": { "Geo": { "AutoUpdate": false } },
 	"Kestrel": { "Endpoints": { "Http": { "Url": "http://0.0.0.0:80", "Protocols": "Http1AndHttp2" } } },
 	"Serilog": {
 		"MinimumLevel": { "Default": "Information", "Override": { "Microsoft": "Warning", "System": "Warning" } },

tools/pasture/lib/interop.sh

@@ -30,37 +30,14 @@ privapub_root() {
 	echo "$root" | j "print(d['token'])"
 }
 
-# privapub_token <persona>: creates the persona under the pasture root if needed and returns a Mastodon token for it.
+# privapub_token <persona>: creates the persona under the pasture root if needed and returns a Mastodon token for it,
+# through the same OAuth flow the deploy's smoke check uses (tools/smoke/oauth.sh).
 privapub_token() {
-	local persona=$1 jwt cid cs q xt form code
+	local persona=$1 jwt
 	jwt=$(privapub_root)
 	curl -s -o /dev/null -X POST $P/clientapi/avatar/private/insert -H 'Content-Type: application/json' -H "Authorization: Bearer $jwt" \
 		-d "{\"userName\":\"$persona\",\"name\":\"$persona of PrivaPub\",\"biography\":\"testing federation\"}"
-	local app; app=$(curl -s -X POST $P/api/v1/apps -d 'client_name=pasture&redirect_uris=urn:ietf:wg:oauth:2.0:oob&scopes=read+write+follow')
-	cid=$(echo "$app" | j "print(d['client_id'])"); cs=$(echo "$app" | j "print(d['client_secret'])")
-	q="client_id=$cid&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&scope=read+write+follow"
-	local jar="$work/jar-$persona"
-	xt=$(curl -s -c "$jar" -b "$jar" "$P/oauth/login?returnUrl=/oauth/authorize?$q" | grep -o 'name="__RequestVerificationToken" type="hidden" value="[^"]*"' | sed 's/.*value="//;s/"//')
-	curl -s -o /dev/null -c "$jar" -b "$jar" -X POST $P/oauth/login --data-urlencode "returnUrl=/oauth/authorize?$q" --data-urlencode "__RequestVerificationToken=$xt" \
-		--data-urlencode "userName=$ROOT_USER" --data-urlencode "password=$ROOT_PASS"
-	curl -s -c "$jar" -b "$jar" "$P/oauth/authorize?$q&signed_in=1" > "$work/choose-$persona.html"
-	form=$(python3 - "$work/choose-$persona.html" "$persona" <<'PY'
-import re,sys,urllib.parse,html
-s=open(sys.argv[1]).read()
-pairs=[(k,html.unescape(v)) for k,v in re.findall(r'<input type="hidden" name="([^"]*)" value="([^"]*)"',s)]
-blocks=re.findall(r'<label[^>]*>(.*?)</label>',s,re.S)
-avatar=None
-for b in blocks:
-    if '@'+sys.argv[2]+'@' in b or '@'+sys.argv[2]+'<' in b or '>'+sys.argv[2]+'<' in b:
-        m=re.search(r'name="avatarId" value="([^"]*)"',b)
-        if m: avatar=m.group(1)
-if avatar is None:
-    avatar=re.findall(r'name="avatarId" value="([^"]*)"',s)[0]
-print(urllib.parse.urlencode(pairs+[("avatarId",avatar),("decision","allow")]))
-PY
-)
-	code=$(curl -s -c "$jar" -b "$jar" -X POST $P/oauth/authorize --data "$form" | grep -o '<code>[^<]*</code>' | sed 's/<[^>]*>//g')
-	curl -s -X POST $P/oauth/token -d "grant_type=authorization_code&code=$code&client_id=$cid&client_secret=$cs&redirect_uri=urn:ietf:wg:oauth:2.0:oob" | j "print(d['access_token'])"
+	"$here/../smoke/oauth.sh" "$P" "$ROOT_USER" "$ROOT_PASS" "$persona" "read write follow" | cut -d' ' -f1
 }
 
 # stats_check <host> <software>: the admin statistics name the peer's software and count traffic both ways.

tools/smoke/oauth.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Gets a Mastodon API token for one persona through PrivaPub's real OAuth code flow, as a client would: register an app,
+# sign in with the root's password at /oauth/login, choose the persona at /oauth/authorize, read the out-of-band code and
+# exchange it. Prints "<access token> <client id> <client secret>" so the caller can revoke the token afterwards.
+# usage: tools/smoke/oauth.sh <base url> <root login> <root password> <persona> [scopes]
+set -euo pipefail
+BASE="${1:?base url}"; LOGIN="${2:?root login}"; PASSWORD="${3:?root password}"; PERSONA="${4:?persona}"; SCOPES="${5:-read}"
+jar=$(mktemp -d); trap 'rm -rf "$jar"' EXIT
+json() { python3 -c "import sys,json; d=json.load(sys.stdin); print($1)"; }
+
+app=$(curl -fsS -X POST "$BASE/api/v1/apps" --data-urlencode client_name=privapub-oauth \
+	--data-urlencode redirect_uris=urn:ietf:wg:oauth:2.0:oob --data-urlencode "scopes=$SCOPES")
+cid=$(echo "$app" | json "d['client_id']"); cs=$(echo "$app" | json "d['client_secret']")
+scope_q=$(python3 -c "import sys,urllib.parse; print(urllib.parse.quote(sys.argv[1]))" "$SCOPES")
+q="client_id=$cid&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&scope=$scope_q"
+
+xt=$(curl -fsS -c "$jar/c" -b "$jar/c" "$BASE/oauth/login?returnUrl=/oauth/authorize?$q" \
+	| grep -o 'name="__RequestVerificationToken" type="hidden" value="[^"]*"' | sed 's/.*value="//;s/"//')
+curl -sS -o /dev/null -c "$jar/c" -b "$jar/c" -X POST "$BASE/oauth/login" --data-urlencode "returnUrl=/oauth/authorize?$q" \
+	--data-urlencode "__RequestVerificationToken=$xt" --data-urlencode "userName=$LOGIN" --data-urlencode "password=$PASSWORD"
+curl -fsS -c "$jar/c" -b "$jar/c" "$BASE/oauth/authorize?$q&signed_in=1" > "$jar/choose.html"
+form=$(python3 - "$jar/choose.html" "$PERSONA" <<'PY'
+import re, sys, urllib.parse, html
+page = open(sys.argv[1]).read()
+pairs = [(k, html.unescape(v)) for k, v in re.findall(r'<input type="hidden" name="([^"]*)" value="([^"]*)"', page)]
+persona = None
+for block in re.findall(r'<label[^>]*>(.*?)</label>', page, re.S):
+    if '@' + sys.argv[2] + '@' in block or '@' + sys.argv[2] + '<' in block or '>' + sys.argv[2] + '<' in block:
+        found = re.search(r'name="avatarId" value="([^"]*)"', block)
+        if found:
+            persona = found.group(1)
+if persona is None:
+    sys.exit("persona '%s' is not offered at /oauth/authorize" % sys.argv[2])
+print(urllib.parse.urlencode(pairs + [("avatarId", persona), ("decision", "allow")]))
+PY
+)
+code=$(curl -fsS -c "$jar/c" -b "$jar/c" -X POST "$BASE/oauth/authorize" --data "$form" | grep -o '<code>[^<]*</code>' | sed 's/<[^>]*>//g')
+[ -n "$code" ] || { echo "no authorization code" >&2; exit 1; }
+token=$(curl -fsS -X POST "$BASE/oauth/token" --data-urlencode grant_type=authorization_code --data-urlencode "code=$code" \
+	--data-urlencode "client_id=$cid" --data-urlencode "client_secret=$cs" --data-urlencode redirect_uri=urn:ietf:wg:oauth:2.0:oob \
+	| json "d['access_token']")
+echo "$token $cid $cs"