test(e2e): the calendar test counted other tests' tasks as its own

The calendar test asserted `[data-date=day] .tevent` had a count of exactly one —
the mocked meeting — after dragging its task to the next day. That count assumed
the day held nothing but this test's own events. It does not: the suite shares one
database, and an earlier test drags a task across a month boundary, which on some
dates lands a timed task on this very day. A timed task renders as a `.tevent`
too, so the count was two, and the test failed — but only in the full run, and
only when the date arithmetic put the two tests on the same cell. Alone it passed,
which is exactly the shape of a shared-state collision rather than a real bug.

Named, not counted: assert the meeting is still there and the task is no longer in
the day's column, which is what "the events stayed, the task moved" actually
means — and is true however full another test left the day. Same for the all-day
band. No product code changed; the drag and everything it checks are untouched.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitea/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,46 @@
+name: Bug
+# Gitea kalder feltet `about`, hvor GitHub kalder det `description`, og Gitea
+# *kræver* det: en skabelon uden bliver afvist frem for at blive vist. Derfor
+# ligger skabelonerne her for sig frem for at være delt med `.github/`.
+about: Something does not work
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: And what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: How to reproduce it
+      placeholder: |
+        1. …
+        2. …
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: The image tag, or the commit you built from.
+    validations:
+      required: true
+  - type: dropdown
+    id: how
+    attributes:
+      label: How are you running it
+      options:
+        - As a Rune in Yggdrasil Panel
+        - Docker directly
+        - From source
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Anything in the logs
+      description: Please remove tokens and email addresses first.
+      render: text

.gitea/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security issue
+    url: https://gitea.nolimit.dk/kw/verdande/src/branch/main/SECURITY.md
+    about: Please report vulnerabilities by email, not as a public issue.

.gitea/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,24 @@
+name: Feature
+about: Suggest something
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      # Absolut adresse, ikke GitHubs `../../blob/main/…`: Gitea lægger en fil
+      # under `/src/branch/<gren>/`, så den relative form peger ingen steder her.
+      value: |
+        Please check the [non-goals](https://gitea.nolimit.dk/kw/verdande/src/branch/main/README.md#non-goals)
+        first — some things are deliberately not being built.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do
+      description: The problem, not the solution. What does the current version make hard?
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What you had in mind
+    validations:
+      required: false

.gitea/workflows/ci.yml

@@ -0,0 +1,273 @@
+name: CI
+
+# Gitea-tvillingen til .github/workflows/ci.yml. Den prøver at nå samme resultat
+# ad en anden vej, og forskellen er hele pointen med filen:
+#
+# INGEN `uses:`. Gitea Actions kan læse GitHubs format, men `DEFAULT_ACTIONS_URL`
+# står ikke i app.ini på gitea.nolimit.dk, og standarden er github.com — så et
+# `uses: actions/checkout@v4` her ville blive hentet FRA GitHub, hver gang, også
+# selvom både koden, runneren og registret er vores egne. Et workflow, der bruger
+# markedspladsen, er derfor ikke uafhængigt af GitHub; det ser bare sådan ud.
+#
+# Prisen er, at værktøjskæden skal komme et sted fra. Den kommer fra jobbets
+# container, hvilket er billigere end det lyder: `container: golang:1.26` er
+# nøjagtig det, setup-go ellers ville bruge et trin på at installere.
+#
+# Alternativerne, hvis nogen senere vil skrive filen om: sæt DEFAULT_ACTIONS_URL
+# til gitea.com, som spejler de gængse handlinger — men det flytter kun
+# afhængigheden fra én andens server til en andens, og det er en indstilling for
+# HELE instansen, altså også for alt andet, der bygger der. Denne fil rører kun
+# dette repo.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # Så en kørsel kan udløses uden at skulle opfinde en commit. Det er ikke
+  # bekvemmelighed: uden den er den eneste måde at få CI til at køre igen mod
+  # uændret kode at skubbe noget tomt, og en tom commit i historikken er en
+  # løgn om, at der skete noget.
+  workflow_dispatch:
+
+# Ingen `concurrency:`-blok. GitHub-udgaven aflyser en kørsel, når en nyere
+# kommer, og det er stadig det rigtige at gøre — men understøttelsen kom sent til
+# Gitea Actions, og et felt, runneren ikke kender, er en fejl ved oversættelsen
+# frem for en ignoreret linje. Den kan sættes på, når instansen er en version,
+# der kan.
+
+jobs:
+  go:
+    name: Go
+    runs-on: ubuntu-latest
+    # Containeren ER værktøjskæden. `-race` kræver en C-oversætter, og den er med
+    # i det officielle golang-image — et slankere ville koste et apt-trin.
+    container:
+      image: golang:1.26
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          # Håndrullet, fordi actions/checkout ville blive hentet fra GitHub.
+          # Det er de samme fire greb, den handling tager: init, remote, en
+          # fetch af præcis den commit, der udløste kørslen, og et checkout.
+          #
+          # Legitimationen sættes med -c på selve fetch-kommandoen frem for i
+          # remotens adresse. En adresse med token i havner i .git/config, i
+          # `git remote -v` og i enhver fejlbesked, der citerer den; en header
+          # gør ikke.
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      - name: Formatting
+        run: |
+          unformatted=$(gofmt -l .)
+          if [ -n "$unformatted" ]; then
+            echo "These files are not gofmt'd:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      # -race is the whole point of running tests in CI for a server with a
+      # WebSocket fan-out: a data race is exactly the bug that passes locally.
+      - name: Test
+        run: go test -race -count=1 ./...
+
+      - name: Build
+        run: CGO_ENABLED=0 go build ./...
+
+  spec:
+    name: OpenAPI is valid
+    runs-on: ubuntu-latest
+    container:
+      image: node:22
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      # Structural validity only. That the spec matches the *router* is checked by
+      # a Go test, which is the half that actually goes stale.
+      - run: npx --yes @redocly/cli@latest lint docs/openapi.yaml
+
+  e2e:
+    name: End-to-end
+    runs-on: ubuntu-latest
+    # node frem for golang her: Playwrights browsere trækker et lag
+    # Debian-pakker, som npm-imaget er vant til at have, mens Go til gengæld er
+    # fire linjer at hælde ind. Den anden vej rundt er den dyre.
+    container:
+      image: node:22
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      - name: Go
+        run: |
+          set -eu
+          # Versionen læses ud af go.mod frem for at stå her. To steder at rette
+          # er ét for mange, og den slags glemmes lige indtil CI bygger med en
+          # anden Go end udviklerne.
+          version=$(awk '/^go /{print $2; exit}' go.mod)
+          arch=$(dpkg --print-architecture)
+          curl -fsSL "https://go.dev/dl/go${version}.linux-${arch}.tar.gz" | tar -xz -C /usr/local
+          echo /usr/local/go/bin >> "$GITHUB_PATH"
+
+      - name: Install
+        working-directory: web
+        run: npm ci --no-audit --no-fund
+
+      # Chromium for the suite, WebKit for one test.
+      #
+      # A smoke test exists to catch a build that does not work at all, and running
+      # the whole thing in three engines finds the same breakage three times for
+      # three times the cost. Focus is the exception, and it took a real report to
+      # learn it: Safari ignores `autofocus` on anything inserted after the page has
+      # loaded, so every inline form in the app opened with no cursor in it. WebKit
+      # here is the same engine Safari is, and `webkit-forms` in the Playwright
+      # config greps a single test out of the suite to run in it.
+      - name: Install browsers
+        working-directory: web
+        run: npx playwright install --with-deps chromium webkit
+
+      # The suite builds the frontend, embeds it and starts the real binary — see
+      # playwright.config.js. There is nothing to build here first.
+      - name: Test
+        working-directory: web
+        run: npm run test:e2e
+
+      # Ingen rapport at hente ned bagefter. GitHub-udgaven lægger
+      # web/playwright-report/ op som et artefakt, og det trin ER en handling fra
+      # markedspladsen — der er ikke en `run:`-form af det. Går suiten i stykker
+      # her, står grunden i loggen frem for i en zip. Skal rapporten tilbage, er
+      # det upload-artifact spejlet ind lokalt, ikke en linje mere i denne fil.
+
+  docker:
+    name: Docker image builds
+    runs-on: ubuntu-latest
+    # Ingen `container:` her: jobbet skal bruge docker-klienten og buildx, og dem
+    # har runnerens eget ubuntu-image. En golang- eller node-container ville have
+    # sproget og mangle værktøjet.
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      # Build only — publishing happens on a tag, in release.yml. This job exists
+      # so a Dockerfile that no longer builds fails on the pull request rather
+      # than at release time.
+      #
+      # `type=cacheonly` frem for `--load`: resultatet skal ingen steder hen, og
+      # at hente et image ind i daemonen for straks at glemme det er et halvt
+      # minut hver kørsel. Én arkitektur er nok til at fange en Dockerfile, der
+      # ikke bygger; de to rigtige bygges på et mærkat.
+      - name: Build
+        run: |
+          set -eu
+          docker buildx create --use --name ci-verdande 2>/dev/null || docker buildx use ci-verdande
+          docker buildx build --platform linux/amd64 --output type=cacheonly .

.gitea/workflows/release.yml

@@ -0,0 +1,126 @@
+name: Release
+
+# Samme udløser som GitHub-workflowet: et semver-tag, og ikke andet.
+#
+# Gitea Actions læser samme format som GitHub Actions, men det er *ikke* det
+# samme sted. Filen ligger derfor for sig frem for at være delt: der er intet
+# `secrets.GITHUB_TOKEN`, registret er et andet, og der er ingen Releases-side at
+# skrive til. En delt fil ville være fire betingede led, der hver kun gælder ét
+# af de to steder.
+#
+# Og som i ci.yml: ingen `uses:`. Handlinger hentes fra github.com, så længe
+# DEFAULT_ACTIONS_URL ikke er sat — se den lange forklaring der.
+on:
+  push:
+    tags: ["v[0-9]+.[0-9]+.[0-9]+*"]
+
+jobs:
+  image:
+    name: Build and publish image
+    # `ubuntu-latest` er runnerens egen etiket (`ovh-1`, docker-mode). Ingen
+    # `container:`: jobbet skal bruge docker-klienten og buildx, og dem har
+    # runnerens image.
+    runs-on: ubuntu-latest
+    env:
+      REGISTRY: gitea.nolimit.dk
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      # setup-qemu-action i rå form. Uden den bygger buildx kun værtens egen
+      # arkitektur, og arm64 er ikke valgfrit: et hjemmelab er lige så tit en
+      # Raspberry Pi eller en Apple silicon-VM som en x86-kasse.
+      - name: Emulation for the other architecture
+        run: docker run --privileged --rm tonistiigi/binfmt --install arm64,amd64
+
+      - name: Builder
+        run: docker buildx create --use --name release-verdande 2>/dev/null || docker buildx use release-verdande
+
+      # `GITEA_TOKEN` er automatisk til stede i et Actions-job og har lov at
+      # skrive pakker for den, der ejer repoet. Ingen hemmelighed at sætte op.
+      # --password-stdin frem for --password: det sidste ville stå i processens
+      # kommandolinje, som enhver på maskinen kan læse.
+      - name: Log in to the registry
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: printf '%s' "$TOKEN" | docker login "$REGISTRY" -u "$GITHUB_ACTOR" --password-stdin
+
+      # metadata-action i rå form.
+      #
+      # v1.4.2 udgiver 1.4.2, 1.4, 1 og latest — så en rune, der er bundet til
+      # :1, får rettelser uden nogensinde at krydse et hovedversionsskifte.
+      #
+      # En forudgivelse (v1.4.2-rc1) får KUN sit eget nøjagtige mærkat. At lade
+      # en rc overskrive :latest eller :1 ville sende den ud til alle, der troede
+      # de fulgte det stabile spor — og mærkatmønsteret ovenfor lukker dem ind.
+      - name: Work out the tags
+        id: tags
+        run: |
+          set -eu
+          version=${GITHUB_REF_NAME#v}
+          image="$REGISTRY/$GITHUB_REPOSITORY"
+          args="--tag $image:$version"
+          case "$version" in
+            *-*) echo "Forudgivelse: kun $version." ;;
+            *)
+              minor=${version%.*}
+              major=${version%%.*}
+              args="$args --tag $image:$minor --tag $image:$major --tag $image:latest"
+              ;;
+          esac
+          echo "args=$args" >> "$GITHUB_OUTPUT"
+          echo "Mærkater: $args"
+
+      - name: Build and push
+        run: |
+          set -eu
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            ${{ steps.tags.outputs.args }} \
+            --build-arg "VERSION=$GITHUB_REF_NAME" \
+            --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
+            --label "org.opencontainers.image.version=$GITHUB_REF_NAME" \
+            --label "org.opencontainers.image.revision=$GITHUB_SHA" \
+            --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            .
+          # Ingen `cache-from: type=gha`. act_runner har en cache-tjeneste, der
+          # svarer på det navn, men den er ikke prøvet her, og en kold bygning,
+          # der tager nogle minutter længere, er billigere end en udgivelse, der
+          # fejler på noget, som ikke har med bygningen at gøre.
+
+    # Ingen Release oprettes.
+    #
+    # GitHub-workflowet laver en Release, fordi opdateringsnotitsen i appen læser
+    # `releases/latest` derfra. Gitea har sit eget Releases-begreb, men notitsen
+    # peger på GitHub — så en release her ville ingen læse. Skal notitsen flyttes
+    # med, er det `internal/update`, der skal have en ny adresse, og det er en
+    # ændring for sig. (Bemærk også, at GitHub-udgavens softprops-handling taler
+    # mod api.github.com og ikke kan genbruges her.)

.gitignore

@@ -67,5 +67,9 @@ node_modules.nosync/
 HANDOFF.md
 NOTES-PLAN.md
 
+# Samme grund: instruktionen til flytningen navngiver kassen, runneren, registret
+# og hvordan man kommer til dem. Arbejdspapir, ikke produktdokumentation.
+GITEA-FLYTNING.md
+
 # Agenternes arbejdstræer. Et git-repo inde i et git-repo, som ikke hører til her.
 .claude/worktrees/

docs/configuration.md

@@ -12,6 +12,25 @@ nowhere to put one that the operator would ever see.
 | `VERDANDE_DATA_DIR` | `/data` | Database, uploaded files and backups. |
 | `VERDANDE_DEV` | `false` | Human-readable logs at debug level, and a relaxed origin check so a Vite dev server can connect. Never in production. |
 
+## Behind a proxy
+
+verdande keys its login rate limit and its audit log on the caller's address, so
+that address has to be one the caller cannot forge. A forwarded-for header is
+believed only when the machine that connected is a trusted proxy; a connection
+straight off the internet is keyed on the address it really came from.
+
+| Variable | Default | What it does |
+|---|---|---|
+| `VERDANDE_TRUSTED_PROXIES` | private networks | Whose `X-Forwarded-For` to believe, as comma-separated CIDRs. The default trusts loopback and the private ranges — the shape of a reverse proxy or tunnel sharing the host or the docker bridge. Set to `none` for an instance exposed directly with no proxy, so no forwarded header is ever believed. |
+| `VERDANDE_REAL_IP_HEADER` | `X-Forwarded-For` | The header the client address is read from, for a trusted proxy. |
+
+!!! warning "A proxy that does not overwrite the header"
+    The default is safe when your proxy replaces a client-supplied
+    `X-Forwarded-For` with the real address — nginx, Caddy and Cloudflare Tunnel all
+    do. If yours passes the client's own header through, narrow
+    `VERDANDE_TRUSTED_PROXIES` to just your proxy's address so a visitor cannot
+    choose the address they are rate-limited and logged as.
+
 ## Sessions and links
 
 | Variable | Default | What it does |

docs/rune.md

@@ -7,14 +7,14 @@ verdande ships with a Rune manifest for
 
 ```
 create container: Error response from daemon:
-No such image: ghcr.io/kristianwind/verdande:latest
+No such image: gitea.nolimit.dk/kw/verdande:latest
 ```
 
 This message is a liar. It does not mean the tag is missing from the registry —
 it means the image is not on the host, and the panel's attempt to fetch it failed
 without saying so.
 
-The usual cause is a **private** GHCR package. Yggdrasil pulls anonymously: its
+The usual cause is a **private** package. Yggdrasil pulls anonymously: its
 `PullImage` calls the Docker SDK with no `RegistryAuth`, so a private image comes
 back 401. The pull error is discarded, and `ContainerCreate` — which only ever
 looks locally — then reports the image as missing.
@@ -24,10 +24,28 @@ looks locally — then reports the image as missing.
     sends them itself with each request. Yggdrasil is a different client and
     sends none, so logging in changes nothing for the panel.
 
-**Make the package public.** Under
-[Packages → verdande → Package settings](https://github.com/users/kristianwind/packages/container/package/verdande)
-→ *Change visibility*. The repository stays private; only the built image becomes
-readable, which is what the manifest and these pages have always assumed.
+**The package has to be readable without credentials**, and the only way to know
+is to ask the registry for a token as a stranger:
+
+```bash
+curl -s "https://ghcr.io/token?scope=repository:kristianwind/verdande:pull&service=ghcr.io"
+```
+
+A 200 with a `token` in it means anyone can pull, which means the panel can. A
+401 means it cannot, whatever the package page says.
+
+!!! danger "Do not test this with `docker --config /tmp/empty pull`"
+    It looks like the honest test and is not. An empty config directory does not
+    stop the machine's credential helper, so the pull is quietly authenticated
+    with credentials you forgot you had — and reports success for an image no
+    stranger can fetch. This cost a production instance an hour of downtime: the
+    image was declared public on that evidence, the rune was pointed at it, and
+    the host — which had never logged in — could not pull a thing.
+
+    A self-hosted Gitea is where this bites. An instance with `REQUIRE_SIGNIN_VIEW`
+    turned on refuses anonymous tokens for its registry too, and no per-package
+    setting overrides it. Making the source repository public does not change it
+    either; that was tried.
 
 Once it is public, press **Start** on the server you already have. There is no
 need to delete it and make another: the image reference is read from the rune at
@@ -37,8 +55,8 @@ To keep the package private you have to put the image on the host yourself,
 before creating the server, and again after every release:
 
 ```bash
-sudo docker login ghcr.io -u kristianwind
-sudo docker pull ghcr.io/kristianwind/verdande:latest
+sudo docker login gitea.nolimit.dk -u kw
+sudo docker pull gitea.nolimit.dk/kw/verdande:latest
 ```
 
 Run it as the user the Docker daemon runs as — `sudo` if the panel does. The

docs/self-hosting.md

@@ -6,9 +6,10 @@ cache, no queue and no second process.
 ## Docker
 
 !!! note "If the pull is refused"
-    The GHCR package is public, so this needs no credentials. If it is ever set
-    back to private, `docker login ghcr.io` with a token carrying the
-    `read:packages` scope before pulling — and see
+    The image is published from a self-hosted Gitea and is readable without
+    credentials — the package is not linked to a repository, so its visibility
+    follows the account rather than the (private) source repo. If it is ever set
+    back to private, `docker login gitea.nolimit.dk` before pulling — and see
     [the Rune page](rune.md#if-the-image-will-not-pull), because a private image
     fails differently and much more confusingly under Yggdrasil.
 

internal/ai/ai.go

@@ -47,6 +47,12 @@ type Config struct {
 	// ProviderCompatible and useful for a proxy in front of the others.
 	BaseURL string
 	Model   string
+	// AllowPrivate lets BaseURL be on this machine or its private network.
+	//
+	// Set by the caller from who is asking, never read from storage: it is the
+	// answer to "may this person reach the LAN", and that answer can change after
+	// the address was saved. See the handler for who gets it and why.
+	AllowPrivate bool
 }
 
 func (c Config) Configured() bool {
@@ -73,13 +79,17 @@ type Client struct {
 }
 
 func New(cfg Config) *Client {
+	dial := safedial.Client
+	if cfg.AllowPrivate {
+		dial = safedial.AllowPrivate
+	}
 	return &Client{
 		cfg: cfg,
 		// Generous: a local model on modest hardware can take a while to produce
 		// its first token, and the alternative is a timeout that only ever fires
 		// for the people running their own.
-		// safedial, not a plain client. `base_url` is typed into a field in the
-		// interface, so it is a user-supplied address — and a server that fetches a
+		// safedial by default. `base_url` is typed into a field in the interface,
+		// so it is a user-supplied address — and a server that fetches a
 		// user-supplied address is a way to ask it to reach things the caller
 		// cannot: the panel next door, a database on the same bridge, the cloud
 		// metadata endpoint. On a homelab that is most of what is worth reaching.
@@ -87,7 +97,13 @@ func New(cfg Config) *Client {
 		// The check is on the resolved address rather than on the URL, because a
 		// name answers whatever its owner says — and can answer differently the
 		// second time, after a parse-time check has passed.
-		http: safedial.Client(120 * time.Second),
+		//
+		// And then the exception, which is the whole reason this provider exists:
+		// a model you run yourself IS on that network. Blocking it made the two
+		// lines above true and the feature useless — the comment about a local
+		// model being slow to its first token was written for a case the dialler
+		// refused to reach. AllowPrivate is granted per request, not per address.
+		http: dial(120 * time.Second),
 	}
 }
 

internal/auth/auth_test.go

@@ -265,6 +265,39 @@ func TestRecoveryCodes(t *testing.T) {
 	}
 }
 
+// TOTPStep returns the step a code matched, and it must be the same step across
+// the tolerance window — that number is what makes a code single-use, so a code
+// entered a little early or late has to spend the same step, not a new one.
+func TestTOTPStepIsStableAcrossTheWindow(t *testing.T) {
+	secret, _, err := NewTOTPSecret("verdande", "[email protected]")
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Date(2026, 3, 10, 10, 0, 15, 0, time.UTC)
+	code := codeAt(t, secret, now)
+
+	want, err := TOTPStep(secret, code, now)
+	if err != nil {
+		t.Fatalf("the current code did not match: %v", err)
+	}
+	// Verified one step late — the code is still valid, and must report the step it
+	// was issued at, not the step it was checked at.
+	got, err := TOTPStep(secret, code, now.Add(30*time.Second))
+	if err != nil {
+		t.Fatalf("code rejected one step late: %v", err)
+	}
+	if got != want {
+		t.Errorf("same code reported step %d then %d; a replay check keyed on that would not catch it", want, got)
+	}
+
+	if _, err := TOTPStep(secret, "000000", now); err == nil {
+		t.Error("a wrong code returned a step")
+	}
+	if _, err := TOTPStep("", code, now); err != ErrNoTOTPSecret {
+		t.Errorf("empty secret: %v, want ErrNoTOTPSecret", err)
+	}
+}
+
 // codeAt produces the code an authenticator app would display at that moment,
 // using the same settings VerifyTOTP checks against.
 func codeAt(t *testing.T, secret string, now time.Time) string {

internal/auth/totp.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"crypto/rand"
+	"crypto/subtle"
 	"encoding/base32"
 	"errors"
 	"fmt"
@@ -82,6 +83,40 @@ func VerifyTOTP(secret, code string, now time.Time) error {
 	return nil
 }
 
+// TOTPStep verifies a code and returns the counter of the step it matched, so the
+// caller can refuse to accept the same step twice.
+//
+// ValidateCustom answers only yes or no, and "yes" for a code inside the skew
+// window is not enough to stop a replay: a code seen in flight stays valid for the
+// rest of its period, and the fix is to record which step was spent and never
+// accept that step or an earlier one again. That needs the number, so this walks
+// the same window ValidateCustom would — one step either side — and reports the
+// counter of the match. The comparison is constant time for the same reason the
+// password check is: a code is a secret being checked against a computed value.
+func TOTPStep(secret, code string, now time.Time) (int64, error) {
+	if secret == "" {
+		return 0, ErrNoTOTPSecret
+	}
+	code = strings.ReplaceAll(strings.TrimSpace(code), " ", "")
+
+	for offset := -int64(totpSkew); offset <= int64(totpSkew); offset++ {
+		at := now.Add(time.Duration(offset) * totpPeriod * time.Second)
+		want, err := totp.GenerateCodeCustom(secret, at, totp.ValidateOpts{
+			Period:    totpPeriod,
+			Skew:      0,
+			Digits:    totpDigits,
+			Algorithm: otp.AlgorithmSHA1,
+		})
+		if err != nil {
+			return 0, ErrInvalidCode
+		}
+		if subtle.ConstantTimeCompare([]byte(want), []byte(code)) == 1 {
+			return at.Unix() / totpPeriod, nil
+		}
+	}
+	return 0, ErrInvalidCode
+}
+
 // NewRecoveryCodes returns single-use codes for someone who has lost their phone,
 // and the hashes to store. Without these, losing a device means losing the account,
 // and the only fix left is editing the database by hand.

internal/config/config.go

@@ -7,6 +7,7 @@ package config
 
 import (
 	"fmt"
+	"net/netip"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -80,6 +81,26 @@ type Config struct {
 	// TrashRetention is how long a soft-deleted task or project stays recoverable.
 	TrashRetention time.Duration
 
+	// TrustedProxies are the peers whose forwarded-for header may be believed.
+	//
+	// The rate limiter and the audit log key on the caller's address, and that
+	// address is only as honest as wherever it was read. Read it from a header that
+	// anybody can set, and an attacker rotates it to get a fresh guess-bucket for
+	// every request and to write someone else's IP into the log. So the header is
+	// believed only when the machine that *connected* is one of these — a reverse
+	// proxy or tunnel the operator put there — and ignored when the connection came
+	// straight off the internet.
+	//
+	// The default is "the peer is on a private network", which is exactly the shape
+	// of a homelab behind Caddy, nginx or a Cloudflare Tunnel: the proxy shares the
+	// host or the docker bridge, so its address is loopback or RFC1918. A directly
+	// exposed instance sees a public peer, trusts nothing, and keys on the real
+	// connection. Override with VERDANDE_TRUSTED_PROXIES (comma-separated CIDRs),
+	// or "none" to trust no proxy at all.
+	TrustedProxies []netip.Prefix
+	// RealIPHeader is where the client address is read from, for a trusted peer.
+	RealIPHeader string
+
 	Dev bool
 }
 
@@ -149,9 +170,70 @@ func Load() (*Config, error) {
 	if c.DataDir, err = filepath.Abs(c.DataDir); err != nil {
 		return nil, fmt.Errorf("VERDANDE_DATA_DIR: %w", err)
 	}
+
+	c.RealIPHeader = env("VERDANDE_REAL_IP_HEADER", "X-Forwarded-For")
+	if c.TrustedProxies, err = parseTrustedProxies(env("VERDANDE_TRUSTED_PROXIES", "")); err != nil {
+		return nil, err
+	}
 	return c, nil
 }
 
+// defaultTrustedProxies is "the peer is not on the public internet": loopback,
+// the three RFC1918 ranges, Tailscale's CGNAT borrow, IPv6 unique-local and both
+// families' link-local. A proxy an operator stands up in front of this server is
+// on one of these; a stranger connecting directly is on none.
+var defaultTrustedProxies = mustPrefixes(
+	"127.0.0.0/8", "::1/128",
+	"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
+	"100.64.0.0/10",
+	"fc00::/7",
+	"169.254.0.0/16", "fe80::/10",
+)
+
+// parseTrustedProxies reads the override. Empty keeps the private-network default;
+// the literal "none" trusts no proxy at all, for an instance that is exposed
+// directly and must never believe a forwarded header.
+func parseTrustedProxies(raw string) ([]netip.Prefix, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return defaultTrustedProxies, nil
+	}
+	if strings.EqualFold(raw, "none") {
+		return nil, nil
+	}
+	var out []netip.Prefix
+	for _, part := range strings.Split(raw, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		// A bare address is a host route: 10.0.0.5 means 10.0.0.5/32, so an operator
+		// naming one proxy does not have to know CIDR notation to do it.
+		if !strings.Contains(part, "/") {
+			addr, err := netip.ParseAddr(part)
+			if err != nil {
+				return nil, fmt.Errorf("VERDANDE_TRUSTED_PROXIES: %q is not an address or CIDR", part)
+			}
+			out = append(out, netip.PrefixFrom(addr, addr.BitLen()))
+			continue
+		}
+		p, err := netip.ParsePrefix(part)
+		if err != nil {
+			return nil, fmt.Errorf("VERDANDE_TRUSTED_PROXIES: %q is not a CIDR", part)
+		}
+		out = append(out, p.Masked())
+	}
+	return out, nil
+}
+
+func mustPrefixes(cidrs ...string) []netip.Prefix {
+	out := make([]netip.Prefix, 0, len(cidrs))
+	for _, c := range cidrs {
+		out = append(out, netip.MustParsePrefix(c))
+	}
+	return out
+}
+
 // DBPath, FilesDir and BackupsDir are the three things that live on the /data volume.
 func (c *Config) DBPath() string     { return filepath.Join(c.DataDir, "verdande.db") }
 func (c *Config) FilesDir() string   { return filepath.Join(c.DataDir, "files") }

internal/httpapi/auth_handlers.go

@@ -218,7 +218,24 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err := auth.VerifyTOTP(user.TOTPSecret, req.Code, time.Now())
+	step, err := auth.TOTPStep(user.TOTPSecret, req.Code, time.Now())
+	if err == nil {
+		// The code is right; now it must also be unused. A TOTP code stays valid for
+		// its whole window, so one observed in flight — a phishing page, a proxy,
+		// over the shoulder — could otherwise be replayed until it expires. Spending
+		// the step here makes it single-use: a second presentation of the same code,
+		// or an earlier one, finds the step already gone.
+		fresh, cerr := s.db.ConsumeTOTPStep(r.Context(), user.ID, step)
+		if cerr != nil {
+			s.internal(w, r, "consume totp step", cerr)
+			return
+		}
+		if !fresh {
+			writeError(w, http.StatusUnauthorized, CodeUnauthorized,
+				"that verification code has already been used")
+			return
+		}
+	}
 	if err != nil {
 		// A recovery code is accepted in the same field. Making somebody find a
 		// different form while locked out of their account is a poor time to

internal/httpapi/auth_test.go

@@ -372,6 +372,50 @@ func TestTOTPEnrolmentAndTwoStepLogin(t *testing.T) {
 	}
 }
 
+// A TOTP code works once. A code seen in flight and replayed inside its window
+// must be refused the second time, or the second factor is only as good as the
+// thirty seconds an attacker has to reuse what they captured.
+func TestTOTPCodeIsSingleUse(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("totp setup: %d %v", resp.StatusCode, body)
+	}
+	secret, _ := body["secret"].(string)
+	resp, body = ts.do(t, "POST", "/api/v1/auth/totp/confirm", map[string]string{
+		"code": codeFor(t, secret),
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("totp confirm: %d %v", resp.StatusCode, body)
+	}
+
+	// One code, captured once and presented twice.
+	code := codeFor(t, secret)
+
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+	ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+		"email": "[email protected]", "password": "et langt kodeord",
+	})
+	resp, body = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": code})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("first use of the code failed: %d %v", resp.StatusCode, body)
+	}
+
+	// A second login, same code, same window.
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+	ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+		"email": "[email protected]", "password": "et langt kodeord",
+	})
+	resp, body = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": code})
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("the same code was accepted twice: %d %v", resp.StatusCode, body)
+	}
+}
+
 // A recovery code is accepted in the same field as a TOTP code, and works once.
 func TestRecoveryCodeCompletesLoginOnce(t *testing.T) {
 	ts := newTestServer(t)

internal/httpapi/csp_header_test.go

@@ -3,6 +3,8 @@ package httpapi
 import (
 	"strings"
 	"testing"
+
+	"github.com/kristianwind/verdande/internal/config"
 )
 
 // Politikken skal stå i svaret, og den skal stadig være stram.
@@ -50,6 +52,39 @@ func TestEveryResponseCarriesAStrictCSP(t *testing.T) {
 	}
 }
 
+// HSTS følger med, når instansen kører over HTTPS — og kun der.
+//
+// Sessionen bor i en __Host-cookie, der kun findes over TLS, så hele modellen
+// forudsætter allerede HTTPS. HSTS er det, der holder den forudsætning mod en
+// netværksangriber; men bedt om over ren HTTP ville den bede en browser om at
+// kræve et certifikat, en dev-instans ikke har. Begge halvdele skal stå prøven.
+func TestHSTSTracksHTTPS(t *testing.T) {
+	overHTTP := newTestServer(t) // BaseURL er http://localhost
+	resp, _ := overHTTP.do(t, "GET", "/api/v1/ping", nil)
+	if got := resp.Header.Get("Strict-Transport-Security"); got != "" {
+		t.Errorf("HSTS sat over ren HTTP: %q", got)
+	}
+
+	overHTTPS := newTestServerWith(t, func(c *config.Config) {
+		c.BaseURL = "https://todo.example.dk"
+	})
+	resp, _ = overHTTPS.do(t, "GET", "/api/v1/ping", nil)
+	if got := resp.Header.Get("Strict-Transport-Security"); got == "" {
+		t.Error("ingen HSTS over HTTPS")
+	} else if !strings.Contains(got, "includeSubDomains") {
+		t.Errorf("HSTS uden includeSubDomains: %q", got)
+	}
+	// Permissions-Policy står på hvert svar, uanset skema: den lukker for kamera,
+	// mikrofon og placering, som appen aldrig beder om.
+	if got := resp.Header.Get("Permissions-Policy"); !strings.Contains(got, "camera=()") {
+		t.Errorf("Permissions-Policy lukker ikke for kameraet: %q", got)
+	}
+	// COOP isolerer browserkonteksten og står på hvert svar.
+	if got := resp.Header.Get("Cross-Origin-Opener-Policy"); got != "same-origin" {
+		t.Errorf("Cross-Origin-Opener-Policy er ikke same-origin: %q", got)
+	}
+}
+
 // Et bilag må ikke kunne blive læst som et dokument.
 func TestAttachmentsAreNotServedAsDocuments(t *testing.T) {
 	for _, mime := range []string{"image/svg+xml", "text/html", "application/xhtml+xml", "text/xml"} {

internal/httpapi/gmail_handlers.go

@@ -360,8 +360,19 @@ func (s *Server) SyncGmail(ctx context.Context, user *store.User) (int, error) {
 			Description: msg.Snippet + "\n\n" + msg.Link,
 			Priority:    4,
 			CreatedBy:   user.ID,
+			// The thread, not the message: a reply arriving later is the same
+			// conversation, and a second task for it would be the duplicate this
+			// key exists to prevent.
+			SourceKey: "gmail:thread:" + msg.ThreadID,
 		}
 		if err := s.db.CreateTask(ctx, task, nil); err != nil {
+			if errors.Is(err, store.ErrDuplicate) {
+				// Somebody got there first — an earlier sweep, or another
+				// assistant reading the same mailbox. Mark it seen and move on;
+				// it is handled, which is all this loop wanted.
+				seen[id] = true
+				continue
+			}
 			s.log.Warn("gmail create task", "err", err)
 			continue
 		}

internal/httpapi/integrations_handlers.go

@@ -215,20 +215,31 @@ func (s *Server) handleSetAISettings(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// The address is checked where it is typed, as well as when it is dialled.
+	// The address is checked where it is typed, as well as when it is dialled. A
+	// scheme other than http or https is refused outright, for everybody —
+	// file:// and gopher:// are not providers.
 	//
-	// safedial refuses a private destination at connect time and is the actual
-	// wall; this is so the person entering it hears about it now rather than
-	// discovering it later as a failed summary. A scheme other than http or https
-	// is refused outright — file:// and gopher:// are not providers.
+	// The private-network wall has one exception, and it is the point of the
+	// provider it guards. "OpenAI-compatible (Ollama, LM Studio, …)" means a model
+	// on this machine or on the desk beside it: 127.0.0.1:11434, 192.168.1.150.
+	// safedial refuses exactly those, so the address the field suggested in its
+	// own placeholder was an address the server would not accept.
+	//
+	// Admins only, because the wall is there for a real reason: a server that
+	// fetches a user-supplied address lets the person supplying it reach what
+	// they cannot reach themselves. An admin on a self-hosted instance already
+	// owns the host and everything on its network, so this grants them nothing
+	// new. An invited user is a different person, and for them it stays shut.
 	if url := strings.TrimSpace(req.BaseURL); url != "" {
 		if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
 			writeFieldErrors(w, map[string]string{"base_url": "must start with http:// or https://"})
 			return
 		}
-		if reason := safedial.CheckURL(url); reason != "" {
-			writeFieldErrors(w, map[string]string{"base_url": reason})
-			return
+		if !user.IsAdmin {
+			if reason := safedial.CheckURL(url); reason != "" {
+				writeFieldErrors(w, map[string]string{"base_url": reason})
+				return
+			}
 		}
 		req.BaseURL = url
 	}
@@ -265,11 +276,20 @@ func (s *Server) aiConfig(r *http.Request, userID string) (ai.Config, error) {
 		v, _ := values[key].(string)
 		return v
 	}
+	// Worked out per request rather than stored beside the address: it answers
+	// "may this person reach the private network", and somebody who is no longer
+	// an admin should stop being able to. A flag written at save time would
+	// outlive the role that granted it.
+	allowPrivate := false
+	if u := userFrom(r.Context()); u != nil && u.IsAdmin {
+		allowPrivate = true
+	}
 	return ai.Config{
-		Provider: ai.Provider(str("provider")),
-		APIKey:   str("api_key"),
-		BaseURL:  str("base_url"),
-		Model:    str("model"),
+		Provider:     ai.Provider(str("provider")),
+		APIKey:       str("api_key"),
+		BaseURL:      str("base_url"),
+		Model:        str("model"),
+		AllowPrivate: allowPrivate,
 	}, nil
 }
 

internal/httpapi/integrations_test.go

@@ -719,6 +719,86 @@ func TestTheAIProviderSurvivesConnectingSomethingElse(t *testing.T) {
 	}
 }
 
+// Reported from use as "the AI settings are not saved" — the second time, and a
+// different cause than the one above.
+//
+// The provider is called "OpenAI-kompatibel (Ollama, LM Studio, …)" and the
+// address field suggests http://localhost:11434/v1. Both of those live on the
+// private network, which safedial refuses — so the address the interface proposed
+// was the address the server rejected, and the one provider that exists for
+// running your own model could not be configured at all.
+//
+// It looked like a save that did nothing, because the 422 came back on a field
+// with nowhere to show it. Two bugs wearing one coat.
+func TestAdminMayPointAIAtAModelOnTheLAN(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	// The three shapes a self-hosted model actually takes: another machine on the
+	// LAN, the loopback name, and the loopback address.
+	for _, addr := range []string{
+		"http://192.168.1.150:8080/v1",
+		"http://localhost:11434/v1",
+		"http://127.0.0.1:1234/v1",
+	} {
+		resp, body := ts.do(t, "PUT", "/api/v1/ai/settings", map[string]any{
+			"provider": "compatible", "model": "gemma-4-26b-qat", "base_url": addr,
+		})
+		if resp.StatusCode != http.StatusNoContent {
+			t.Fatalf("save %s: status %d, body %v", addr, resp.StatusCode, body)
+		}
+	}
+
+	_, body := ts.do(t, "GET", "/api/v1/ai/settings", nil)
+	if body["base_url"] != "http://127.0.0.1:1234/v1" {
+		t.Errorf("base_url = %v after saving, want it to have survived", body["base_url"])
+	}
+	if body["provider"] != "compatible" {
+		t.Errorf("provider = %v", body["provider"])
+	}
+}
+
+// The wall stays up for everybody else.
+//
+// An admin on a self-hosted instance already owns the host and its network, so a
+// private destination grants them nothing they did not have. An invited user is a
+// different person, and for them the address field would be a way to find out
+// what answers on the host's network.
+func TestAnInvitedUserCannotPointAIAtThePrivateNetwork(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "[email protected]", "Andreas")
+
+	resp, body := other.do(t, "PUT", "/api/v1/ai/settings", map[string]any{
+		"provider": "compatible", "model": "llama3.1",
+		"base_url": "http://192.168.1.150:8080/v1",
+	})
+	if resp.StatusCode == http.StatusNoContent {
+		t.Fatal("an invited user was allowed to point the AI at the private network")
+	}
+	fields, _ := body["fields"].(map[string]any)
+	if fields["base_url"] == nil {
+		t.Errorf("the refusal did not name the field it was about: %v", body)
+	}
+}
+
+// A scheme that is not http or https is refused for everybody, admin or not.
+func TestAISettingsRefuseANonHTTPAddress(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "PUT", "/api/v1/ai/settings", map[string]any{
+		"provider": "compatible", "model": "llama3.1", "base_url": "file:///etc/passwd",
+	})
+	if resp.StatusCode == http.StatusNoContent {
+		t.Fatal("file:// was accepted as a provider address")
+	}
+	fields, _ := body["fields"].(map[string]any)
+	if fields["base_url"] == nil {
+		t.Errorf("no error on base_url: %v", body)
+	}
+}
+
 func TestGmailSettings(t *testing.T) {
 	ts := newTestServer(t)
 	ts.bootstrap(t)

internal/httpapi/mailbox_handlers.go

@@ -202,8 +202,20 @@ func (s *Server) SyncMailbox(ctx context.Context, user *store.User, m *store.Mai
 			Description: msg.Snippet,
 			Priority:    4,
 			CreatedBy:   user.ID,
+			// Host and uid together: a uid is only unique within one mailbox on
+			// one server, and two accounts will hand out the same small numbers.
+			SourceKey: fmt.Sprintf("imap:%s:%s:%d", m.Host, m.Folder, msg.UID),
 		}
 		if err := s.db.CreateTask(ctx, task, nil); err != nil {
+			if errors.Is(err, store.ErrDuplicate) {
+				// Already a task. Still count it as read, or last_uid never moves
+				// past it and every sweep from here on stops at the same message.
+				done = append(done, msg.UID)
+				if msg.UID > highest {
+					highest = msg.UID
+				}
+				continue
+			}
 			s.log.Warn("mailbox create task", "err", err, "mailbox", m.ID)
 			continue
 		}

internal/httpapi/realip.go

@@ -0,0 +1,88 @@
+package httpapi
+
+import (
+	"net"
+	"net/http"
+	"net/netip"
+	"strings"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// realIP rewrites r.RemoteAddr to the client address a trusted proxy reported,
+// and does nothing at all when the peer is not trusted.
+//
+// This replaces chi's middleware.RealIP, which is deprecated precisely because it
+// believes a forwarded header from anyone: an attacker sets X-Forwarded-For to a
+// new value on every request and gets a fresh rate-limit bucket each time, and
+// writes whatever address they like into the audit log. The one control that
+// exists for when a password is already gone is keyed on this address, so it has
+// to be an address the caller cannot choose.
+//
+// The gate is the peer. A header is read only when the machine that opened the
+// connection is one of cfg.TrustedProxies — a reverse proxy or tunnel the operator
+// put there. A connection straight off the internet is trusted for nothing, so its
+// header is ignored and it is keyed on the address it actually came from. Behind a
+// proxy that overwrites the client's own header (nginx, Caddy and cloudflared all
+// do) the value is then the real client and cannot be forged from outside.
+func realIP(cfg *config.Config) func(http.Handler) http.Handler {
+	trusted := cfg.TrustedProxies
+	header := cfg.RealIPHeader
+	if header == "" {
+		header = "X-Forwarded-For"
+	}
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if ip := trustedClientIP(r, trusted, header); ip != "" {
+				// Port preserved off the original peer only for shape; downstream
+				// clientIP() splits it away, and the forwarded value carries none.
+				r.RemoteAddr = ip
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// trustedClientIP returns the forwarded client address if the peer may be believed,
+// or "" to leave RemoteAddr untouched.
+func trustedClientIP(r *http.Request, trusted []netip.Prefix, header string) string {
+	peer := r.RemoteAddr
+	if host, _, err := net.SplitHostPort(peer); err == nil {
+		peer = host
+	}
+	peerAddr, err := netip.ParseAddr(peer)
+	if err != nil || !isTrusted(peerAddr, trusted) {
+		return ""
+	}
+
+	raw := r.Header.Get(header)
+	if raw == "" {
+		return ""
+	}
+	// The leftmost entry is the original client. That entry is only as trustworthy
+	// as the proxy that wrote it — but the trusted proxy is exactly the one that
+	// replaces a client-supplied header, so on the deployments this is written for
+	// it is the real client, and on a direct connection we never reach this line.
+	first := raw
+	if i := strings.IndexByte(raw, ','); i >= 0 {
+		first = raw[:i]
+	}
+	first = strings.TrimSpace(first)
+	if _, err := netip.ParseAddr(first); err != nil {
+		return ""
+	}
+	return first
+}
+
+func isTrusted(addr netip.Addr, trusted []netip.Prefix) bool {
+	if !addr.IsValid() {
+		return false
+	}
+	addr = addr.Unmap()
+	for _, p := range trusted {
+		if p.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}

internal/httpapi/realip_test.go

@@ -0,0 +1,94 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// The address the rate limiter keys on must be one the caller cannot choose. A
+// forwarded header is believed only from a trusted proxy, and ignored from a
+// stranger connecting directly — the difference between a control and a suggestion.
+func TestRealIPTrustsOnlyTheProxy(t *testing.T) {
+	cfg, err := config.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	seen := ""
+	h := realIP(cfg)(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+		seen = clientIP(r)
+	}))
+
+	cases := []struct {
+		name       string
+		remoteAddr string
+		xff        string
+		want       string
+	}{
+		{
+			// A private peer is a proxy the operator put there: believe it.
+			name:       "trusted proxy is believed",
+			remoteAddr: "10.1.2.3:5000",
+			xff:        "203.0.113.9",
+			want:       "203.0.113.9",
+		},
+		{
+			// A public peer connected straight to us; its header is a guess.
+			name:       "public peer header ignored",
+			remoteAddr: "198.51.100.7:5000",
+			xff:        "203.0.113.9",
+			want:       "198.51.100.7",
+		},
+		{
+			// No header from a trusted proxy leaves the peer as the answer.
+			name:       "trusted peer without header",
+			remoteAddr: "127.0.0.1:5000",
+			xff:        "",
+			want:       "127.0.0.1",
+		},
+		{
+			// A spoofed value from a stranger cannot become the key.
+			name:       "spoof from outside does not win",
+			remoteAddr: "198.51.100.7:5000",
+			xff:        "127.0.0.1",
+			want:       "198.51.100.7",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest("POST", "/api/v1/auth/login", nil)
+			r.RemoteAddr = tc.remoteAddr
+			if tc.xff != "" {
+				r.Header.Set("X-Forwarded-For", tc.xff)
+			}
+			h.ServeHTTP(httptest.NewRecorder(), r)
+			if seen != tc.want {
+				t.Errorf("keyed on %q, want %q", seen, tc.want)
+			}
+		})
+	}
+}
+
+// "none" turns the trust off entirely, for an instance exposed directly.
+func TestRealIPTrustNone(t *testing.T) {
+	t.Setenv("VERDANDE_TRUSTED_PROXIES", "none")
+	cfg, err := config.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := ""
+	h := realIP(cfg)(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+		seen = clientIP(r)
+	}))
+	r := httptest.NewRequest("POST", "/", nil)
+	r.RemoteAddr = "10.1.2.3:5000" // even a private peer is not trusted now
+	r.Header.Set("X-Forwarded-For", "203.0.113.9")
+	h.ServeHTTP(httptest.NewRecorder(), r)
+	if seen != "10.1.2.3" {
+		t.Errorf("keyed on %q, want the peer 10.1.2.3", seen)
+	}
+}

internal/httpapi/server.go

@@ -110,7 +110,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 
 	r := chi.NewRouter()
 	r.Use(middleware.RequestID)
-	r.Use(middleware.RealIP)
+	// Not middleware.RealIP: that believes a forwarded header from anyone, which
+	// lets a caller pick the address the rate limiter and audit log key on. This
+	// one reads the header only from a trusted proxy — see realip.go.
+	r.Use(realIP(cfg))
 	r.Use(requestLogger(log))
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.Timeout(30 * time.Second))
@@ -665,6 +668,31 @@ func (s *Server) securityHeaders(next http.Handler) http.Handler {
 		h.Set("X-Frame-Options", "DENY")
 		h.Set("Referrer-Policy", "same-origin")
 		h.Set("Content-Security-Policy", s.csp)
+		// The session lives in a __Host- cookie that only exists over HTTPS, so the
+		// whole security model already assumes TLS. HSTS is what makes that
+		// assumption hold against a network attacker: without it, the very first
+		// navigation can be stripped to http:// and the cookie handed over in the
+		// clear. Gated on the same condition as the cookie's Secure flag, so a
+		// plain-HTTP dev instance is never told to demand a certificate it cannot
+		// present. Two years, subdomains included; no preload directive, because
+		// asking to be hard-coded into browsers is a decision the operator makes
+		// for their domain, not one a self-hosted app makes for them.
+		if s.secureCookies() {
+			h.Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
+		}
+		// verdande uses none of the powerful browser features, so the safest policy
+		// is to turn them all off: an injected element cannot ask for the camera,
+		// the microphone or the location if the page itself has already declined
+		// them. Named explicitly rather than with a wildcard because the wildcard
+		// form of this header is not universally understood, and a directive a
+		// browser ignores is not a control.
+		h.Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), "+
+			"payment=(), usb=(), interest-cohort=()")
+		// Isolate the browsing context: a window this page opened, or one that
+		// opened it, cannot keep a handle across the origin boundary. verdande
+		// never scripts another window, so there is nothing to lose and a whole
+		// class of cross-window attacks to close.
+		h.Set("Cross-Origin-Opener-Policy", "same-origin")
 		next.ServeHTTP(w, r)
 	})
 }

internal/safedial/safedial.go

@@ -24,17 +24,58 @@
 // lives), the private ranges, unique-local IPv6, and the unspecified address.
 // Everything else is allowed: this is not an allowlist of the internet, it is a
 // wall around the inside.
+//
+// With one named exception, for Tailscale — see tailnets below.
 package safedial
 
 import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/netip"
 	"net/url"
 	"syscall"
 	"time"
 )
 
+// tailnets are Tailscale's own ranges, and they are not "the inside".
+//
+// A tailnet is not a network you happen to be on; it is one every member had to
+// authenticate to join. A verdande whose host is on one reaches its peers on
+// purpose, and the operator who joined it meant to.
+//
+// Half of this already worked, by luck rather than intent: Go's IsPrivate covers
+// RFC1918 and not the carrier-grade NAT range Tailscale borrows, so 100.x
+// addresses passed the wall without anybody deciding they should. The IPv6 half
+// did not — fd7a:115c:a1e0::/48 sits inside fc00::/7 and was refused. The same
+// machine was reachable or not depending on which family its address had, which
+// is the kind of difference nobody debugs on purpose.
+//
+// Naming both makes the allowance deliberate, and writes down its cost: on an
+// instance with people you have invited, this is a network they can now ask the
+// server to reach. That is the trade, and it is the operator's to make.
+var tailnets = []netip.Prefix{
+	netip.MustParsePrefix("100.64.0.0/10"),
+	netip.MustParsePrefix("fd7a:115c:a1e0::/48"),
+}
+
+// IsTailscale reports whether an address belongs to a tailnet.
+func IsTailscale(ip net.IP) bool {
+	addr, ok := netip.AddrFromSlice(ip)
+	if !ok {
+		return false
+	}
+	// Unmap first: ParseIP gives a v4 address as 4-in-6, and a v4 prefix does not
+	// contain a v6-shaped address however equal the two look when printed.
+	addr = addr.Unmap()
+	for _, n := range tailnets {
+		if n.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}
+
 // ErrPrivate is returned when a connection was refused for where it pointed. It
 // deliberately does not say which address it resolved to: the answer is itself
 // the thing an attacker is fishing for.
@@ -46,8 +87,15 @@ func (e *ErrPrivate) Error() string {
 
 // Blocked reports whether an address must not be dialled.
 func Blocked(ip net.IP) bool {
-	return ip == nil ||
-		ip.IsLoopback() ||
+	if ip == nil {
+		return true
+	}
+	// Before the private check, not after: a tailnet's IPv6 range is unique-local,
+	// so asking IsPrivate first would refuse it.
+	if IsTailscale(ip) {
+		return false
+	}
+	return ip.IsLoopback() ||
 		ip.IsUnspecified() ||
 		ip.IsLinkLocalUnicast() ||
 		ip.IsLinkLocalMulticast() ||

internal/safedial/safedial_test.go

@@ -53,3 +53,47 @@ func TestAllowPrivateStillReaches(t *testing.T) {
 	}
 	resp.Body.Close()
 }
+
+// Tailscale skal virke, og på begge familier.
+//
+// IPv4-halvdelen slap allerede igennem, men ved et tilfælde: Gos IsPrivate
+// dækker RFC1918 og ikke det CGNAT-område, Tailscale låner. IPv6-halvdelen gjorde
+// ikke — fd7a:115c:a1e0::/48 ligger inde i fc00::/7. Samme maskine var altså
+// tilgængelig eller ej alt efter, hvilken adressefamilie man ramte den på.
+//
+// Testen står her for at holde begge dele fast: at 100.x er tilladt med vilje og
+// ikke af held, og at fd7a: ikke ryger tilbage bag muren, næste gang nogen rydder
+// op i prædikatet.
+func TestTailnetIsNotTheInside(t *testing.T) {
+	for _, s := range []string{
+		"100.64.0.0", "100.100.100.100", "100.127.255.255",
+		"fd7a:115c:a1e0::1", "fd7a:115c:a1e0:ab12:3456:7890:abcd:ef01",
+	} {
+		if Blocked(net.ParseIP(s)) {
+			t.Errorf("Blocked(%s) = true, men det er en tailnet-adresse", s)
+		}
+		if !IsTailscale(net.ParseIP(s)) {
+			t.Errorf("IsTailscale(%s) = false", s)
+		}
+	}
+
+	// Undtagelsen skal være så smal, som den er navngivet. Naboerne til området
+	// er ikke Tailscale, og en anden unique-local-adresse er stadig indenfor.
+	for _, s := range []string{
+		"100.63.255.255", // lige under 100.64.0.0/10
+		"100.128.0.0",    // lige over
+		"fd00::1",        // unique-local, men ikke Tailscales
+		"fd7b:115c:a1e0::1",
+		"192.168.1.150",
+	} {
+		if IsTailscale(net.ParseIP(s)) {
+			t.Errorf("IsTailscale(%s) = true, men den ligger uden for området", s)
+		}
+	}
+	// Og de af dem, der er indenfor, skal stadig være det.
+	for _, s := range []string{"fd00::1", "fd7b:115c:a1e0::1", "192.168.1.150"} {
+		if !Blocked(net.ParseIP(s)) {
+			t.Errorf("Blocked(%s) = false — muren er væk for mere end Tailscale", s)
+		}
+	}
+}

internal/store/migrations/0028_kvasir.sql

@@ -0,0 +1,79 @@
+-- Kvasir: what an assistant did, and what it acted on.
+--
+-- Two things, and they are separate on purpose: one is about the outside world,
+-- and would be worth having even if Kvasir never existed.
+
+-- 1. Where a task came from, out there.
+--
+-- Nothing today can answer "has this mail already become a task?". A second
+-- reader of the same mailbox — another assistant, a rerun of the same sweep,
+-- a person — makes a second task, and the only sign is the duplicate itself.
+-- That has happened in practice, twice in one run.
+--
+-- Namespaced rather than a bare id: `gmail:thread:18f2c…`, `imap:<host>:<uid>`,
+-- `ics:<uid>`. A Gmail thread id and an IMAP uid look nothing alike until the
+-- day they collide, and a namespace costs one colon. It also means the next
+-- source needs no column — which is the point of a key rather than a foreign
+-- key. There is no messages table to point at, and this has to work without one.
+ALTER TABLE tasks ADD COLUMN source_key TEXT NOT NULL DEFAULT '';
+
+-- The index is the interlock, not an optimisation. Two agents reading the same
+-- inbox must be unable to make two tasks, and "must be unable" is a constraint
+-- rather than a convention somebody remembers to follow.
+--
+-- Scoped to the author: two people on one instance connect their own mailboxes,
+-- and the same thread reaching both of them is two tasks, correctly. Partial
+-- because `created_by` is ON DELETE SET NULL — a task outlives its author, and
+-- rows that have lost theirs must not start colliding with each other.
+CREATE UNIQUE INDEX tasks_once_per_source
+    ON tasks (created_by, source_key)
+    WHERE source_key <> '' AND created_by IS NOT NULL;
+
+-- 2. Kvasir's ledger.
+--
+-- The dial that lets an assistant act on its own is only bearable because of
+-- this table. Two questions have to be answerable at any moment: what did it do
+-- today, and how do I undo it. Neither is answerable from the tasks themselves.
+--
+-- A suggestion and a completed action are the SAME ROW in different states. That
+-- is the whole design: "suggest" and "act" are not two code paths, they are one
+-- path that writes a different `state`. Accepting a suggestion moves it to done;
+-- undoing an action moves it to undone. Nothing has to be written twice, and the
+-- feed reads the same either way.
+--
+-- `before_json` is the undo. Not a diff and not a description — the fields as
+-- they were, so putting them back needs no reasoning about what changed. It is
+-- also the honest record: a task edited by hand afterwards will not match, and
+-- an undo that would overwrite newer work should say so rather than win.
+CREATE TABLE kvasir_actions (
+    id          TEXT PRIMARY KEY,
+    user_id     TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+
+    -- 'file', 'rewrite', 'split', 'nudge', 'prioritise'. Free text rather than a
+    -- CHECK: a new capability must not need a migration to be recorded, and an
+    -- unknown kind in the feed is a row nobody rendered, not a broken database.
+    kind        TEXT NOT NULL,
+    task_id     TEXT REFERENCES tasks (id) ON DELETE CASCADE,
+
+    -- One sentence, written when the action was decided. Stored rather than
+    -- rebuilt: it says what Kvasir believed at the time, and the project it
+    -- names may since have been renamed or deleted.
+    summary     TEXT NOT NULL,
+    -- Why it thought so. Shown on request, because a suggestion you cannot
+    -- interrogate is one you either trust blindly or ignore entirely.
+    reason      TEXT NOT NULL DEFAULT '',
+
+    before_json TEXT NOT NULL DEFAULT '{}',
+    after_json  TEXT NOT NULL DEFAULT '{}',
+
+    -- suggested → done | dismissed, and done → undone.
+    state       TEXT NOT NULL CHECK (state IN ('suggested', 'done', 'dismissed', 'undone')),
+
+    created_at  INTEGER NOT NULL,
+    decided_at  INTEGER NOT NULL DEFAULT 0
+);
+
+-- The feed asks "what is waiting for me, newest first", and the corrections
+-- Kvasir learns from ask "what did I get wrong lately" — both read by user and
+-- order by time.
+CREATE INDEX kvasir_actions_by_user ON kvasir_actions (user_id, created_at DESC);

internal/store/migrations/0029_totp_single_use.sql

@@ -0,0 +1,11 @@
+-- A TOTP code is meant to be usable once. RFC 6238 says so in as many words: the
+-- verifier must reject a code that has already been accepted, or a code observed in
+-- flight — over the shoulder, off a phishing page, out of a proxy — can be replayed
+-- for the rest of its thirty-second window.
+--
+-- totp_last_step records the counter of the most recently accepted code (Unix time
+-- divided by the period). A login accepts a code only when its step is strictly
+-- greater, so the same code cannot be spent twice and time cannot run backwards.
+-- Null means no code has been accepted yet, which is every account until its owner
+-- next signs in with one.
+ALTER TABLE users ADD COLUMN totp_last_step INTEGER;

internal/store/source_test.go

@@ -0,0 +1,109 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+// One mail, one task — however many readers there are.
+//
+// Nothing could answer "has this already become a task?" before, so a second
+// reader of the same mailbox made a second task. That is not hypothetical: a
+// briefing run produced "Betal faktura fra Browns" twice in one pass, and a
+// separate assistant reading the same inbox does the same thing every sweep.
+func TestOneMailBecomesOneTask(t *testing.T) {
+	db := openTest(t)
+	ctx := context.Background()
+
+	user := &User{Email: "[email protected]", Name: "Kristian", PasswordHash: "x"}
+	if err := db.CreateUser(ctx, user, "Indbakke"); err != nil {
+		t.Fatal(err)
+	}
+	inbox := newProject(t, db, user.ID)
+
+	const thread = "gmail:thread:18f2cabc"
+	first := &Task{ProjectID: inbox, Content: "Svar Mette", CreatedBy: user.ID, SourceKey: thread}
+	if err := db.CreateTask(ctx, first, nil); err != nil {
+		t.Fatalf("first task: %v", err)
+	}
+
+	// The same thread again — a rerun, or somebody else's assistant.
+	second := &Task{ProjectID: inbox, Content: "Svar Mette", CreatedBy: user.ID, SourceKey: thread}
+	err := db.CreateTask(ctx, second, nil)
+	if !errors.Is(err, ErrDuplicate) {
+		t.Fatalf("second task for the same thread: err = %v, want ErrDuplicate", err)
+	}
+
+	// And the question that makes the other agent safe.
+	id, err := db.TaskIDBySource(ctx, user.ID, thread)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if id != first.ID {
+		t.Errorf("TaskIDBySource = %q, want %q", id, first.ID)
+	}
+	if id, err := db.TaskIDBySource(ctx, user.ID, "gmail:thread:aldrig-set"); err != nil || id != "" {
+		t.Errorf("an unseen thread answered %q, %v", id, err)
+	}
+}
+
+// A task somebody typed has no source, and there can be any number of those.
+// The index is partial for exactly this reason — without the WHERE clause the
+// second hand-written task in the database would be refused.
+func TestTasksWithoutASourceDoNotCollide(t *testing.T) {
+	db := openTest(t)
+	ctx := context.Background()
+
+	user := &User{Email: "[email protected]", Name: "Kristian", PasswordHash: "x"}
+	if err := db.CreateUser(ctx, user, "Indbakke"); err != nil {
+		t.Fatal(err)
+	}
+	inbox := newProject(t, db, user.ID)
+
+	for i, name := range []string{"køb kaffe", "ring til Andreas", "hent pakken"} {
+		if err := db.CreateTask(ctx, &Task{ProjectID: inbox, Content: name, CreatedBy: user.ID}, nil); err != nil {
+			t.Fatalf("task %d (%s): %v", i, name, err)
+		}
+	}
+	if id, err := db.TaskIDBySource(ctx, user.ID, ""); err != nil || id != "" {
+		t.Errorf("an empty source key answered %q, %v", id, err)
+	}
+}
+
+// Two people on one instance, each with their own mailbox. The same thread id
+// reaching both of them is two tasks, correctly — the key is scoped to whoever
+// the mail arrived for.
+func TestTheSameThreadForTwoPeopleIsTwoTasks(t *testing.T) {
+	db := openTest(t)
+	ctx := context.Background()
+
+	var ids []string
+	for _, email := range []string{"[email protected]", "[email protected]"} {
+		u := &User{Email: email, Name: email, PasswordHash: "x"}
+		if err := db.CreateUser(ctx, u, "Indbakke"); err != nil {
+			t.Fatal(err)
+		}
+		inbox := newProject(t, db, u.ID)
+		task := &Task{ProjectID: inbox, Content: "Fælles tråd", CreatedBy: u.ID,
+			SourceKey: "gmail:thread:delt"}
+		if err := db.CreateTask(ctx, task, nil); err != nil {
+			t.Fatalf("%s: %v", email, err)
+		}
+		ids = append(ids, task.ID)
+	}
+	if ids[0] == ids[1] {
+		t.Error("the two people got the same task")
+	}
+}
+
+// A project to hang the tasks on. The tests are about the source key, not about
+// where a task lives.
+func newProject(t *testing.T, db *DB, ownerID string) string {
+	t.Helper()
+	p := &Project{OwnerID: ownerID, Name: "Indbakke"}
+	if err := db.CreateProject(context.Background(), p); err != nil {
+		t.Fatalf("create project: %v", err)
+	}
+	return p.ID
+}

internal/store/tasks.go

@@ -32,6 +32,13 @@ type Task struct {
 	// CreatedBy is empty when the author's account has been deleted: `created_by`
 	// is ON DELETE SET NULL so the task survives the person who wrote it.
 	CreatedBy string
+	// SourceKey names the thing out there this task was made from, namespaced:
+	// `gmail:thread:18f2c…`. Empty for a task somebody typed.
+	//
+	// It exists so that the second reader of a mailbox — another assistant, a
+	// rerun, a person — can ask "has this already become a task?" and get an
+	// answer. CreateTask returns ErrDuplicate rather than making a second one.
+	SourceKey string
 	SortOrder float64
 	// SubtaskCount and SubtaskDone are what a row can say without being opened:
 	// that there is something underneath it, and how much of it is left. Counted
@@ -452,21 +459,48 @@ func (db *DB) CreateTask(ctx context.Context, t *Task, labelNames []string) erro
 		_, err := tx.ExecContext(ctx, `
 			INSERT INTO tasks (id, project_id, section_id, parent_id, content, description,
 			                   priority, due_date, due_datetime, due_timezone, duration_min,
-			                   recurrence_rule, assignee_id, created_by, sort_order,
+			                   recurrence_rule, assignee_id, created_by, source_key, sort_order,
 			                   created_at, updated_at)
-			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 			t.ID, t.ProjectID, nullString(t.SectionID), nullString(t.ParentID),
 			t.Content, t.Description, t.Priority, nullString(t.DueDate),
 			nullTime(t.DueDatetime), nullString(t.DueTimezone), nullInt(t.DurationMin),
 			nullString(t.RecurrenceRule), nullString(t.AssigneeID), nullString(t.CreatedBy),
-			t.SortOrder, now.Unix(), now.Unix())
+			t.SourceKey, t.SortOrder, now.Unix(), now.Unix())
 		if err != nil {
+			// The one broken constraint that is not a bug: this source has already
+			// become a task. The caller skips it rather than making a duplicate,
+			// which is the entire reason the index exists.
+			if isUniqueViolation(err) {
+				return ErrDuplicate
+			}
 			return err
 		}
 		return setTaskLabels(ctx, tx, t.ID, t.CreatedBy, labelNames)
 	})
 }
 
+// TaskIDBySource answers "has this mail already become a task?" — the question
+// nothing could answer before, and the one that stops two assistants reading the
+// same inbox from making two of everything. Empty id and no error means no.
+//
+// Deleted tasks count. A task that was made from a mail and then thrown away is
+// an answer — remaking it on the next sweep would be the same duplicate wearing
+// a different hat.
+func (db *DB) TaskIDBySource(ctx context.Context, userID, sourceKey string) (string, error) {
+	if sourceKey == "" {
+		return "", nil
+	}
+	var id string
+	err := db.QueryRowContext(ctx,
+		`SELECT id FROM tasks WHERE created_by = ? AND source_key = ?`,
+		userID, sourceKey).Scan(&id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", nil
+	}
+	return id, err
+}
+
 func (db *DB) nextTaskOrder(ctx context.Context, projectID, sectionID string) (float64, error) {
 	var max sql.NullFloat64
 	var err error

internal/store/users.go

@@ -466,6 +466,26 @@ func (db *DB) SetTOTPSecret(ctx context.Context, userID, secret string, enabled
 	return err
 }
 
+// ConsumeTOTPStep records a just-accepted TOTP step and reports whether it was
+// fresh. It answers false when the step has already been spent — the same code, or
+// an earlier one, being presented a second time.
+//
+// The guard is in the statement, not in a read-then-write: two logins racing with
+// the same stolen code must not both find the old value and both proceed. The row
+// moves forward only when the new step is strictly greater, so exactly one of them
+// updates a row and the other sees nothing change.
+func (db *DB) ConsumeTOTPStep(ctx context.Context, userID string, step int64) (bool, error) {
+	res, err := db.ExecContext(ctx,
+		`UPDATE users SET totp_last_step = ? WHERE id = ?
+		   AND (totp_last_step IS NULL OR totp_last_step < ?)`,
+		step, userID, step)
+	if err != nil {
+		return false, err
+	}
+	n, _ := res.RowsAffected()
+	return n == 1, nil
+}
+
 // InboxID returns the user's Inbox project.
 func (db *DB) InboxID(ctx context.Context, userID string) (string, error) {
 	var id string

rune/verdande.yaml

@@ -15,12 +15,37 @@ gameskill:
   # this: a manifest with new fields and an unchanged version is a manifest the
   # panel has no reason to re-read, so the fields never appear and the failure is
   # silent — the server's settings page simply does not offer them.
-  version: 4
+  # Bumpet til 6: v5 flyttede imaget til vores egen Gitea, og det virkede ikke.
+  # En rune opdaterer ikke sig selv — panelet skriver rune-rækken fra en
+  # UI-handling, så ændringen her kræver **Runes → verdande → Update**, og
+  # katalog-listen caches ti minutter, så to forsøg lige efter hinanden kan begge
+  # give den gamle version.
+  version: 6
   icon: "app"
 
   # The image is distroless — no shell — so keep_entrypoint runs the binary the
   # image already declares as its ENTRYPOINT, and startup.exec passes it argv
   # directly rather than through /bin/sh, which does not exist in there.
+  # GHCR, ikke vores egen Gitea. v5 prøvede det sidste og tog instansen ned.
+  #
+  # Panelets `PullImage` sætter aldrig `RegistryAuth`, så registret SKAL kunne
+  # læses uden legitimation. GHCR kan: dens token-endepunkt svarer 200 og udsteder
+  # en pull-token til hvem som helst. Gitea på gitea.nolimit.dk kan ikke —
+  # `/v2/token?scope=repository:kw/verdande:pull` svarer 401, også efter at repoet
+  # blev gjort offentligt. Instansen kræver login på alt, registret inklusive, og
+  # det er en indstilling for hele instansen frem for for denne pakke.
+  #
+  # Sådan ser det ud, når det går galt, for det tog en time at finde: panelet
+  # river containeren ned for at anvende runen, pullet fejler, `pullImageRetry`
+  # kasserer fejlen, og `ContainerCreate` slår derefter op LOKALT og siger
+  # `No such image`. Serveren står som "running" uden container_id, og udadtil er
+  # det en 502. Fejlen nævner aldrig, at det var et login, der manglede.
+  #
+  # Sådan afgør man det, uden at blive narret: spørg registrets token-endepunkt
+  # med `curl` og se efter en 200 med et token i. Test det ALDRIG med
+  # `docker --config <tom-mappe> pull` — en tom config stopper ikke maskinens
+  # credential-helper, så pullet bliver autentificeret uden at se sådan ud, og
+  # svaret er præcis det modsatte af sandheden.
   docker:
     image: "ghcr.io/kristianwind/verdande:latest"
     data_path: /data

web/e2e/smoke.spec.js

@@ -558,15 +558,35 @@ test('en opgave kan trækkes til en anden dag og videre til et projekt', async (
 	// browser is pinned to Europe/Copenhagen and this process is not, and for two
 	// hours of every day they disagree about what today is.
 	await page.goto('/upcoming');
+
+	// Taller than the default window, and it is not cosmetic: the month grid is
+	// six rows, and in 720 px the last one is cut off by the fold. A synthetic
+	// drag drops at the target's centre without the auto-scroll a real pointer
+	// gets from the browser — so a target below the fold is never hit.
+	//
+	// That made this test depend on the date. The task sits on tomorrow, and when
+	// tomorrow is a Sunday, the day after is the first cell of the next row, down
+	// in the cut-off part. It passed for months and failed the morning tomorrow
+	// happened to be a Sunday, on a commit that had touched nothing near a
+	// calendar.
+	await page.setViewportSize({ width: 1280, height: 1000 });
 	await page.getByRole('button', { name: 'Måned', exact: true }).click();
 
 	const chip = page.locator('.chip').filter({ hasText: 'hent pakken' });
 	await expect(chip).toBeVisible();
 
 	const from = await page.locator('.day').filter({ has: chip }).getAttribute('data-date');
-	const to = new Date(new Date(`${from}T12:00:00Z`).getTime() + 86400000)
-		.toISOString()
-		.slice(0, 10);
+
+	// The neighbouring cell is taken from the grid, not worked out from the date.
+	// The day after tomorrow is not always in the month on screen — at the end of
+	// a short month it falls outside it entirely — and the cell next door always
+	// is. Falls back to the cell before, for the one day a month when there is no
+	// cell after.
+	const dates = await page
+		.locator('.day[data-date]')
+		.evaluateAll((cells) => cells.map((cell) => cell.dataset.date));
+	const at = dates.indexOf(from);
+	const to = dates[at + 1] ?? dates[at - 1];
 
 	await chip.dragTo(page.locator(`[data-date="${to}"]`));
 	await expect(page.locator(`[data-date="${to}"]`).getByText('hent pakken')).toBeVisible();
@@ -1182,8 +1202,18 @@ test('kalenderen viser Googles begivenheder over egne opgaver, og kun opgaven ka
 	await expect(page.locator(`[data-date="${next}"] .tevent`).getByText('vande blomster')).toBeVisible();
 	await expect(band.getByText('vande blomster')).toBeHidden();
 	// The events stayed where they were; a rescheduled task moves nothing else.
-	await expect(cell.locator('.tevent')).toHaveCount(1);
-	await expect(band.locator('.event')).toHaveCount(1);
+	//
+	// Named, not counted. A raw `.tevent` count here assumes this day holds nothing
+	// but this test's own events — and it does not: the suite shares one database,
+	// so an earlier test that drags a task across a month boundary can leave a timed
+	// task on this very day, and a timed task is a `.tevent` too. Counting them all
+	// made this pass alone and fail in the full run, on whatever date the arithmetic
+	// happened to land the two tests on the same cell. Asserting the meeting stayed
+	// and the task left is the thing the test actually means, and it is true however
+	// full somebody else left the day.
+	await expect(cell.locator('.tevent').filter({ hasText: 'Bestyrelsesmøde' })).toHaveCount(1);
+	await expect(cell.locator('.tevent').filter({ hasText: 'vande blomster' })).toHaveCount(0);
+	await expect(band.locator('.event').filter({ hasText: 'Feriedag' })).toHaveCount(1);
 
 	expect(trouble).toEqual([]);
 });

web/src/routes/indstillinger/ai/+page.svelte

@@ -21,6 +21,13 @@
 		{ value: 'compatible', label: 'OpenAI-kompatibel (Ollama, LM Studio, …)' }
 	];
 
+	// Every field error needs somewhere to appear, and this list is the check that
+	// it does. `base_url` had nowhere: a refused address set `errors`, skipped the
+	// toast because the object was not empty, and then rendered nothing — so the
+	// one provider meant for running your own model looked like a save that did
+	// nothing at all. Anything without a slot is shouted rather than dropped.
+	const SHOWN = ['provider', 'model', 'base_url'];
+
 	// Suggestions, not a closed list: the model field is free text, because a new
 	// model name must not require a new release of this app to be usable.
 	const SUGGESTED_MODEL = {
@@ -56,7 +63,8 @@
 			saved = true;
 		} catch (e) {
 			errors = e.fields ?? {};
-			if (!Object.keys(errors).length) app.toast(humanMessage(e));
+			const homeless = Object.keys(errors).filter((field) => !SHOWN.includes(field));
+			if (!Object.keys(errors).length || homeless.length) app.toast(humanMessage(e));
 		} finally {
 			saving = false;
 		}
@@ -105,6 +113,7 @@
 						bind:value={settings.model}
 						placeholder={SUGGESTED_MODEL[settings.provider] ?? ''}
 					/>
+					{#if errors.model}<p class="error">{errors.model}</p>{/if}
 				</div>
 
 				{#if settings.provider === 'compatible'}
@@ -116,6 +125,7 @@
 							bind:value={settings.base_url}
 							placeholder="http://localhost:11434/v1"
 						/>
+						{#if errors.base_url}<p class="error">{errors.base_url}</p>{/if}
 					</div>
 				{/if}