9423cf8f64
SCHEDULE. games.monsterrobot.depot-archive installed on ultra, daily 05:30 — after meshgod at 05:00, matching the existing games.monsterrobot.* launchd convention, plist kept in the repo beside the script. plutil-linted and bootstrapped; launchctl reports it registered. PRUNE. John wants old GLBs off the live VPS while keeping everything backed up. Age alone cannot decide that: two shipping games resolve depot assets BY FILENAME at runtime, so a three-year-old mesh some game still names is load-bearing, not stale, and deleting it is a 404 in a released build. So prune.py deletes only when all three hold — older than --days, named in NO consumer's source (scanning js/html/json/ts across thriftgod, procity and 90sDJsim, including the JSON manifests that also carry depot refs), and an identical-SIZE copy confirmed in the Drive archive. Size mismatch counts as unbacked; it never deletes on a maybe. Dry-run by default, and apply re-verifies every rule rather than trusting the earlier plan. Thumbnails and meta.json are left alone so the depot keeps listing pruned entries, as the MeshGod archive does. Measured today it deletes NOTHING, correctly: of 774 assets, 35 are game-referenced and 724 are newer than a 180-day cutoff — every asset in the depot is under 30 days old. Reported as-is rather than loosening the cutoff to manufacture a result. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
5.1 KiB
depot — the asset CDN (formerly "3GOD")
3GOD was "three.js god": an easy way to eyeball a GLB and drop it into a game. wardrobegod's stage covers the viewing half far better now, so the bench is retired. What survives is the part that quietly became infrastructure: a small HTTP asset server that two shipping games fetch from at runtime.
server.py(271 lines) — the depot itself. Absorbed verbatim from3GOD/server.py.viewer.html— the old browse/upload UI. Kept for reference only; superseded by wardrobegod's stage, grid and publish flow. Not deployed by us.test_hardening.py— its security tests (SSRF allowlist, tag XSS escape, meta race).
Why this is not just deletable
The live instance runs on the dealgod VPS (container 3god, assets bind-mounted at
/opt/3god/assets, published on 100.94.195.115:8788, fronted at https://digalot.fyi/3god)
and holds 773 assets. Two shipping games read it at runtime:
| consumer | line |
|---|---|
| thriftgod | web/index.html:1176 — const DEPOT = 'https://digalot.fyi/3god'; |
| procity | web/js/.../loaders.js:7 — same URL; LOCAL_DEPOT is null unless ?localdepot=1 |
Keep the /3god URL even though the name is retired. It is hardcoded in both games; changing
it means editing two shipping codebases for no benefit. The name now survives only as a URL path
nobody looks at.
Publishing (what wardrobegod does)
POST http://100.94.195.115:8788/api/upload?name=<file>.glb # raw body, direct over tailnet
Not via https://digalot.fyi/3god. Auth trusts the raw socket peer against a tailnet
allow-list, so through the Cloudflare front the peer is CF and every write 403s. Measured:
/api/list reports authed=false via CF, authed=true direct. (thriftgod's own shipped
tools/prop_campaign.py --publish defaults to the CF URL and is broken for this reason.)
The filename hazard
clean_name deletes illegal characters rather than substituting them, and matching is
case-sensitive. So shop!-cat.glb becomes shop-cat.glb — an existing, different mesh — and
is then served with no error at all. [A-Za-z0-9._ -] survive verbatim; the first character must
be alphanumeric; a missing extension gets .glb appended.
wardrobegod reproduces this rule in god3_name() and refuses to publish over an existing name
unless overwrite:true is passed. Do not bypass that check.
Migration note
The depot's /api/meta tag/note store was checked before retiring the UI: 0 of 773 assets had
any tags or notes, so nothing needed migrating into wardrobegod's manifest. Tagging now lives in
library/index.json.
Retiring the repo
ssh://git@100.71.119.27:222/monster/3GOD.git (Gitea on the old box) can be archived once this
copy is committed. The running VPS service is unaffected — it is deployed, not sourced live from
that checkout. ultra's ~/Documents/3GOD is a dev copy holding 4 files and its :8788 is closed.
Backup
archive.sh (deployed to ultra:~/depot-backups/archive.sh — outside ~/Documents because
launchd + TCC) follows the MeshGod flow: ultra rsyncs the VPS asset dir, then rclones to
gdrive:DB-BACKUP/3god-depot. 7.5 GB / 774 assets.
Not git. Git has no delta compression for binary blobs, so 774 GLBs would grow the Gitea repo without bound on every re-upload, and Gitea lives on the disk-tight old box.
Deliberate difference from the MeshGod flow: NO PRUNING. MeshGod prunes VPS .glb older than
180 days because its gallery keeps thumb+index so stale entries still list. This depot is live
runtime infrastructure — thriftgod and procity fetch assets by filename at runtime, so deleting
an old GLB breaks a shipping game with a 404. Archive only, never prune.
Verify freshness the same way as the other flows:
rclone lsl gdrive:DB-BACKUP/3god-depot --include "*.glb" --max-age 36h
⚠️ Shares the whole-fleet risk noted in the backup-verify skill: the gdrive: remote uses
rclone's shared Google client_id, which Google retires during 2026. When it dies every Drive flow
breaks at once, this one included.
Schedule
games.monsterrobot.depot-archive — launchd on ultra, daily 05:30 (after meshgod at 05:00),
logging to ~/depot-backups/launchd.log. Plist kept here alongside the script.
Pruning (prune.py)
Reclaims VPS disk without the 404 risk, because age alone is not a safe criterion — a three-year-old asset a game still names is load-bearing, not stale. A GLB is deleted only when all three hold:
- older than
--days - its name appears in no consumer's source (js/html/json/ts across thriftgod, procity, 90sDJsim)
- an identical-size copy is confirmed in the Drive archive
Dry-run by default (plan); apply re-verifies every rule before deleting. Thumbnails and
meta.json are never touched, so the depot keeps listing pruned assets — same behaviour as the
MeshGod archive.
python3 ~/depot-backups/prune.py plan --days 180 # on ultra, where rclone lives
As of 2026-07-24 this deletes nothing: of 774 assets, 35 are game-referenced and 724 are newer than the cutoff. Every asset in the depot is under 30 days old. The mechanism is armed for when that changes.