wardrobegod/depot

depot — the asset CDN (formerly "3GOD")

3GOD was "three.js god": an easy way to eyeball a GLB and drop it into a game. wardrobegod's stage covers the viewing half far better now, so the bench is retired. What survives is the part that quietly became infrastructure: a small HTTP asset server that two shipping games fetch from at runtime.

• server.py (271 lines) — the depot itself. Absorbed verbatim from 3GOD/server.py.
• viewer.html — the old browse/upload UI. Kept for reference only; superseded by wardrobegod's stage, grid and publish flow. Not deployed by us.
• test_hardening.py — its security tests (SSRF allowlist, tag XSS escape, meta race).

Why this is not just deletable

The live instance runs on the dealgod VPS (container 3god, assets bind-mounted at /opt/3god/assets, published on 100.94.195.115:8788, fronted at https://digalot.fyi/3god) and holds 773 assets. Two shipping games read it at runtime:

consumer	line
thriftgod	web/index.html:1176 — const DEPOT = 'https://digalot.fyi/3god';
procity	web/js/.../loaders.js:7 — same URL; LOCAL_DEPOT is null unless ?localdepot=1

Keep the /3god URL even though the name is retired. It is hardcoded in both games; changing it means editing two shipping codebases for no benefit. The name now survives only as a URL path nobody looks at.

Publishing (what wardrobegod does)

POST http://100.94.195.115:8788/api/upload?name=<file>.glb    # raw body, direct over tailnet

Not via https://digalot.fyi/3god. Auth trusts the raw socket peer against a tailnet allow-list, so through the Cloudflare front the peer is CF and every write 403s. Measured: /api/list reports authed=false via CF, authed=true direct. (thriftgod's own shipped tools/prop_campaign.py --publish defaults to the CF URL and is broken for this reason.)

The filename hazard

clean_name deletes illegal characters rather than substituting them, and matching is case-sensitive. So shop!-cat.glb becomes shop-cat.glb — an existing, different mesh — and is then served with no error at all. [A-Za-z0-9._ -] survive verbatim; the first character must be alphanumeric; a missing extension gets .glb appended.

wardrobegod reproduces this rule in god3_name() and refuses to publish over an existing name unless overwrite:true is passed. Do not bypass that check.

Migration note

The depot's /api/meta tag/note store was checked before retiring the UI: 0 of 773 assets had any tags or notes, so nothing needed migrating into wardrobegod's manifest. Tagging now lives in library/index.json.

Retiring the repo

ssh://git@100.71.119.27:222/monster/3GOD.git (Gitea on the old box) can be archived once this copy is committed. The running VPS service is unaffected — it is deployed, not sourced live from that checkout. ultra's ~/Documents/3GOD is a dev copy holding 4 files and its :8788 is closed.

Backup

archive.sh (deployed to ultra:~/depot-backups/archive.sh — outside ~/Documents because launchd + TCC) follows the MeshGod flow: ultra rsyncs the VPS asset dir, then rclones to gdrive:DB-BACKUP/3god-depot. 7.5 GB / 774 assets.

Not git. Git has no delta compression for binary blobs, so 774 GLBs would grow the Gitea repo without bound on every re-upload, and Gitea lives on the disk-tight old box.

Deliberate difference from the MeshGod flow: NO PRUNING. MeshGod prunes VPS .glb older than 180 days because its gallery keeps thumb+index so stale entries still list. This depot is live runtime infrastructure — thriftgod and procity fetch assets by filename at runtime, so deleting an old GLB breaks a shipping game with a 404. Archive only, never prune.

Verify freshness the same way as the other flows: rclone lsl gdrive:DB-BACKUP/3god-depot --include "*.glb" --max-age 36h

⚠️ Shares the whole-fleet risk noted in the backup-verify skill: the gdrive: remote uses rclone's shared Google client_id, which Google retires during 2026. When it dies every Drive flow breaks at once, this one included.