dtok

dtok is a cookie-gated, full-screen short-form review feed and comparison lab. It ships the audience feed, pairwise comparison surface, aggregate dashboard, editorial cut room, a Go recommendation/telemetry service, SQLite state, and the generated media catalog as one repository.

Production has separate public and tailnet ingress paths to one loopback app:

internet browser -> Cloudflare -> Caddy (strips Tailscale headers)
dread tailnet browser ---------> Tailscale Serve (verified identity headers)
  -> dtok on 127.0.0.1:8787, hybrid identity
  -> SQLite at /var/lib/dtok/dtok.sqlite3
  -> release-local, Git-LFS-materialized media

Caddy and Tailscale Serve are the only web ingresses. The Go service and the R2-backed Git LFS helper stay on loopback. Production runs with DTOK_AUTH=hybrid: public visitors explicitly consent to one first-party profile cookie, while tailnet users retain verified Tailscale identity. Editorial routes remain restricted to an explicit Tailscale admin allowlist. The same single required consent enables Bread behavioral, WebMCP, and session-replay capture; Dreadtok does not operate without its research signals.

Local development

cd mlst_review
go run .

Open http://127.0.0.1:8787/mlst_feed/. The local process defaults to dev identity mode; production must override it.

Run the repository tests before building a release:

make check

The more detailed application behavior and local privacy model are documented in mlst_review/README.md.

Operations

The complete Ubuntu/Vultr handoff is in docs/deployment.md. It covers:

• bootstrapping the localhost-only R2 Git LFS helper on port 8019;
• the exact skip-smudge clone and LFS pull sequence;
• atomic, hard-link-deduplicated releases and rollback;
• systemd and environment-file installation;
• Tailscale Serve, tailnet grants, UFW, and no-Funnel checks;
• consistent SQLite backups outside the release tree; and
• identity, privacy, byte-range, public-port, and restore smoke tests.

The public Caddy, Cloudflare, cookie, and dual-ingress procedure is in docs/public-launch.md.

The initial packaging, authorization, LFS upload, adapter fix, verification, and data-migration work is recorded in docs/work-log-2026-08-06.md.

Files under deploy/ are examples. Copy them to their documented host paths, fill in host-local secrets and login lists, and review them before enabling any unit.

Pushing media

The repository intentionally commits .lfsconfig with http://localhost:8019. Start the bucket-backed LFS helper on the editing machine first, then use ordinary Git:

curl -H 'Content-Type: application/vnd.git-lfs+json' \
  --data '{"operation":"download","objects":[]}' \
  http://127.0.0.1:8019/objects/batch
git lfs env
git add --all
git lfs ls-files
git commit
git push origin main

The pre-push hook uploads LFS objects through port 8019 before Git sends the pointer commit to dgit. Do not use --no-verify. Every clone/pull machine must run its own localhost:8019 helper against the same bucket; the exact skip-smudge bootstrap is in the deployment guide.