Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
43 commits
Select commit Hold shift + click to select a range
e28cabe
fix: add timeout to health check endpoints to prevent hanging
buzzkillb Apr 10, 2026
5fdc973
fix: use tokio::sync::Mutex instead of std::sync::Mutex in HealthAggr…
buzzkillb Apr 14, 2026
c5062f5
fix: add Discord connectivity monitoring and auto-restart logic
buzzkillb Apr 19, 2026
d5ee15e
fix: remove unreachable!() panics in format_custom_status
buzzkillb Apr 19, 2026
4a1c65f
fix: use subquery for DELETE LIMIT to support older SQLite versions
buzzkillb Apr 19, 2026
222969e
fix: improve SQLite concurrency settings for better handling of many …
buzzkillb Apr 19, 2026
d72d930
feat: migrate from SQLite to PostgreSQL for better concurrency
buzzkillb Apr 19, 2026
8e20d88
feat: improve stability with task supervision and shared price state
buzzkillb Apr 19, 2026
bd70916
fix: compilation errors in stability migration
buzzkillb Apr 19, 2026
f153e5f
feat(v2): Python rewrite with discord.py and asyncpg
buzzkillb Apr 19, 2026
f11dabe
fix: asyncio.run() and idempotent table creation
buzzkillb Apr 19, 2026
35b0ac8
feat: cycle through BTC/ETH/SOL with 1h percentage change
buzzkillb Apr 19, 2026
dd2f26f
fix: each bot shows its own crypto price, not cycling
buzzkillb Apr 19, 2026
20c6435
fix: SHANGHAISILVER fallback to cached price if fetch fails
buzzkillb Apr 19, 2026
8ddcfc3
fix: SHANGHAISVER - goldsilver.ai is fully JS-rendered, no live data …
buzzkillb Apr 19, 2026
5ec551f
feat: SHANGHAISILVER price fetch works!
buzzkillb Apr 19, 2026
6aa5507
fix: uppercase ticker names in Discord nicknames
buzzkillb Apr 19, 2026
4200a25
feat: DXY via Yahoo Finance (DX-Y.NYB)
buzzkillb Apr 19, 2026
689adc7
feat: cycle status between BTC value and 1h percentage
buzzkillb Apr 19, 2026
3aea809
fix: show BTC value as '0.030582 BTC' instead of ₿ symbol
buzzkillb Apr 19, 2026
8adab81
feat: cycle through BTC, ETH, SOL conversions and 1h%
buzzkillb Apr 19, 2026
e82a6c0
docs: update README for Python rewrite
buzzkillb Apr 19, 2026
822ea4b
Add chart generation commands and improve price display
buzzkillb Apr 19, 2026
d73168c
Fix /price command to default to bot's own ticker
buzzkillb Apr 19, 2026
31b3117
Enable /chart command for all bots
buzzkillb Apr 19, 2026
6c5f5b7
Add timeframe presets to /chart command
buzzkillb Apr 19, 2026
36d7e26
Update README with SSILVER display name
buzzkillb Apr 19, 2026
209f24e
Expand /chart price documentation in README
buzzkillb Apr 19, 2026
e4d6b9f
Add autocomplete timeframe input to /chart command
buzzkillb Apr 19, 2026
32633e7
Switch to Alpine for smaller image size (266MB vs 350MB)
buzzkillb Apr 20, 2026
1d8ca10
Rewrite README with clean, professional documentation
buzzkillb Apr 20, 2026
6e4cc65
Fix code review findings: chart dates, resource cleanup, remove dead …
buzzkillb Apr 20, 2026
9cc0fb2
Security fixes: non-root user, fail-fast DATABASE_URL, env-based post…
buzzkillb Apr 20, 2026
310dafa
Enforce strong postgres password via env vars
buzzkillb Apr 20, 2026
7c21b18
Add CI/CD with ruff linting and docker smoke test
buzzkillb Apr 20, 2026
bd39755
Fix CI: use docker compose v2 syntax, update action versions
buzzkillb Apr 20, 2026
5590458
Fix CI: lint cleanup, fallback postgres password for CI
buzzkillb Apr 20, 2026
710da7c
Fix lint errors and CI env file setup
buzzkillb Apr 20, 2026
f032ebc
Update CI: checkout@v5, opt into Node.js 24
buzzkillb Apr 20, 2026
44498e4
Fix PR review: row limits, downsampling, save conversion prices
buzzkillb Apr 20, 2026
2a6e92f
Implement 5-year retention with tiered aggregation
buzzkillb Apr 20, 2026
26ebfb7
Fix PR review: DOUBLE PRECISION for prices, SSILVER fallback logic
buzzkillb Apr 20, 2026
3f769a2
Fix lint errors in database.py
buzzkillb Apr 20, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 0 additions & 14 deletions .cargo/config.toml

This file was deleted.

48 changes: 12 additions & 36 deletions .env.example
Original file line number Diff line number Diff line change
@@ -1,41 +1,17 @@
# Price update interval (shared by all services)
UPDATE_INTERVAL_SECONDS=30
# Price update interval in seconds

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hardcoded database credentials in .env.example

Critical Severity

The .env.example file contains what appears to be a real database password: POSTGRES_PASSWORD=PdefSMMIa8N22nKwHxmWz5znC13bUFo and a corresponding DATABASE_URL with the same password embedded. Example/template files should contain only placeholder values like your_password_here, never actual credentials. If users copy this file without editing, they may unknowingly use these credentials in production. Anyone with read access to the repository can obtain these credentials.

Suggested fix: Replace PdefSMMIa8N22nKwHxmWz5znC13bUFo with placeholder text like your_secure_password_here in both POSTGRES_PASSWORD and DATABASE_URL.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hardcoded database password committed to repository

High Severity

The .env.example file contains a hardcoded database password (PdefSMMIa8N22nKwHxmWz5znC13bUFo). While this is an example file, committing credentials to version control creates security risk if developers copy it without generating new credentials. Passwords should only be documented as placeholders or sourced from CI secrets.

Suggested fix: Remove the hardcoded password from .env.example and use a placeholder value like your_secure_password_here, or document that users must generate their own.

UPDATE_INTERVAL_SECONDS=12

# How often to clean up old price data (in hours)
CLEANUP_INTERVAL_HOURS=48

# Log level: error, warn, info, debug, trace
RUST_LOG=info

# Discord Bot Tokens - get these from https://discord.com/developers/applications
# Create a bot, go to Bot, and click "Reset Token" to get a new token
# Then invite the bot to your server with appropriate permissions
# Discord Bot Tokens
# Format: DISCORD_TOKEN_<NAME>=token
DISCORD_TOKEN_BTC=your_btc_bot_token_here
DISCORD_TOKEN_ETH=your_eth_bot_token_here
DISCORD_TOKEN_SOL=your_sol_bot_token_here
DISCORD_TOKEN_DOGE=your_doge_bot_token_here
DISCORD_TOKEN_AVAX=your_avax_bot_token_here
DISCORD_TOKEN_BNB=your_bnb_bot_token_here
DISCORD_TOKEN_SUI=your_sui_bot_token_here
DISCORD_TOKEN_SEI=your_sei_bot_token_here
DISCORD_TOKEN_JLP=your_jlp_bot_token_here
DISCORD_TOKEN_PUMP=your_pump_bot_token_here
DISCORD_TOKEN_XPL=your_xpl_bot_token_here
DISCORD_TOKEN_MSTR=your_mstr_bot_token_here
DISCORD_TOKEN_OIL=your_oil_bot_token_here
DISCORD_TOKEN_VOO=your_voo_bot_token_here
DISCORD_TOKEN_DXY=your_dxy_bot_token_here
DISCORD_TOKEN_HOOD=your_hood_bot_token_here
DISCORD_TOKEN_SBET=your_sbet_bot_token_here
DISCORD_TOKEN_GOLD=your_gold_bot_token_here
DISCORD_TOKEN_SILVER=your_silver_bot_token_here
DISCORD_TOKEN_FARTCOIN=your_fartcoin_bot_token_here
DISCORD_TOKEN_2Z=your_2z_bot_token_here
DISCORD_TOKEN_ASTER=your_aster_bot_token_here
DISCORD_TOKEN_EURO=your_euro_bot_token_here
DISCORD_TOKEN_SHANGHAISILVER=your_shanghai_silver_bot_token_here
DISCORD_TOKEN_SHANGHAI=your_shanghai_bot_token_here

# Crypto Feed IDs (Pyth Network) - these are public and safe to share
# Get fresh IDs from https://pyth.network/docs/developers
CRYPTO_FEEDS=BTC:0xe62df6c8b4a85fe1a67db44dc12de5db330f7ac66b72dc658afedf0f4a415b43,ETH:0xff61491a931112ddf1bd8147cd1b641375f79f5825126d665480874634fd0ace,SOL:0xef0d8b6fda2ceba41da15d4095d1da392a0d2f8ed0c6c7bc0f4cfac8c280b56d,DOGE:0xdcef50dd0a4cd2dcc17e45df1676dcb336a11a61c69df7a0299b0150c672d25c,DXY:yahoo_finance
# Pyth Network Feed IDs (comma-separated)
# Format: CRYPTO:feed_id,CRYPTO:feed_id,...
CRYPTO_FEEDS=BTC:0xe62df6c8b4a85fe1a67db44dc12de5db330f7ac66b72dc658afedf0f4a415b43,ETH:0xff61491a931112ddf1bd8147cd1b641375f79f5825126d665480874634fd0ace,SOL:0xef0d8b6fda2ceba41da15d4095d1da392a0d2f8ed0c6c7bc0f4cfac8c280b56d

Comment on lines +11 to +13

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hardcoded database credentials committed to repository

Critical Severity

The .env.example file contains hardcoded PostgreSQL credentials: POSTGRES_PASSWORD=PdefSMMIa8N22nKwHxmWz5znC13bUFo and DATABASE_URL=postgresql://postgres:PdefSMMIa8N22nKwHxmWz5znC13bUFo@postgres:5432/pricebot. The .gitignore only ignores .env, .env.local, .env.production but NOT .env.example, so these credentials will be committed to version control. Anyone with repository access can extract these credentials and gain database access. This is a severe security vulnerability that could lead to unauthorized database access and potential data breaches.

Suggested fix: Remove the hardcoded password values from .env.example. Replace with placeholder values that clearly indicate they must be changed: POSTGRES_PASSWORD=changeme and DATABASE_URL=postgresql://postgres:changeme@postgres:5432/pricebot. The existing comment "CHANGE THESE PASSWORDS" is insufficient as users may miss it or copy-paste without modification.

# Database - CHANGE THESE PASSWORDS
POSTGRES_USER=postgres
POSTGRES_PASSWORD=PdefSMMIa8N22nKwHxmWz5znC13bUFo
DATABASE_URL=postgresql://postgres:PdefSMMIa8N22nKwHxmWz5znC13bUFo@postgres:5432/pricebot
Comment on lines +14 to +17

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hardcoded database password in .env.example

High Severity

The .env.example file contains a hardcoded database password (PdefSMMIa8N22nKwHxmWz5znC13bUFo) instead of a placeholder value. While the comment says "CHANGE THESE PASSWORDS", having actual credentials in the repository creates a security risk - the password will remain in git history and users may deploy with the real credential.

Suggested fix: Replace the hardcoded password with a placeholder like your_secure_password_here and update the comment to make it clear this must be changed before deployment.

5 changes: 5 additions & 0 deletions .factory/settings.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"enabledPlugins": {
"core@factory-plugins": true
}
}
96 changes: 64 additions & 32 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,51 +2,83 @@ name: CI

on:
push:
branches: [main, dev]
branches: [main, v2]
pull_request:
branches: [main]
branches: [main, v2]

env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
test:
lint:
name: Lint Python
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Install Rust
uses: dtolnay/rust-toolchain@stable

- name: Install system dependencies
run: |
sudo apt-get update
sudo apt-get install -y pkg-config libssl-dev libfreetype6-dev libfontconfig1-dev
- uses: actions/checkout@v5

- name: Cache cargo
uses: Swatinem/rust-cache@v2
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.12"

- name: Build
run: cargo build --release
- name: Install lint tools
run: pip install ruff

- name: Run tests
run: cargo test
- name: Run ruff
run: ruff check .

docker:
name: Docker Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Create test .env
run: |
cp .env.example .env
echo "DATABASE_URL=postgresql://postgres:postgres@postgres:5432/pricebot" >> .env

- name: Build Docker image
uses: docker/build-push-action@v5
with:
context: .
load: true
tags: rustymcpriceface:test
- name: Build Docker Compose
run: docker compose build

- name: Check Docker Compose validity
run: docker compose config --quiet

smoke-test:
name: Smoke Test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5

- name: Verify Docker image runs
- name: Create test .env
run: |
docker run -d --name test-container -e DISCORD_TOKEN_BTC=test rustymcpriceface:test
sleep 10
docker logs test-container
docker rm -f test-container
cp .env.example .env
echo "DATABASE_URL=postgresql://postgres:postgres@postgres:5432/pricebot" >> .env

- name: Start services
run: docker compose up -d

- name: Wait for postgres
run: |
for i in {1..30}; do
if docker compose exec -T postgres pg_isready -U postgres > /dev/null 2>&1; then
echo "Postgres ready"
exit 0
fi
sleep 1
done
echo "Postgres failed to start"
exit 1

- name: Check bot container
run: |
sleep 5
docker compose ps

- name: Check bot logs
run: |
docker compose logs bot | head -20

- name: Stop services
if: always()
run: docker compose down
30 changes: 0 additions & 30 deletions .github/workflows/test.yml

This file was deleted.

Loading