Send email confirmation when BTC payment is confirmed

Implement bitcoin donations via BTCPay
Allow other controllers to access lndhub user balance
2024-02-22 15:20:17 +01:00 · 2024-02-22 15:19:27 +01:00 · 2024-02-22 15:19:27 +01:00 · 2024-02-22 15:19:27 +01:00 · 2024-02-22 15:19:27 +01:00
191 changed files with 835 additions and 4330 deletions
--- a/.env.example
+++ b/.env.example
@@ -1,14 +1,14 @@
-# PRIMARY_DOMAIN=kosmos.org
-# AKKOUNTS_DOMAIN=accounts.example.com
+PRIMARY_DOMAIN=kosmos.org
+AKKOUNTS_DOMAIN=accounts.example.com

-# SMTP_SERVER=smtp.example.com
-# SMTP_PORT=587
-# SMTP_LOGIN=accounts
-# SMTP_PASSWORD=123abc
-# SMTP_FROM_ADDRESS=accounts@example.com
-# SMTP_DOMAIN=example.com
-# SMTP_AUTH_METHOD=plain
-# SMTP_ENABLE_STARTTLS=auto
+SMTP_SERVER=smtp.example.com
+SMTP_PORT=587
+SMTP_LOGIN=accounts
+SMTP_PASSWORD=123abc
+SMTP_FROM_ADDRESS=accounts@example.com
+SMTP_DOMAIN=example.com
+SMTP_AUTH_METHOD=plain
+SMTP_ENABLE_STARTTLS=auto

 # S3_ENABLED=true
 # S3_ENDPOINT=https://s3.kosmos.org
@@ -18,54 +18,48 @@
 # S3_ACCESS_KEY=123456abcdefg
 # S3_SECRET_KEY=123456789123456789123456789

-# LDAP_HOST=localhost
-# LDAP_PORT=389
-# LDAP_ADMIN_PASSWORD=passthebutter
-# LDAP_SUFFIX='dc=kosmos,dc=org'
+LDAP_HOST=localhost
+LDAP_PORT=389
+LDAP_ADMIN_PASSWORD=passthebutter
+LDAP_SUFFIX='dc=kosmos,dc=org'

-# REDIS_URL='redis://localhost:6379/1'
+REDIS_URL='redis://localhost:6379/1'

-# WEBHOOKS_ALLOWED_IPS='10.1.1.163'
+WEBHOOKS_ALLOWED_IPS='10.1.1.163'

 #
 # Service Integrations
-# (sorted alphabetically by service name)
 #

-# BTCPAY_PUBLIC_URL='https://btcpay.example.com'
-# BTCPAY_API_URL='http://localhost:23001/api/v1'
-# BTCPAY_STORE_ID=''
-# BTCPAY_AUTH_TOKEN=''
+BTCPAY_PUBLIC_URL='https://btcpay.example.com'
+BTCPAY_API_URL='http://localhost:23001/api/v1'
+BTCPAY_STORE_ID=''
+BTCPAY_AUTH_TOKEN=''

-# DISCOURSE_PUBLIC_URL='https://community.kosmos.org'
-# DISCOURSE_CONNECT_SECRET='discourse_connect_ftw'
+DISCOURSE_PUBLIC_URL='https://community.kosmos.org'
+DISCOURSE_CONNECT_SECRET='discourse_connect_ftw'

-# DRONECI_PUBLIC_URL='https://drone.kosmos.org'
+DRONECI_PUBLIC_URL='https://drone.kosmos.org'

-# EJABBERD_ADMIN_URL='https://xmpp.kosmos.org/admin'
-# EJABBERD_API_URL='https://xmpp.kosmos.org/api'
+EJABBERD_ADMIN_URL='https://xmpp.kosmos.org/admin'
+EJABBERD_API_URL='https://xmpp.kosmos.org/api'

-# GITEA_PUBLIC_URL='https://gitea.kosmos.org'
+GITEA_PUBLIC_URL='https://gitea.kosmos.org'

-# LNDHUB_API_URL='http://localhost:3023'
-# LNDHUB_PUBLIC_URL='https://lndhub.kosmos.org'
-# LNDHUB_PUBLIC_KEY='0123d3be18617f39cf645851e3ba63f51fc13f0bb09e3bb25e6fd4de556486d946'
-# LNDHUB_ADMIN_UI=true
-# LNDHUB_ADMIN_TOKEN=123456789
-# LNDHUB_PG_HOST=localhost
-# LNDHUB_PG_PORT=5432
-# LNDHUB_PG_DATABASE=lndhub
-# LNDHUB_PG_USERNAME=lndhub
-# LNDHUB_PG_PASSWORD=''
+LNDHUB_API_URL='http://localhost:3023'
+LNDHUB_PUBLIC_URL='https://lndhub.kosmos.org'
+LNDHUB_PUBLIC_KEY='0123d3be18617f39cf645851e3ba63f51fc13f0bb09e3bb25e6fd4de556486d946'
+LNDHUB_ADMIN_UI=true
+LNDHUB_ADMIN_TOKEN=123456789
+LNDHUB_PG_HOST=localhost
+LNDHUB_PG_PORT=5432
+LNDHUB_PG_DATABASE=lndhub
+LNDHUB_PG_USERNAME=lndhub
+LNDHUB_PG_PASSWORD=''

-# MASTODON_PUBLIC_URL='https://kosmos.social'
-# MASTODON_ADDRESS_DOMAIN='https://kosmos.org'
+MASTODON_PUBLIC_URL='https://kosmos.social'

-# MEDIAWIKI_PUBLIC_URL='https://wiki.kosmos.org'
+MEDIAWIKI_PUBLIC_URL='https://wiki.kosmos.org'

-# NOSTR_PRIVATE_KEY='123456abcdef...'
-# NOSTR_PUBLIC_KEY='123456abcdef...'
-# NOSTR_RELAY_URL='wss://nostr.kosmos.org'
-
-# RS_STORAGE_URL='https://storage.kosmos.org'
-# RS_REDIS_URL='redis://localhost:6379/2'
+RS_STORAGE_URL='https://storage.kosmos.org'
+RS_REDIS_URL='redis://localhost:6379/2'
--- a/.env.test
+++ b/.env.test
@@ -1,5 +1,4 @@
 PRIMARY_DOMAIN=kosmos.org
-AKKOUNTS_DOMAIN=accounts.kosmos.org

 REDIS_URL='redis://localhost:6379/0'

@@ -12,15 +11,10 @@ DISCOURSE_CONNECT_SECRET='discourse_connect_ftw'

 EJABBERD_API_URL='http://xmpp.example.com/api'

-MASTODON_PUBLIC_URL='http://example.social'
-
 LNDHUB_API_URL='http://localhost:3026'
 LNDHUB_PUBLIC_URL='https://lndhub.kosmos.org'
 LNDHUB_PUBLIC_KEY='024cd3be18617f39cf645851e3ba63f51fc13f0bb09e3bb25e6fd4de556486d946'

-NOSTR_PRIVATE_KEY='7c3ef7e448505f0615137af38569d01807d3b05b5005d5ecf8aaafcd40323cea'
-NOSTR_PUBLIC_KEY='bdd76ce2934b2f591f9fad2ebe9da18f20d2921de527494ba00eeaa0a0efadcf'
-
 RS_STORAGE_URL='https://storage.kosmos.org'
 RS_REDIS_URL='redis://localhost:6379/1'

--- a/13
+++ b/13
@@ -1,11 +1,18 @@
 # syntax=docker/dockerfile:1
-FROM ruby:3.3.4
+FROM debian:bullseye-slim as base

 SHELL ["/bin/bash", "-o", "pipefail", "-c"]

-RUN apt-get update -qq && apt-get install -y --no-install-recommends curl \
-      ldap-utils tini libvips
+# TODO Remove when upstream Ruby works properly on Apple silicon
+RUN apt update && apt install -y build-essential wget autoconf libpq-dev pkg-config
+RUN wget https://github.com/postmodern/ruby-install/releases/download/v0.9.3/ruby-install-0.9.3.tar.gz \
+  && tar -xzvf ruby-install-0.9.3.tar.gz \
+  && cd ruby-install-0.9.3/ \
+  && make install
+RUN ruby-install -p https://github.com/ruby/ruby/pull/9371.diff ruby 3.3.0
+ENV PATH="/opt/rubies/ruby-3.3.0/bin:${PATH}"

+RUN apt-get install -y --no-install-recommends curl ldap-utils tini libvips
 RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -
 RUN apt-get update && apt-get install -y nodejs

--- a/4
+++ b/4
@@ -61,8 +61,8 @@ gem "sentry-rails"
 # Services
 gem 'discourse_api'
 gem "lnurl"
-gem 'manifique', '~> 1.1.0'
-gem 'nostr', '~> 0.6.0'
+gem 'manifique'
+gem 'nostr'

 group :development, :test do
  # Use sqlite3 as the database for Active Record
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -155,7 +155,7 @@ GEM
      ruby2_keywords
    e2mmap (0.1.0)
    ecdsa (1.2.0)
-    ecdsa_ext (0.5.1)
+    ecdsa_ext (0.5.0)
      ecdsa (~> 1.2.0)
    erubi (1.12.0)
    et-orbi (1.2.7)
@@ -245,7 +245,7 @@ GEM
      net-imap
      net-pop
      net-smtp
-    manifique (1.1.0)
+    manifique (1.0.1)
      faraday (~> 2.9.0)
      faraday-follow_redirects (= 0.3.0)
      nokogiri (~> 1.16.0)
@@ -278,9 +278,9 @@ GEM
      racc (~> 1.4)
    nokogiri (1.16.0-x86_64-linux)
      racc (~> 1.4)
-    nostr (0.6.0)
+    nostr (0.5.0)
      bech32 (~> 1.4)
-      bip-schnorr (~> 0.7)
+      bip-schnorr (~> 0.6)
      ecdsa (~> 1.2)
      event_emitter (~> 0.2)
      faye-websocket (~> 0.11)
@@ -515,9 +515,9 @@ DEPENDENCIES
  listen (~> 3.2)
  lnurl
  lockbox
-  manifique (~> 1.1.0)
+  manifique
  net-ldap
-  nostr (~> 0.6.0)
+  nostr
  pagy (~> 6.0, >= 6.0.2)
  pg (~> 1.5)
  puma (~> 4.1)
--- a/README.md
+++ b/README.md
@@ -14,10 +14,8 @@ so:

 1. Make sure [Docker Compose is installed][1] and Docker is running (included in
   Docker Desktop)
-3. Run `docker compose up --build` and wait until all services have started
-   (389ds might take an extra minute to be ready). This will take a while when
-   running for the first time, so you might want to do something else in the
-   meantime.
+3. Run `docker compose up` and wait until 389ds announces its successful start
+   in the log output
 4. `docker-compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"`
 5. `docker compose run web rails ldap:setup`
 6. `docker compose run web rails db:setup`
@@ -30,44 +28,38 @@ have the password "user is user".

 ### Rails app

-_Note: when using Docker Compose, prefix the following commands with `docker-compose
-run web`._
-
 Installing dependencies:

    bundle install
    yarn install

-Migrating the local database (after schema changes):
+Setting up local database (SQLite):

+    bundle exec rails db:create
    bundle exec rails db:migrate

-Running the dev server, and auto-building CSS files on change _(automatic with Docker Compose)_:
+Running the dev server and auto-building CSS files on change:

    bin/dev

-Running the background workers (requires Redis) _(automatic with Docker Compose)_:
+Running the background workers (requires Redis):

    bundle exec sidekiq -C config/sidekiq.yml

-Running the test suite:
+Running all specs:

    bundle exec rspec

-Running the test suite with Docker Compose requires overriding the Rails
-environment:
+### Docker (Compose)

-    docker-compose run -e "RAILS_ENV=test" web rspec
+There is a working Docker Compose config file, which define a number of services including
+an app server for Rails as well as a local 389ds (LDAP) server.

-### Docker Compose
+For Rails developers, you probably just want to start the LDAP server: `docker-compose up ldap`, 
+listening on port 389 on your machine. 

-Services/containers are configured in `docker-compose.yml`.
-
-You can run services selectively, for example if you want to run the Rails app
-and test suite on the host machine. Just add the service names of the
-containers you want to run to the `up` command, like so:
-
-    docker-compose up ldap redis
+You can pick and choose your services adding them by name (listed in `docker-compose.yml`) at 
+the end of the docker compose command. eg. `docker compose up ldap redis`

 #### LDAP server

@@ -84,15 +76,13 @@ Now you can seed the back-end with data using this Rails task:
 The setup task will first delete any existing entries in the directory tree
 ("dc=kosmos,dc=org"), and then create our development entries.

-Note that all 389ds data is stored in the `389ds-data` volume. So if you want
-to start over with a fresh installation, delete both that volume as well as the
-container.
+Note that all 389ds data is stored in `tmp/389ds`. So if you want to start over
+with a fresh installation, delete both that directory as well as the container.

-#### Minio / remoteStorage
+#### Minio / RS

 If you want to run remoteStorage accounts locally, you will have to create the
-respective bucket first. With the `minio` container running (run by default
-when using Docker Compose), follow these steps:
+respective bucket first:

 * `docker compose up web redis minio liquor-cabinet`
 * Head to http://localhost:9001 and log in with user `minioadmin`, password
--- a/app/assets/stylesheets/components/buttons.css
+++ b/app/assets/stylesheets/components/buttons.css
@@ -42,11 +42,6 @@
           focus:ring-red-500 focus:ring-opacity-75;
  }

-  .btn-outline-purple {
-    @apply border-2 border-purple-500 hover:bg-purple-100
-           focus:ring-purple-400 focus:ring-opacity-75;
-  }
-
  .btn:disabled {
    @apply bg-gray-100 hover:bg-gray-200 text-gray-400
           focus:ring-gray-300 focus:ring-opacity-75;
--- a/app/assets/stylesheets/components/dashboard_services.css
+++ b/app/assets/stylesheets/components/dashboard_services.css
@@ -1,5 +1,5 @@
@layer components {
  .services > div > a {
-    background-image: linear-gradient(110deg, rgba(255,255,255,0.99) 20%, rgba(255,255,255,0.88) 100%);
+    background-image: linear-gradient(110deg, rgba(255,255,255,0.99) 0, rgba(255,255,255,0.88) 100%);
  }
 }
--- a/app/components/app_catalog/web_app_icon_component.html.erb
+++ b/app/components/app_catalog/web_app_icon_component.html.erb
@@ -1,5 +0,0 @@
-<% if @image_url %>
-  <%= image_tag @image_url, class: "h-full w-full" %>
-<% else %>
-  <%= render partial: "icons/remotestorage", locals: { custom_class: "h-full w-full p-0.5 text-gray-200" } %>
-<% end %>
--- a/app/components/app_catalog/web_app_icon_component.rb
+++ b/app/components/app_catalog/web_app_icon_component.rb
@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-module AppCatalog
-  class WebAppIconComponent < ViewComponent::Base
-    def initialize(web_app:)
-      if web_app&.icon&.attached?
-        @image_url = image_url_for(web_app.icon)
-      elsif web_app&.apple_touch_icon&.attached?
-        @image_url = image_url_for(web_app.apple_touch_icon)
-      end
-    end
-
-    def image_url_for(attachment)
-      if Setting.s3_enabled?
-        s3_image_url(attachment)
-      else
-        Rails.application.routes.url_helpers.rails_blob_path(attachment, only_path: true)
-      end
-    end
-  end
-end
--- a/app/components/form_elements/fieldset_resettable_setting_component.html.erb
+++ b/app/components/form_elements/fieldset_resettable_setting_component.html.erb
@@ -6,7 +6,6 @@
    ) do %>
  <%= method("#{@type}_field").call :setting, @key,
    value: Setting.public_send(@key),
-    placeholder: @placeholder,
    data: {
      :'default-value' => Setting.get_field(@key)[:default]
    },
--- a/app/components/form_elements/fieldset_resettable_setting_component.rb
+++ b/app/components/form_elements/fieldset_resettable_setting_component.rb
@@ -2,7 +2,7 @@

 module FormElements
  class FieldsetResettableSettingComponent < ViewComponent::Base
-    def initialize(tag: "li", key:, type: :text, title:, description: nil, placeholder: nil)
+    def initialize(tag: "li", key:, type: :text, title:, description: nil)
      @tag         = tag
      @positioning = :vertical
      @title       = title
@@ -10,7 +10,6 @@ module FormElements
      @key         = key.to_sym
      @type        = type
      @resettable  = is_resettable?(@key)
-      @placeholder = placeholder
    end

    def is_resettable?(key)
--- a/app/components/form_elements/fieldset_toggle_component.html.erb
+++ b/app/components/form_elements/fieldset_toggle_component.html.erb
@@ -6,7 +6,7 @@
  <div class="flex flex-col">
    <label class="font-bold mb-1"><%= @title %></label>
    <% if @description.present? %>
-    <p class="text-gray-500"><%= @description %></p>
+    <p class="text-gray-500"><%= @descripton %></p>
    <% end %>
  </div>
  <div class="relative ml-4 inline-flex flex-shrink-0">
--- a/app/components/form_elements/fieldset_toggle_component.rb
+++ b/app/components/form_elements/fieldset_toggle_component.rb
@@ -12,7 +12,7 @@ module FormElements
      @enabled = enabled
      @input_enabled = input_enabled
      @title = title
-      @description = description
+      @descripton = description
      @button_text = @enabled ? "Switch off" : "Switch on"
    end
  end
--- a/app/components/rs_auth_component.html.erb
+++ b/app/components/rs_auth_component.html.erb
@@ -1,10 +1,16 @@
 <div class="flex items-center gap-4">
  <div class="h-16 w-16 flex-none">
-    <%= render AppCatalog::WebAppIconComponent.new(web_app: @web_app) %>
+    <% if @web_app.icon.attached? %>
+    <%= image_tag s3_image_url(@web_app.icon), class: "h-full w-full" %>
+    <% elsif @web_app.apple_touch_icon.attached? %>
+    <%= image_tag s3_image_url(@web_app.apple_touch_icon), class: "h-full w-full" %>
+    <% else %>
+    <%= render partial: "icons/remotestorage", locals: { custom_class: "h-full w-full p-0.5 text-gray-200" } %>
+    <% end %>
  </div>
  <div class="flex-grow">
    <h4 class="mb-1 text-lg font-bold">
-      <%= @web_app&.name || @auth.app_name %>
+      <%= @web_app.name %>
    </h4>
    <p class="text-sm text-gray-500">
      <%= @auth.client_id %>
--- a/app/components/settings/nostr_edit_profile_component.html.erb
+++ b/app/components/settings/nostr_edit_profile_component.html.erb
@@ -1,44 +0,0 @@
-<div class="w-[72vw] md:w-[500px]">
-  <header class="absolute z-10 h-36 sm:h-44 inset-x-1 top-1 rounded-t
-                 bg-cover bg-center bg-gray-50"
-          style="background-image: url('<%= @profile["banner"]%>');">
-    <div class="inline-block z-20 size-28 sm:size-32 ml-4 mt-16 sm:mt-20">
-    <% if @profile["picture"].present? %>
-      <img src="<%= @profile["picture"] %>"
-           class="inline-block size:28 sm:size-32 rounded-full border-2 border-white" />
-    <% else %>
-      <span class="inline-block size:28 sm:size-32 overflow-hidden rounded-full border-2 border-white bg-gray-100">
-        <svg class="size-full text-gray-300" fill="currentColor" viewBox="0 0 24 24">
-          <path d="M24 20.993V24H0v-2.996A14.977 14.977 0 0112.004 15c4.904 0 9.26 2.354 11.996 5.993zM16.002 8.999a4 4 0 11-8 0 4 4 0 018 0z" />
-        </svg>
-      </span>
-    <% end %>
-    </div>
-  </header>
-  <main class="mt-44 sm:mt-52">
-    <%= form_for(@user, url: setting_path(:nostr), html: { :method => :put }) do |f| %>
-      <%= render FormElements::FieldsetComponent.new(tag: "div", title: "Display name") do %>
-        <%= f.text_field :display_name, value: @display_name, class: "w-full sm:w-3/5" %>
-        <% if @validation_errors.present? && @validation_errors[:display_name].present? %>
-          <p class="error-msg mt-2"><%= @validation_errors[:display_name].first %></p>
-        <% end %>
-      <% end %>
-      <%= render FormElements::FieldsetComponent.new(tag: "div", title: "Nostr address (NIP-05)") do %>
-        <%= f.text_field :nip05_address, value: @profile["nip05"], class: "w-full sm:w-3/5" %>
-        <% if @validation_errors.present? && @validation_errors[:nip05_address].present? %>
-          <p class="error-msg mt-2"><%= @validation_errors[:nip05_address].first %></p>
-        <% end %>
-      <% end %>
-      <%= render FormElements::FieldsetComponent.new(tag: "div", title: "Ligtning address for Zaps") do %>
-        <%= f.text_field :lud16_address, value: @profile["lud16"], class: "w-full sm:w-3/5" %>
-        <% if @validation_errors.present? && @validation_errors[:lud16_address].present? %>
-          <p class="error-msg mt-2"><%= @validation_errors[:lud16_address].first %></p>
-        <% end %>
-      <% end %>
-    <% end %>
-  </main>
-  <footer>
-    <%# <%= @profile.inspect %>
-    <%# <%= @profile_event.inspect %>
-  </footer>
-</div>
--- a/app/components/settings/nostr_edit_profile_component.rb
+++ b/app/components/settings/nostr_edit_profile_component.rb
@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-
-module Settings
-  class NostrEditProfileComponent < ViewComponent::Base
-    def initialize(user:, profile_event:)
-      if profile_event.present?
-        @user = user
-        @profile_event = profile_event
-        @profile = JSON.parse(profile_event["content"])
-        @display_name = @profile["display_name"] || @profile["displayName"]
-
-        if @profile["nip05"].present? && @profile["nip05"] == @user.address
-          # "Your profile's Nostr address is set to <strong>#{ user_address }</strong>"
-        else
-          # "Your profile's Nostr address is not set to <strong>#{ user_address }</strong> yet"
-        end
-
-        if @profile["lud16"].present? && @profile["lud16"] == @user.address
-          # "Your profile's Lightning address is set to <strong>#{ user_address }</strong>"
-        else
-          # "Your profile's Lightning address is not set to <strong>#{ user_address }</strong> yet"
-        end
-      else
-        # "We could not find a profile for your public key"
-      end
-    end
-  end
-end
--- a/app/components/settings/nostr_profile_status_component.html.erb
+++ b/app/components/settings/nostr_profile_status_component.html.erb
@@ -1,21 +0,0 @@
-<% @statuses.each do |status| %>
-  <%= render StatusTextComponent.new(
-    text: status[:text],
-    icon_name: status[:icon_name],
-    icon_color: status[:icon_color]
-  ) %>
-<% end %>
-
-<% if @status == 1 %>
-  <p class="mt-8">
-    <button class="btn-md btn-blue">
-      Edit my profile
-    </button>
-  </p>
-<% elsif @status == 2 %>
-  <p class="mt-8">
-    <button class="btn-md btn-blue">
-      Create my profile
-    </button>
-  </p>
-<% end %>
--- a/app/components/settings/nostr_profile_status_component.rb
+++ b/app/components/settings/nostr_profile_status_component.rb
@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-
-module Settings
-  class NostrProfileStatusComponent < ViewComponent::Base
-    def initialize(profile_event:, user_address:)
-      @statuses = []
-
-      if profile_event.present?
-        profile = JSON.parse(profile_event["content"])
-
-        @statuses.push({
-          text: "You have a public Nostr profile",
-          icon_name: "check-circle",
-          icon_color: "emerald-500"
-        })
-
-        if profile["nip05"].present? && profile["nip05"] == user_address
-          @statuses.push({
-            text: "Your profile's Nostr address is set to <strong>#{ user_address }</strong>",
-            icon_name: "check-circle",
-            icon_color: "emerald-500"
-          })
-        else
-          @statuses.push({
-            text: "Your profile's Nostr address is not set to <strong>#{ user_address }</strong> yet",
-            icon_name: "alert-octagon",
-            icon_color: "amber-500"
-          })
-        end
-
-        if profile["lud16"].present? && profile["lud16"] == user_address
-          @statuses.push({
-            text: "Your profile's Lightning address is set to <strong>#{ user_address }</strong>",
-            icon_name: "check-circle",
-            icon_color: "emerald-500"
-          })
-        else
-          @statuses.push({
-            text: "Your profile's Lightning address is not set to <strong>#{ user_address }</strong> yet",
-            icon_name: "alert-octagon",
-            icon_color: "amber-500"
-          })
-        end
-      else
-        @statuses.push({
-          text: "We could not find a profile for your public key",
-          icon_name: "alert-octagon",
-          icon_color: "amber-500"
-        })
-      end
-    end
-  end
-end
--- a/app/components/settings/nostr_relay_status_component.html.erb
+++ b/app/components/settings/nostr_relay_status_component.html.erb
@@ -1,18 +0,0 @@
-<%= render StatusTextComponent.new(
-  text: @text,
-  icon_name: @icon_name,
-  icon_color: @icon_color) %>
-
-<% if @status == 1 %>
-  <p class="mt-8">
-    <button class="btn-md btn-blue">
-      Add the relay to my list
-    </button>
-  </p>
-<% elsif @status == 2 %>
-  <p class="mt-8">
-    <button class="btn-md btn-blue">
-      Set up default relays
-    </button>
-  </p>
-<% end %>
--- a/app/components/settings/nostr_relay_status_component.rb
+++ b/app/components/settings/nostr_relay_status_component.rb
@@ -1,34 +0,0 @@
-# frozen_string_literal: true
-
-module Settings
-  class NostrRelayStatusComponent < ViewComponent::Base
-    def initialize(nip65_event:)
-      if nip65_event.present?
-        if relay_urls(nip65_event).any? { |r| r.include?("wss://nostr.kosmos.org") }
-          @text = "You have a relay list, and the Kosmos relay is part of it"
-          @icon_name = "check-circle"
-          @icon_color = "emerald-500"
-          @status = 0
-        else
-          @text = "The Kosmos relay is missing from your relay list"
-          @icon_name = "alert-octagon"
-          @icon_color = "amber-500"
-          @status = 1
-        end
-      else
-        @text = "We could not find a relay list for your public key"
-        @icon_name = "alert-octagon"
-        @icon_color = "amber-500"
-        @status = 2
-      end
-    end
-
-    private
-
-    def relay_urls(nip65_event)
-      nip65_event["tags"].select{ |t| t[0] == "r" }.map{ |t| t[1] }
-      # @inbox_relay_urls  = relay_tags&.select{ |t| t[2] == "read" }&.map{ |t| t[1] }
-      # @outbox_relay_urls = relay_tags&.select{ |t| t[2] != "read" }&.map{ |t| t[1] }
-    end
-  end
-end
--- a/app/components/status_text_component.html.erb
+++ b/app/components/status_text_component.html.erb
@@ -1,8 +0,0 @@
-<p class="flex gap-x-4 items-center">
-  <span class="inline-block h-6 w-6 grow-0 text-<%= @icon_color %>">
-    <%= render "icons/#{@icon_name}" %>
-  </span>
-  <span>
-    <%= raw @text %>
-  </span>
-</p>
--- a/app/components/status_text_component.rb
+++ b/app/components/status_text_component.rb
@@ -1,7 +0,0 @@
-class StatusTextComponent < ViewComponent::Base
-  def initialize(text:, icon_name:, icon_color:)
-    @text = text
-    @icon_name = icon_name
-    @icon_color = icon_color
-  end
-end
--- a/app/controllers/admin/donations_controller.rb
+++ b/app/controllers/admin/donations_controller.rb
@@ -8,7 +8,7 @@ class Admin::DonationsController < Admin::BaseController

    @stats = {
      overall_sats: @donations.sum("amount_sats"),
-      donor_count: Donation.completed.count(:user_id)
+      donor_count: @donations.distinct.count(:user_id)
    }
  end

--- a/app/controllers/admin/settings/registrations_controller.rb
+++ b/app/controllers/admin/settings/registrations_controller.rb
@@ -1,20 +1,12 @@
 class Admin::Settings::RegistrationsController < Admin::SettingsController
-  def show
+  def index
  end

-  def update
+  def create
    update_settings

    redirect_to admin_settings_registrations_path, flash: {
      success: "Settings saved"
    }
  end
-
-  private
-
-    def setting_params
-      params.require(:setting).permit([
-        :reserved_usernames, default_services: []
-      ])
-    end
 end
--- a/app/controllers/admin/settings/services_controller.rb
+++ b/app/controllers/admin/settings/services_controller.rb
@@ -1,32 +1,19 @@
 class Admin::Settings::ServicesController < Admin::SettingsController
-  before_action :set_service, only: [:show, :update]
-
  def index
-    redirect_to admin_settings_service_path("btcpay")
+    @service = params[:s]
+
+    if @service.blank?
+      redirect_to admin_settings_services_path(params: { s: "btcpay" })
+    end
  end

-  def show
-  end
+  def create
+    service = params.require(:service)

-  def update
    update_settings

-    redirect_to admin_settings_service_path(@service), flash: {
+    redirect_to admin_settings_services_path(params: { s: service }), flash: {
      success: "Settings saved"
    }
  end
-
-  private
-
-    def set_subsection
-      @subsection = "services"
-    end
-
-    def set_service
-      @service = params[:service]
-
-      if @service.blank?
-        redirect_to admin_settings_services_path and return
-      end
-    end
 end
--- a/app/controllers/admin/settings_controller.rb
+++ b/app/controllers/admin/settings_controller.rb
@@ -9,23 +9,22 @@ class Admin::SettingsController < Admin::BaseController
    changed_keys = []

    setting_params.keys.each do |key|
-      next if clean_param(key).nil? ||
-        (Setting.send(key).to_s == clean_param(key))
-
+      next if setting_params[key].nil? ||
+              (Setting.send(key).to_s == setting_params[key].strip)
      changed_keys.push(key)
      setting = Setting.new(var: key)
-      setting.value = clean_param(key)
+      setting.value = setting_params[key].strip
      unless setting.valid?
        @errors.merge!(setting.errors)
      end
    end

    if @errors.any?
-      render :show and return
+      render :index and return
    end

    changed_keys.each do |key|
-      Setting.send("#{key}=", clean_param(key))
+      Setting.send("#{key}=", setting_params[key].strip)
    end
  end

@@ -38,12 +37,4 @@ class Admin::SettingsController < Admin::BaseController
    def setting_params
      params.require(:setting).permit(Setting.editable_keys.map(&:to_sym))
    end
-
-    def clean_param(key)
-      if Setting.get_field(key)[:type] == :string
-        setting_params[key].strip
-      else
-        setting_params[key]
-      end
-    end
 end
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -63,9 +63,4 @@ class ApplicationController < ActionController::Base
    @fetch_balance_retried = true
    lndhub_fetch_balance
  end
-
-  def nostr_event_from_params
-    params.permit!
-    params[:signed_event].to_h.symbolize_keys
-  end
 end
--- a/app/controllers/contributions/donations_controller.rb
+++ b/app/controllers/contributions/donations_controller.rb
@@ -28,7 +28,6 @@ class Contributions::DonationsController < ApplicationController
    if params[:currency] == "sats"
      fiat_amount = nil
      fiat_currency = nil
-      amount_sats = params[:amount]
    else
      fiat_amount = params[:amount].to_i
      fiat_currency = params[:currency]
--- a/app/controllers/lnurlpay_controller.rb
+++ b/app/controllers/lnurlpay_controller.rb
@@ -1,15 +1,13 @@
 class LnurlpayController < ApplicationController
  before_action :check_service_available
  before_action :find_user
-  before_action :set_cors_access_control_headers

  MIN_SATS = 10
  MAX_SATS = 1_000_000
  MAX_COMMENT_CHARS = 100

-  # GET /.well-known/lnurlp/:username
  def index
-    res = {
+    render json: {
      status: "OK",
      callback: "https://#{Setting.accounts_domain}/lnurlpay/#{@user.cn}/invoice",
      tag: "payRequest",
@@ -18,16 +16,8 @@ class LnurlpayController < ApplicationController
      metadata: metadata(@user.address),
      commentAllowed: MAX_COMMENT_CHARS
    }
-
-    if Setting.nostr_enabled?
-      res[:allowsNostr] = true
-      res[:nostrPubkey] = Setting.nostr_public_key
-    end
-
-    render json: res
  end

-  # GET /.well-known/keysend/:username
  def keysend
    http_status :not_found and return unless Setting.lndhub_keysend_enabled?

@@ -42,9 +32,8 @@ class LnurlpayController < ApplicationController
    }
  end

-  # GET /lnurlpay/:username/invoice
  def invoice
-    amount = params[:amount].to_i / 1000 # msats to sats
+    amount = params[:amount].to_i / 1000 # msats
    comment = params[:comment] || ""
    address = @user.address

@@ -53,109 +42,53 @@ class LnurlpayController < ApplicationController
      return
    end

-    if params[:nostr].present? && Setting.nostr_enabled?
-      handle_zap_request amount, params[:nostr], params[:lnurl]
-    else
-      handle_pay_request address, amount, comment
+    if !valid_comment?(comment)
+      render json: { status: "ERROR", reason: "Comment too long" }
+      return
    end
+
+    memo = "To #{address}"
+    memo = "#{memo}: \"#{comment}\"" if comment.present?
+
+    payment_request = @user.ln_create_invoice({
+      amount: amount, # we create invoices in sats
+      memo: memo,
+      description_hash: Digest::SHA2.hexdigest(metadata(address)),
+    })
+
+    render json: {
+      status: "OK",
+      successAction: {
+        tag: "message",
+        message: "Sats received. Thank you!"
+      },
+      routes: [],
+      pr: payment_request
+    }
  end

  private

-    def set_cors_access_control_headers
-      headers['Access-Control-Allow-Origin'] = "*"
-      headers['Access-Control-Allow-Headers'] = "*"
-      headers['Access-Control-Allow-Methods'] = "GET"
-    end
+  def find_user
+    @user = User.where(cn: params[:username], ou: Setting.primary_domain).first
+    http_status :not_found if @user.nil?
+  end

-    def check_service_available
-      http_status :not_found unless Setting.lndhub_enabled?
-    end
+  def metadata(address)
+    "[[\"text/identifier\", \"#{address}\"], [\"text/plain\", \"Send sats, receive thanks.\"]]"
+  end

-    def find_user
-      @user = User.where(cn: params[:username], ou: Setting.primary_domain).first
-      http_status :not_found if @user.nil?
-    end
+  def valid_amount?(amount_in_sats)
+    amount_in_sats <= MAX_SATS && amount_in_sats >= MIN_SATS
+  end

-    def metadata(address)
-      "[[\"text/identifier\",\"#{address}\"],[\"text/plain\",\"Sats for #{address}\"]]"
-    end
+  def valid_comment?(comment)
+    comment.length <= MAX_COMMENT_CHARS
+  end

-    def valid_amount?(amount_in_sats)
-      amount_in_sats <= MAX_SATS && amount_in_sats >= MIN_SATS
-    end
+  private

-    def valid_comment?(comment)
-      comment.length <= MAX_COMMENT_CHARS
-    end
-
-    def handle_pay_request(address, amount, comment)
-      if !valid_comment?(comment)
-        render json: { status: "ERROR", reason: "Comment too long" }
-        return
-      end
-
-      desc = "To #{address}"
-      desc = "#{desc}: \"#{comment}\"" if comment.present?
-
-      invoice = LndhubManager::CreateUserInvoice.call(
-        user: @user, payload: {
-          amount: amount, # sats
-          description: desc,
-          description_hash: Digest::SHA256.hexdigest(metadata(address)),
-        }
-      )
-
-      render json: {
-        status: "OK",
-        successAction: {
-          tag: "message",
-          message: "Sats received. Thank you!"
-        },
-        routes: [],
-        pr: invoice["payment_request"]
-      }
-    end
-
-    def nostr_event_from_payload(nostr_param)
-      event_obj = JSON.parse(nostr_param).transform_keys(&:to_sym)
-      Nostr::Event.new(**event_obj)
-    rescue => e
-      return nil
-    end
-
-    def valid_zap_request?(amount, event, lnurl)
-      NostrManager::VerifyZapRequest.call(
-        amount: amount, event: event, lnurl: lnurl
-      )
-    end
-
-    def handle_zap_request(amount, nostr_param, lnurl_param)
-      event = nostr_event_from_payload(nostr_param)
-
-      unless event.present? && valid_zap_request?(amount*1000, event, lnurl_param)
-        render json: { status: "ERROR", reason: "Invalid zap request" }
-        return
-      end
-
-      # TODO might want to use the existing invoice and zap record if there are
-      # multiple calls with the same zap request
-
-      desc = "Zap for #{@user.address}"
-      desc = "#{desc}: \"#{event.content}\"" if event.content.present?
-
-      invoice = LndhubManager::CreateUserInvoice.call(
-        user: @user, payload: {
-          amount: amount, # sats
-          description: desc,
-          description_hash: Digest::SHA256.hexdigest(event.to_json),
-        }
-      )
-
-      @user.zaps.create! request: event,
-                         payment_request: invoice["payment_request"],
-                         amount: amount
-
-      render json: { status: "OK", pr: invoice["payment_request"] }
-    end
+  def check_service_available
+    http_status :not_found unless Setting.lndhub_enabled?
+  end
 end
--- a/app/controllers/services/chat_controller.rb
+++ b/app/controllers/services/chat_controller.rb
@@ -3,7 +3,7 @@ class Services::ChatController < Services::BaseController
  before_action :require_service_available

  def show
-    @service_enabled = current_user.service_enabled?(:ejabberd)
+    @service_enabled = current_user.services_enabled.include?(:xmpp)
  end

  private
--- a/app/controllers/services/mastodon_controller.rb
+++ b/app/controllers/services/mastodon_controller.rb
@@ -3,7 +3,7 @@ class Services::MastodonController < Services::BaseController
  before_action :require_service_available

  def show
-    @service_enabled = current_user.service_enabled?(:mastodon)
+    @service_enabled = current_user.services_enabled.include?(:mastodon)
  end

  private
--- a/app/controllers/services/remotestorage_controller.rb
+++ b/app/controllers/services/remotestorage_controller.rb
@@ -5,10 +5,11 @@ class Services::RemotestorageController < Services::BaseController

  # Dashboard
  def show
-    # unless current_user.service_enabled?(:remotestorage)
+    # unless current_user.services_enabled.include?(:remotestorage)
    #   redirect_to service_remotestorage_info_path
    # end
-    # @rs_apps_connected = current_user.remote_storage_authorizations.any?
+    @rs_auths = current_user.remote_storage_authorizations
+    # TODO sort by app name
  end

  private
--- a/app/controllers/services/rs_auths_controller.rb
+++ b/app/controllers/services/rs_auths_controller.rb
@@ -3,18 +3,13 @@ class Services::RsAuthsController < Services::BaseController
  before_action :require_feature_enabled
  before_action :require_service_available
  # before_action :require_service_enabled
-  before_action :find_rs_auth, only: [:destroy, :launch_app]
-
-  def index
-    @rs_auths = current_user.remote_storage_authorizations
-    # TODO sort by app name?
-  end
+  before_action :find_rs_auth

  def destroy
    @auth.destroy!

    respond_to do |format|
-      format.html do redirect_to apps_services_storage_url, flash: {
+      format.html do redirect_to services_storage_url, flash: {
        success: 'App authorization revoked'
      }
      end
--- a/app/controllers/settings_controller.rb
+++ b/app/controllers/settings_controller.rb
@@ -4,24 +4,15 @@ require "bcrypt"
 class SettingsController < ApplicationController
  before_action :authenticate_user!
  before_action :set_main_nav_section
-  before_action :set_settings_section, only: [
-    :show, :update, :update_email, :reset_email_password
-  ]
-  before_action :set_user, only: [
-    :show, :update, :update_email, :reset_email_password,
-    :fetch_nostr_user_metadata
-  ]
+  before_action :set_settings_section, only: [:show, :update, :update_email, :reset_email_password]
+  before_action :set_user, only: [:show, :update, :update_email, :reset_email_password]

  def index
    redirect_to setting_path(:profile)
  end

  def show
-    case @settings_section
-    when "lightning"
-      @notifications_enabled = @user.preferences[:lightning_notify_sats_received] != "disabled" ||
-                               @user.preferences[:lightning_notify_zap_received] != "disabled"
-    when "nostr"
+    if @settings_section == "experiments"
      session[:shared_secret] ||= SecureRandom.base64(12)
    end
  end
@@ -96,65 +87,44 @@ class SettingsController < ApplicationController
  end

  def set_nostr_pubkey
-    signed_event = Nostr::Event.new(**nostr_event_from_params)
+    signed_event = nostr_event_params[:signed_event].to_h.symbolize_keys
+    is_valid_id  = NostrManager::ValidateId.call(event: signed_event)
+    is_valid_sig = NostrManager::VerifySignature.call(event: signed_event)
+    is_correct_content = signed_event[:content] == "Connect my public key to #{current_user.address} (confirmation #{session[:shared_secret]})"

-    is_valid_sig  = signed_event.verify_signature
-    is_valid_auth = NostrManager::VerifyAuth.call(
-      event: signed_event,
-      challenge: session[:shared_secret]
-    )
-
-    unless is_valid_sig && is_valid_auth
+    unless is_valid_id && is_valid_sig && is_correct_content
      flash[:alert] = "Public key could not be verified"
      http_status :unprocessable_entity and return
    end

-    user_with_pubkey = LdapManager::FetchUserByNostrKey.call(pubkey: signed_event.pubkey)
+    pubkey_taken = User.all_except(current_user).where(
+      ou: current_user.ou, nostr_pubkey: signed_event[:pubkey]
+    ).any?

-    if user_with_pubkey.present? && (user_with_pubkey != current_user)
+    if pubkey_taken
      flash[:alert] = "Public key already in use for a different account"
      http_status :unprocessable_entity and return
    end

-    LdapManager::UpdateNostrKey.call(dn: current_user.dn, pubkey: signed_event.pubkey)
+    current_user.update! nostr_pubkey: signed_event[:pubkey]
    session[:shared_secret] = nil

    flash[:success] = "Public key verification successful"
    http_status :ok
+  rescue
+    flash[:alert] = "Public key could not be verified"
+    http_status :unprocessable_entity and return
  end

  # DELETE /settings/nostr_pubkey
  def remove_nostr_pubkey
-    # TODO require current pubkey or password to delete
-    LdapManager::UpdateNostrKey.call(dn: current_user.dn, pubkey: nil)
+    current_user.update! nostr_pubkey: nil

-    redirect_to setting_path(:nostr), flash: {
+    redirect_to setting_path(:experiments), flash: {
      success: 'Public key removed from account'
    }
  end

-  def fetch_nostr_user_metadata
-    if @user.nostr_pubkey.present?
-      outbox_relay_urls = nil
-
-      # if @nip65_event = NostrManager::DiscoverUserRelays.call(pubkey: @user.nostr_pubkey)
-      #   relay_tags = @nip65_event["tags"].select{ |t| t[0] == "r" }
-      #   outbox_relay_urls = relay_tags&.select{ |t| t[2] != "read" }&.map{ |t| t[1] }
-      # end
-
-      # @profile = NostrManager::DiscoverUserProfile.call(
-      #   pubkey: @user.nostr_pubkey,
-      #   relays: outbox_relay_urls
-      # )
-      @profile = {"content"=>"{\"name\":\"jimmy\",\"picture\":\"https://storage.kosmos.org/jimmy/public/shares/241028-1117-tony.jpg\",\"banner\":\"https://storage.kosmos.org/raucao/public/shares/240604-1517-1500x500.jpg\",\"nip05\":\"jimmy@kosmos.org\",\"lud16\":\"jimmy@kosmos.org\",\"pubkey\":\"07e188a1ff87ce171d517b8ed2bb7a31b1d3453a0db3b15379ec07b724d232f3\",\"display_name\":\"Jimmy\",\"displayName\":\"Jimmy\",\"about\":\"I don't exist. Follow at your own peril.\"}", "created_at"=>1730114246, "id"=>"6b15b1308a61ee837bd3b50319978314650e435891c259f4ea499f819f35a4f6", "kind"=>0, "pubkey"=>"07e188a1ff87ce171d517b8ed2bb7a31b1d3453a0db3b15379ec07b724d232f3", "sig"=>"4f681f4b95646bbf88a6eae9ca92c0f2ce5effecfa017556a23490f91a99243aedf81d956ee2466ed64fecb9a03b6b89cd80ff116df0178830977e203867d7ae", "tags"=>[]}
-      # @profile = {"content"=>"{\"name\":\"jimmy\",\"nip05\":\"jimmy@kosmos.org\",\"lud16\":\"jimmy@kosmos.org\",\"pubkey\":\"07e188a1ff87ce171d517b8ed2bb7a31b1d3453a0db3b15379ec07b724d232f3\",\"display_name\":\"Jimmy\",\"displayName\":\"Jimmy\",\"about\":\"I don't exist. Follow at your own peril.\"}", "created_at"=>1730114246, "id"=>"6b15b1308a61ee837bd3b50319978314650e435891c259f4ea499f819f35a4f6", "kind"=>0, "pubkey"=>"07e188a1ff87ce171d517b8ed2bb7a31b1d3453a0db3b15379ec07b724d232f3", "sig"=>"4f681f4b95646bbf88a6eae9ca92c0f2ce5effecfa017556a23490f91a99243aedf81d956ee2466ed64fecb9a03b6b89cd80ff116df0178830977e203867d7ae", "tags"=>[]}
-    else
-      @relays, @profile = [nil, nil]
-    end
-
-    render partial: 'nostr_user_metadata'
-  end
-
  private

    def set_main_nav_section
@@ -164,8 +134,8 @@ class SettingsController < ApplicationController
    def set_settings_section
      @settings_section = params[:section]
      allowed_sections = [
-        :profile, :account, :xmpp, :email,
-        :lightning, :remotestorage, :nostr
+        :profile, :account, :xmpp, :email, :lightning, :remotestorage,
+        :experiments
      ]

      unless allowed_sections.include?(@settings_section.to_sym)
@@ -178,9 +148,11 @@ class SettingsController < ApplicationController
    end

    def user_params
-      params.require(:user).permit(
-        :display_name, :avatar, preferences: UserPreferences.pref_keys
-      )
+      params.require(:user).permit(:display_name, :avatar, preferences: [
+        :lightning_notify_sats_received,
+        :remotestorage_notify_auth_created,
+        :xmpp_exchange_contacts_with_invitees
+      ])
    end

    def email_params
@@ -191,6 +163,12 @@ class SettingsController < ApplicationController
      params.require(:user).permit(:current_password)
    end

+    def nostr_event_params
+      params.permit(signed_event: [
+        :id, :pubkey, :created_at, :kind, :tags, :content, :sig
+      ])
+    end
+
    def generate_email_password
      characters = [('a'..'z'), ('A'..'Z'), (0..9)].map(&:to_a).flatten
      SecureRandom.random_bytes(16).each_byte.map { |b| characters[b % characters.length] }.join
--- a/app/controllers/users/sessions_controller.rb
+++ b/app/controllers/users/sessions_controller.rb
@@ -1,62 +0,0 @@
-# frozen_string_literal: true
-
-class Users::SessionsController < Devise::SessionsController
-  # before_action :configure_sign_in_params, only: [:create]
-
-  # GET /resource/sign_in
-  def new
-    session[:shared_secret] = SecureRandom.base64(12)
-    super
-  end
-
-  # POST /resource/sign_in
-  # def create
-  #   super
-  # end
-
-  # DELETE /resource/sign_out
-  # def destroy
-  #   super
-  # end
-
-  # POST /users/nostr_login
-  def nostr_login
-    signed_event = Nostr::Event.new(**nostr_event_from_params)
-
-    is_valid_sig  = signed_event.verify_signature
-    is_valid_auth = NostrManager::VerifyAuth.call(
-      event: signed_event,
-      challenge: session[:shared_secret]
-    )
-
-    session[:shared_secret] = nil
-
-    unless is_valid_sig && is_valid_auth
-      flash[:alert] = "Login verification failed"
-      http_status :unauthorized and return
-    end
-
-    user = LdapManager::FetchUserByNostrKey.call(pubkey: signed_event.pubkey)
-
-    if user.present?
-      set_flash_message!(:notice, :signed_in)
-      sign_in("user", user)
-      render json: { redirect_url: after_sign_in_path_for(user) }, status: :ok
-    else
-      flash[:alert] = "Failed to find your account. Nostr login may be disabled."
-      http_status :unauthorized
-    end
-  end
-
-  protected
-
-    def set_flash_message(key, kind, options = {})
-      # Hide flash message after redirecting from a signin route while logged in
-      super unless key == :alert && kind == "already_authenticated"
-    end
-
-  # If you have extra params to permit, append them to the sanitizer.
-  # def configure_sign_in_params
-  #   devise_parameter_sanitizer.permit(:sign_in, keys: [:attribute])
-  # end
-end
--- a/app/controllers/webfinger_controller.rb
+++ b/app/controllers/webfinger_controller.rb
@@ -1,19 +1,20 @@
-class WebfingerController < WellKnownController
+class WebfingerController < ApplicationController
  before_action :allow_cross_origin_requests, only: [:show]

+  layout false
+
  def show
    resource = params[:resource]

    if resource && @useraddress = resource.match(/acct:(.+)/)&.[](1)
-      @username, @domain = @useraddress.split("@")
+      @username, @org = @useraddress.split("@")

      unless Rails.env.development?
        # Allow different domains (e.g. localhost:3000) in development only
-        head 404 and return unless @domain == Setting.primary_domain
+        head 404 and return unless @org == Setting.primary_domain
      end

-      unless @user = User.where(ou: Setting.primary_domain)
-                         .find_by(cn: @username.downcase)
+      unless User.where(cn: @username.downcase, ou: Setting.primary_domain).any?
        head 404 and return
      end

@@ -27,60 +28,22 @@ class WebfingerController < WellKnownController
  private

  def webfinger
-    jrd = {
-      subject: "acct:#{@user.address}",
-      aliases: [],
-      links: []
-    }
+    links = [];

-    if Setting.mastodon_enabled && @user.service_enabled?(:mastodon)
-      # https://docs.joinmastodon.org/spec/webfinger/
-      jrd[:aliases] += mastodon_aliases
-      jrd[:links] += mastodon_links
-    end
+    # TODO check if storage service is enabled for user, not just globally
+    links << remotestorage_link if Setting.remotestorage_enabled

-    if Setting.remotestorage_enabled && @user.service_enabled?(:remotestorage)
-      # https://datatracker.ietf.org/doc/draft-dejong-remotestorage/
-      jrd[:links] << remotestorage_link
-    end
-
-    jrd
-  end
-
-  def mastodon_aliases
-    [
-      "#{Setting.mastodon_public_url}/@#{@user.cn}",
-      "#{Setting.mastodon_public_url}/users/#{@user.cn}"
-    ]
-  end
-
-  def mastodon_links
-    [
-      {
-        rel: "http://webfinger.net/rel/profile-page",
-        type: "text/html",
-        href: "#{Setting.mastodon_public_url}/@#{@user.cn}"
-      },
-      {
-        rel: "self",
-        type: "application/activity+json",
-        href: "#{Setting.mastodon_public_url}/users/#{@user.cn}"
-      },
-      {
-        rel: "http://ostatus.org/schema/1.0/subscribe",
-        template: "#{Setting.mastodon_public_url}/authorize_interaction?uri={uri}"
-      }
-    ]
+    { "links" => links }
  end

  def remotestorage_link
-    auth_url = new_rs_oauth_url(@username, host: Setting.accounts_domain)
+    auth_url = new_rs_oauth_url(@username)
    storage_url = "#{Setting.rs_storage_url}/#{@username}"

    {
-      rel: "http://tools.ietf.org/id/draft-dejong-remotestorage",
-      href: storage_url,
-      properties: {
+      "rel" => "http://tools.ietf.org/id/draft-dejong-remotestorage",
+      "href" => storage_url,
+      "properties" => {
        "http://remotestorage.io/spec/version" => "draft-dejong-remotestorage-13",
        "http://tools.ietf.org/html/rfc6749#section-4.2" => auth_url,
        "http://tools.ietf.org/html/rfc6750#section-2.3" => nil, # access token via a HTTP query parameter
@@ -89,4 +52,10 @@ class WebfingerController < WellKnownController
      }
    }
  end
+
+  def allow_cross_origin_requests
+    return unless Rails.env.development?
+    headers['Access-Control-Allow-Origin'] = "*"
+    headers['Access-Control-Allow-Methods'] = "GET"
+  end
 end
--- a/app/controllers/webhooks_controller.rb
+++ b/app/controllers/webhooks_controller.rb
@@ -2,76 +2,45 @@ class WebhooksController < ApplicationController
  skip_forgery_protection

  before_action :authorize_request
-  before_action :process_payload

  def lndhub
-    @user = User.find_by!(ln_account: @payload[:user_login])
-
-    if @zap = @user.zaps.find_by(payment_request: @payload[:payment_request])
-      settled_at = Time.parse(@payload[:settled_at])
-      zap_receipt = NostrManager::CreateZapReceipt.call(
-        zap: @zap,
-        paid_at: settled_at.to_i,
-        preimage: @payload[:preimage]
-      )
-      @zap.update! settled_at: settled_at, receipt: zap_receipt.to_h
-      NostrManager::PublishZapReceipt.call(zap: @zap)
+    begin
+      payload = JSON.parse(request.body.read, symbolize_names: true)
+      head :no_content and return unless payload[:type] == "incoming"
+    rescue
+      head :unprocessable_entity and return
    end

-    send_notifications
+    user = User.find_by!(ln_account: payload[:user_login])
+    notify = user.preferences[:lightning_notify_sats_received]
+    case notify
+    when "xmpp"
+      notify_xmpp(user.address, payload[:amount], payload[:memo])
+    when "email"
+      NotificationMailer.with(user: user, amount_sats: payload[:amount])
+                        .lightning_sats_received.deliver_later
+    end

    head :ok
  end

  private

+  # TODO refactor into mailer-like generic class/service
+  def notify_xmpp(address, amt_sats, memo)
+    payload = {
+      type: "normal",
+      from: Setting.xmpp_notifications_from_address,
+      to: address,
+      subject: "Sats received!",
+      body: "#{helpers.number_with_delimiter amt_sats} sats received in your Lightning wallet:\n> #{memo}"
+    }
+    XmppSendMessageJob.perform_later(payload)
+  end
+
  def authorize_request
    if !ENV['WEBHOOKS_ALLOWED_IPS'].split(',').include?(request.remote_ip)
      head :forbidden and return
    end
  end
-
-  def process_payload
-    @payload = JSON.parse(request.body.read, symbolize_names: true)
-    unless @payload[:type] == "incoming" &&
-           @payload[:state] == "settled"
-      head :no_content and return
-    end
-  rescue
-    head :unprocessable_entity and return
-  end
-
-  def send_notifications
-    return if @payload[:amount] < @user.preferences[:lightning_notify_min_sats]
-
-    if @user.preferences[:lightning_notify_only_with_message]
-      return if @payload[:memo].blank?
-    end
-
-    target = @zap.present? ? @user.preferences[:lightning_notify_zap_received] :
-                             @user.preferences[:lightning_notify_sats_received]
-
-    case target
-    when "xmpp"
-      notify_xmpp
-    when "email"
-      notify_email
-    end
-  end
-
-  # TODO refactor into mailer-like generic class/service
-  def notify_xmpp
-    XmppSendMessageJob.perform_later({
-      type: "normal",
-      from: Setting.xmpp_notifications_from_address,
-      to: @user.address,
-      subject: "Sats received!",
-      body: "#{helpers.number_with_delimiter @payload[:amount]} sats received in your Lightning wallet:\n> #{@payload[:memo]}"
-    })
-  end
-
-  def notify_email
-    NotificationMailer.with(user: @user, amount_sats: @payload[:amount])
-                      .lightning_sats_received.deliver_later
-  end
 end
--- a/app/controllers/well_known_controller.rb
+++ b/app/controllers/well_known_controller.rb
@@ -1,47 +1,16 @@
 class WellKnownController < ApplicationController
-  before_action :require_nostr_enabled, only: [ :nostr ]
-  before_action :allow_cross_origin_requests, only: [ :nostr ]
-
-  layout false
-
  def nostr
    http_status :unprocessable_entity and return if params[:name].blank?
    domain = request.headers["X-Forwarded-Host"].presence || Setting.primary_domain
-    relay_url = Setting.nostr_relay_url.presence
-
-    if params[:name] == "_"
-      if domain == Setting.primary_domain
-        # pubkey for the primary domain without a username (e.g. kosmos.org)
-        res = { names: { "_": Setting.nostr_public_key_primary_domain.presence || Setting.nostr_public_key } }
-      else
-        # pubkey for the akkounts domain without a username (e.g. accounts.kosmos.org)
-        res = { names: { "_": Setting.nostr_public_key } }
-      end
-
-      res[:relays] = { "_" => [ relay_url ] } if relay_url
-    else
-      @user = User.where(cn: params[:name], ou: domain).first
-      http_status :not_found and return if @user.nil? || @user.nostr_pubkey.blank?
-
-      res = { names: { @user.cn => @user.nostr_pubkey } }
-      res[:relays] = { @user.nostr_pubkey => [ relay_url ] } if relay_url
-    end
+    @user = User.where(cn: params[:name], ou: domain).first
+    http_status :not_found and return if @user.nil? || @user.nostr_pubkey.blank?

    respond_to do |format|
      format.json do
-        render json: res.to_json
+        render json: {
+          names: { "#{@user.cn}": @user.nostr_pubkey }
+        }.to_json
      end
    end
  end
-
-  private
-
-    def require_nostr_enabled
-      http_status :not_found unless Setting.nostr_enabled?
-    end
-
-    def allow_cross_origin_requests
-      headers['Access-Control-Allow-Origin'] = "*"
-      headers['Access-Control-Allow-Methods'] = "GET"
-    end
 end
--- a/app/helpers/dashboard_helper.rb
+++ b/app/helpers/dashboard_helper.rb
@@ -0,0 +1,2 @@
+module DashboardHelper
+end
--- a/app/helpers/donations_helper.rb
+++ b/app/helpers/donations_helper.rb
@@ -0,0 +1,2 @@
+module DonationsHelper
+end
--- a/app/helpers/invitations_helper.rb
+++ b/app/helpers/invitations_helper.rb
@@ -0,0 +1,2 @@
+module InvitationsHelper
+end
--- a/app/helpers/lnurlpay_helper.rb
+++ b/app/helpers/lnurlpay_helper.rb
@@ -0,0 +1,2 @@
+module LnurlpayHelper
+end
--- a/app/helpers/services_helper.rb
+++ b/app/helpers/services_helper.rb
@@ -1,12 +0,0 @@
-module ServicesHelper
-
-  def service_human_name(key, category = :external)
-    SERVICES[category][key][:name] || key.to_s
-  end
-
-  def service_display_name(key, category = :external)
-    SERVICES[category][key][:display_name] ||
-    service_human_name(key, category)
-  end
-
-end
--- a/app/helpers/settings_helper.rb
+++ b/app/helpers/settings_helper.rb
@@ -0,0 +1,2 @@
+module SettingsHelper
+end
--- a/app/helpers/signup_helper.rb
+++ b/app/helpers/signup_helper.rb
@@ -0,0 +1,2 @@
+module SignupHelper
+end
--- a/app/helpers/users_helper.rb
+++ b/app/helpers/users_helper.rb
@@ -0,0 +1,2 @@
+module UsersHelper
+end
--- a/app/helpers/wallet_helper.rb
+++ b/app/helpers/wallet_helper.rb
@@ -0,0 +1,2 @@
+module WalletHelper
+end
--- a/app/helpers/welcome_helper.rb
+++ b/app/helpers/welcome_helper.rb
@@ -0,0 +1,2 @@
+module WelcomeHelper
+end
--- a/app/javascript/controllers/nostr_login_controller.js
+++ b/app/javascript/controllers/nostr_login_controller.js
@@ -1,53 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-
-// Connects to data-controller="nostr-login"
-export default class extends Controller {
-  static targets = [ "loginForm", "loginButton" ]
-  static values  = { site: String, sharedSecret: String }
-
-  connect() {
-    if (window.nostr) {
-      this.loginButtonTarget.disabled = false
-      this.loginFormTarget.classList.remove("hidden")
-    }
-  }
-
-  async login () {
-    this.loginButtonTarget.disabled = true
-
-    try {
-      // Auth based on NIP-42
-      const signedEvent = await window.nostr.signEvent({
-        created_at: Math.floor(Date.now() / 1000),
-        kind: 22242,
-        tags: [
-          ["site", this.siteValue],
-          ["challenge", this.sharedSecretValue]
-        ],
-        content: ""
-      })
-
-      const res = await fetch("/users/nostr_login", {
-        method: "POST", credentials: "include", headers: {
-          "Accept": "application/json", 'Content-Type': 'application/json',
-          "X-CSRF-Token": this.csrfToken
-        }, body: JSON.stringify({ signed_event: signedEvent })
-      })
-
-      if (res.status === 200) {
-        res.json().then(r => { window.location.href = r.redirect_url })
-      } else {
-        window.location.reload()
-      }
-    } catch (error) {
-      console.warn('Unable to authenticate:', error.message)
-    } finally {
-      this.loginButtonTarget.disabled = false
-    }
-  }
-
-  get csrfToken () {
-    const element = document.head.querySelector('meta[name="csrf-token"]')
-    return element.getAttribute("content")
-  }
-}
--- a/app/javascript/controllers/settings/nostr_pubkey_controller.js
+++ b/app/javascript/controllers/settings/nostr_pubkey_controller.js
@@ -3,12 +3,7 @@ import { Controller } from "@hotwired/stimulus"
 // Connects to data-controller="settings--nostr-pubkey"
 export default class extends Controller {
  static targets = [ "noExtension", "setPubkey", "pubkeyBech32Input" ]
-  static values  = {
-    userAddress: String,
-    pubkeyHex: String,
-    site: String,
-    sharedSecret: String
-  }
+  static values  = { userAddress: String, pubkeyHex: String, sharedSecret: String }

  connect () {
    if (window.nostr) {
@@ -24,15 +19,11 @@ export default class extends Controller {
    this.setPubkeyTarget.disabled = true

    try {
-      // Auth based on NIP-42
      const signedEvent = await window.nostr.signEvent({
        created_at: Math.floor(Date.now() / 1000),
-        kind: 22242,
-        tags: [
-          ["site", this.siteValue],
-          ["challenge", this.sharedSecretValue]
-        ],
-        content: ""
+        kind: 1,
+        tags: [],
+        content: `Connect my public key to ${this.userAddressValue} (confirmation ${this.sharedSecretValue})`
      })

      const res = await fetch("/settings/set_nostr_pubkey", {
--- a/app/jobs/create_ldap_user_job.rb
+++ b/app/jobs/create_ldap_user_job.rb
@@ -1,7 +1,7 @@
 class CreateLdapUserJob < ApplicationJob
  queue_as :default

-  def perform(username:, domain:, email:, hashed_pw:, confirmed: false)
+  def perform(username, domain, email, hashed_pw)
    dn = "cn=#{username},ou=#{domain},cn=users,dc=kosmos,dc=org"
    attr = {
      objectclass: ["top", "account", "person", "extensibleObject"],
@@ -12,10 +12,6 @@ class CreateLdapUserJob < ApplicationJob
      userPassword: hashed_pw
    }

-    if confirmed
-      attr[:serviceEnabled] = Setting.default_services
-    end
-
    ldap_client.add(dn: dn, attributes: attr)
  end

--- a/app/jobs/nostr_publish_event_job.rb
+++ b/app/jobs/nostr_publish_event_job.rb
@@ -1,7 +0,0 @@
-class NostrPublishEventJob < ApplicationJob
-  queue_as :nostr
-
-  def perform(event:, relay_url:)
-    NostrManager::PublishEvent.call(event: event, relay_url: relay_url)
-  end
-end
--- a/app/jobs/xmpp_exchange_contacts_job.rb
+++ b/app/jobs/xmpp_exchange_contacts_job.rb
@@ -2,8 +2,8 @@ class XmppExchangeContactsJob < ApplicationJob
  queue_as :default

  def perform(inviter, invitee)
-    return unless inviter.service_enabled?(:ejabberd) &&
-                  invitee.service_enabled?(:ejabberd) &&
+    return unless inviter.services_enabled.include?("xmpp") &&
+                  invitee.services_enabled.include?("xmpp") &&
                  inviter.preferences[:xmpp_exchange_contacts_with_invitees]

    ejabberd = EjabberdApiClient.new
--- a/app/models/app_catalog/web_app.rb
+++ b/app/models/app_catalog/web_app.rb
@@ -1,7 +1,7 @@
 class AppCatalog::WebApp < ApplicationRecord
  store :metadata, coder: JSON

-  has_many :remote_storage_authorizations, dependent: :destroy
+  has_many :remote_storage_authorizations

  has_one_attached :icon
  has_one_attached :apple_touch_icon
--- a/app/models/concerns/settings/btcpay_settings.rb
+++ b/app/models/concerns/settings/btcpay_settings.rb
@@ -1,24 +0,0 @@
-module Settings
-  module BtcpaySettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :btcpay_api_url, type: :string,
-        default: ENV["BTCPAY_API_URL"].presence
-
-      field :btcpay_enabled, type: :boolean,
-        default: ENV["BTCPAY_API_URL"].present?
-
-      field :btcpay_public_url, type: :string,
-        default: ENV["BTCPAY_PUBLIC_URL"].presence
-
-      field :btcpay_store_id, type: :string,
-        default: ENV["BTCPAY_STORE_ID"].presence
-
-      field :btcpay_auth_token, type: :string,
-        default: ENV["BTCPAY_AUTH_TOKEN"].presence
-
-      field :btcpay_publish_wallet_balances, type: :boolean, default: true
-    end
-  end
-end
--- a/app/models/concerns/settings/discourse_settings.rb
+++ b/app/models/concerns/settings/discourse_settings.rb
@@ -1,16 +0,0 @@
-module Settings
-  module DiscourseSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :discourse_public_url, type: :string,
-        default: ENV["DISCOURSE_PUBLIC_URL"].presence
-
-      field :discourse_enabled, type: :boolean,
-        default: ENV["DISCOURSE_PUBLIC_URL"].present?
-
-      field :discourse_connect_secret, type: :string,
-        default: ENV["DISCOURSE_CONNECT_SECRET"].presence
-    end
-  end
-end
--- a/app/models/concerns/settings/drone_ci_settings.rb
+++ b/app/models/concerns/settings/drone_ci_settings.rb
@@ -1,13 +0,0 @@
-module Settings
-  module DroneCiSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :droneci_public_url, type: :string,
-        default: ENV["DRONECI_PUBLIC_URL"].presence
-
-      field :droneci_enabled, type: :boolean,
-        default: ENV["DRONECI_PUBLIC_URL"].present?
-    end
-  end
-end
--- a/app/models/concerns/settings/ejabberd_settings.rb
+++ b/app/models/concerns/settings/ejabberd_settings.rb
@@ -1,19 +0,0 @@
-module Settings
-  module EjabberdSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :ejabberd_enabled, type: :boolean,
-        default: ENV["EJABBERD_API_URL"].present?
-
-      field :ejabberd_api_url, type: :string,
-        default: ENV["EJABBERD_API_URL"].presence
-
-      field :ejabberd_admin_url, type: :string,
-        default: ENV["EJABBERD_ADMIN_URL"].presence
-
-      field :ejabberd_buddy_roster, type: :string,
-        default: "Buddies"
-    end
-  end
-end
--- a/app/models/concerns/settings/email_settings.rb
+++ b/app/models/concerns/settings/email_settings.rb
@@ -1,28 +0,0 @@
-module Settings
-  module EmailSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :email_enabled, type: :boolean,
-        default: ENV["EMAIL_SMTP_HOST"].present?
-
-      # field :email_smtp_host, type: :string,
-      #   default: ENV["EMAIL_SMTP_HOST"].presence
-      #
-      # field :email_smtp_port, type: :string,
-      #   default: ENV["EMAIL_SMTP_PORT"].presence || 587
-      #
-      # field :email_smtp_enable_starttls, type: :string,
-      #   default: ENV["EMAIL_SMTP_PORT"].presence || true
-      #
-      # field :email_auth_method, type: :string,
-      #   default: ENV["EMAIL_AUTH_METHOD"].presence || "plain"
-      #
-      # field :email_imap_host, type: :string,
-      #   default: ENV["EMAIL_IMAP_HOST"].presence
-      #
-      # field :email_imap_port, type: :string,
-      #   default: ENV["EMAIL_IMAP_PORT"].presence || 993
-    end
-  end
-end
--- a/app/models/concerns/settings/general_settings.rb
+++ b/app/models/concerns/settings/general_settings.rb
@@ -1,34 +0,0 @@
-module Settings
-  module GeneralSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :primary_domain, type: :string,
-        default: ENV["PRIMARY_DOMAIN"].presence
-
-      field :accounts_domain, type: :string,
-        default: ENV["AKKOUNTS_DOMAIN"].presence
-
-      #
-      # Internal services
-      #
-
-      field :redis_url, type: :string,
-        default: ENV["REDIS_URL"] || "redis://localhost:6379/0"
-
-      field :s3_enabled, type: :boolean,
-        default: ENV["S3_ENABLED"] && ENV["S3_ENABLED"].to_s != "false"
-
-      field :sentry_enabled, type: :boolean, readonly: true,
-        default: ENV["SENTRY_DSN"].present?
-
-      #
-      # Registrations
-      #
-
-      field :reserved_usernames, type: :array, default: %w[
-        account accounts donations mail webmaster support
-      ]
-    end
-  end
-end
--- a/app/models/concerns/settings/gitea_settings.rb
+++ b/app/models/concerns/settings/gitea_settings.rb
@@ -1,13 +0,0 @@
-module Settings
-  module GiteaSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :gitea_public_url, type: :string,
-        default: ENV["GITEA_PUBLIC_URL"].presence
-
-      field :gitea_enabled, type: :boolean,
-        default: ENV["GITEA_PUBLIC_URL"].present?
-    end
-  end
-end
--- a/app/models/concerns/settings/lightning_network_settings.rb
+++ b/app/models/concerns/settings/lightning_network_settings.rb
@@ -1,25 +0,0 @@
-module Settings
-  module LightningNetworkSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :lndhub_api_url, type: :string,
-        default: ENV["LNDHUB_API_URL"].presence
-
-      field :lndhub_enabled, type: :boolean,
-        default: ENV["LNDHUB_API_URL"].present?
-
-      field :lndhub_admin_token, type: :string,
-        default: ENV["LNDHUB_ADMIN_TOKEN"].presence
-
-      field :lndhub_admin_enabled, type: :boolean,
-        default: ENV["LNDHUB_ADMIN_UI"] || false
-
-      field :lndhub_public_key, type: :string,
-        default: (ENV["LNDHUB_PUBLIC_KEY"] || "")
-
-      field :lndhub_keysend_enabled, type: :boolean,
-        default: -> { self.lndhub_public_key.present? }
-    end
-  end
-end
--- a/app/models/concerns/settings/mastodon_settings.rb
+++ b/app/models/concerns/settings/mastodon_settings.rb
@@ -1,16 +0,0 @@
-module Settings
-  module MastodonSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :mastodon_public_url, type: :string,
-        default: ENV["MASTODON_PUBLIC_URL"].presence
-
-      field :mastodon_enabled, type: :boolean,
-        default: ENV["MASTODON_PUBLIC_URL"].present?
-
-      field :mastodon_address_domain, type: :string,
-        default: ENV["MASTODON_ADDRESS_DOMAIN"].presence || self.primary_domain
-    end
-  end
-end
--- a/app/models/concerns/settings/media_wiki_settings.rb
+++ b/app/models/concerns/settings/media_wiki_settings.rb
@@ -1,13 +0,0 @@
-module Settings
-  module MediaWikiSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :mediawiki_public_url, type: :string,
-        default: ENV["MEDIAWIKI_PUBLIC_URL"].presence
-
-      field :mediawiki_enabled, type: :boolean,
-        default: ENV["MEDIAWIKI_PUBLIC_URL"].present?
-    end
-  end
-end
--- a/app/models/concerns/settings/nostr_settings.rb
+++ b/app/models/concerns/settings/nostr_settings.rb
@@ -1,38 +0,0 @@
-module Settings
-  module NostrSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :nostr_enabled, type: :boolean,
-        default: ENV["NOSTR_PRIVATE_KEY"].present?
-
-      field :nostr_private_key, type: :string,
-        default: ENV["NOSTR_PRIVATE_KEY"].presence
-
-      field :nostr_public_key, type: :string,
-        default: ENV["NOSTR_PUBLIC_KEY"].presence
-
-      field :nostr_public_key_primary_domain, type: :string,
-        default: ENV["NOSTR_PUBLIC_KEY_PRIMARY_DOMAIN"].presence
-
-      field :nostr_relay_url, type: :string,
-        default: ENV["NOSTR_RELAY_URL"].presence
-
-      field :nostr_zaps_relay_limit, type: :integer,
-        default: 12
-
-      field :nostr_discovery_relays, type: :array, default: %w[
-        wss://nostr.kosmos.org
-        wss://purplepag.es
-        wss://relay.nostr.band
-        wss://njump.me
-        wss://relay.damus.io
-      ]
-
-      def self.nostr_relay_url_http
-        self.nostr_relay_url.gsub(/^ws:/, "http:")
-                            .gsub(/^wss:/, "https:")
-      end
-    end
-  end
-end
--- a/app/models/concerns/settings/open_collective_settings.rb
+++ b/app/models/concerns/settings/open_collective_settings.rb
@@ -1,9 +0,0 @@
-module Settings
-  module OpenCollectiveSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :opencollective_enabled, type: :boolean, default: true
-    end
-  end
-end
--- a/app/models/concerns/settings/remote_storage_settings.rb
+++ b/app/models/concerns/settings/remote_storage_settings.rb
@@ -1,16 +0,0 @@
-module Settings
-  module RemoteStorageSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :remotestorage_enabled, type: :boolean,
-        default: ENV["RS_STORAGE_URL"].present?
-
-      field :rs_storage_url, type: :string,
-        default: ENV["RS_STORAGE_URL"].presence
-
-      field :rs_redis_url, type: :string,
-        default: ENV["RS_REDIS_URL"] || "redis://localhost:6379/1"
-    end
-  end
-end
--- a/app/models/concerns/settings/xmpp_settings.rb
+++ b/app/models/concerns/settings/xmpp_settings.rb
@@ -1,11 +0,0 @@
-module Settings
-  module XmppSettings
-    extend ActiveSupport::Concern
-
-    included do
-      field :xmpp_default_rooms, type: :array, default: []
-      field :xmpp_autojoin_default_rooms, type: :boolean, default: false
-      field :xmpp_notifications_from_address, type: :string, default: primary_domain
-    end
-  end
-end
--- a/app/models/setting.rb
+++ b/app/models/setting.rb
@@ -2,30 +2,205 @@
 class Setting < RailsSettings::Base
  cache_prefix { "v1" }

-  Dir[Rails.root.join('app', 'models', 'concerns', 'settings', '*.rb')].each do |file|
-    require file
-  end
+  field :primary_domain, type: :string,
+    default: ENV["PRIMARY_DOMAIN"].presence

-  include Settings::GeneralSettings
-  include Settings::BtcpaySettings
-  include Settings::DiscourseSettings
-  include Settings::DroneCiSettings
-  include Settings::EjabberdSettings
-  include Settings::EmailSettings
-  include Settings::GiteaSettings
-  include Settings::LightningNetworkSettings
-  include Settings::MastodonSettings
-  include Settings::MediaWikiSettings
-  include Settings::NostrSettings
-  include Settings::OpenCollectiveSettings
-  include Settings::RemoteStorageSettings
-  include Settings::XmppSettings
+  field :accounts_domain, type: :string,
+    default: ENV["AKKOUNTS_DOMAIN"].presence

-  def self.available_services
-    known_services = SERVICES[:external].keys
-    known_services.select {|s| Setting.send "#{s}_enabled?" }
-  end
+  #
+  # Internal services
+  #

-  field :default_services, type: :array,
-    default: self.available_services
+  field :redis_url, type: :string,
+    default: ENV["REDIS_URL"] || "redis://localhost:6379/0"
+
+  #
+  # Registrations
+  #
+
+  field :reserved_usernames, type: :array, default: %w[
+    account accounts donations mail webmaster support
+  ]
+
+  #
+  # XMPP
+  #
+
+  field :xmpp_default_rooms, type: :array, default: []
+  field :xmpp_autojoin_default_rooms, type: :boolean, default: false
+  field :xmpp_notifications_from_address, type: :string, default: primary_domain
+
+  #
+  # Sentry
+  #
+
+  field :sentry_enabled, type: :boolean, readonly: true,
+    default: ENV["SENTRY_DSN"].present?
+
+  #
+  # BTCPay Server
+  #
+
+  field :btcpay_api_url, type: :string,
+    default: ENV["BTCPAY_API_URL"].presence
+
+  field :btcpay_enabled, type: :boolean,
+    default: ENV["BTCPAY_API_URL"].present?
+
+  field :btcpay_public_url, type: :string,
+    default: ENV["BTCPAY_PUBLIC_URL"].presence
+
+  field :btcpay_store_id, type: :string,
+    default: ENV["BTCPAY_STORE_ID"].presence
+
+  field :btcpay_auth_token, type: :string,
+    default: ENV["BTCPAY_AUTH_TOKEN"].presence
+
+  field :btcpay_publish_wallet_balances, type: :boolean, default: true
+
+  #
+  # Discourse
+  #
+
+  field :discourse_public_url, type: :string,
+    default: ENV["DISCOURSE_PUBLIC_URL"].presence
+
+  field :discourse_enabled, type: :boolean,
+    default: ENV["DISCOURSE_PUBLIC_URL"].present?
+
+  field :discourse_connect_secret, type: :string,
+    default: ENV["DISCOURSE_CONNECT_SECRET"].presence
+
+  #
+  # Drone CI
+  #
+
+  field :droneci_public_url, type: :string,
+    default: ENV["DRONECI_PUBLIC_URL"].presence
+
+  field :droneci_enabled, type: :boolean,
+    default: ENV["DRONECI_PUBLIC_URL"].present?
+
+  #
+  # ejabberd
+  #
+
+  field :ejabberd_enabled, type: :boolean,
+    default: ENV["EJABBERD_API_URL"].present?
+
+  field :ejabberd_api_url, type: :string,
+    default: ENV["EJABBERD_API_URL"].presence
+
+  field :ejabberd_admin_url, type: :string,
+    default: ENV["EJABBERD_ADMIN_URL"].presence
+
+  field :ejabberd_buddy_roster, type: :string,
+    default: "Buddies"
+
+  #
+  # Gitea
+  #
+
+  field :gitea_public_url, type: :string,
+    default: ENV["GITEA_PUBLIC_URL"].presence
+
+  field :gitea_enabled, type: :boolean,
+    default: ENV["GITEA_PUBLIC_URL"].present?
+
+  #
+  # Lightning Network
+  #
+
+  field :lndhub_api_url, type: :string,
+    default: ENV["LNDHUB_API_URL"].presence
+
+  field :lndhub_enabled, type: :boolean,
+    default: ENV["LNDHUB_API_URL"].present?
+
+  field :lndhub_admin_token, type: :string,
+    default: ENV["LNDHUB_ADMIN_TOKEN"].presence
+
+  field :lndhub_admin_enabled, type: :boolean,
+    default: ENV["LNDHUB_ADMIN_UI"] || false
+
+  field :lndhub_public_key, type: :string,
+    default: (ENV["LNDHUB_PUBLIC_KEY"] || "")
+
+  field :lndhub_keysend_enabled, type: :boolean,
+    default: -> { self.lndhub_public_key.present? }
+
+  #
+  # Mastodon
+  #
+
+  field :mastodon_public_url, type: :string,
+    default: ENV["MASTODON_PUBLIC_URL"].presence
+
+  field :mastodon_enabled, type: :boolean,
+    default: ENV["MASTODON_PUBLIC_URL"].present?
+
+  field :mastodon_address_domain, type: :string,
+    default: ENV["MASTODON_ADDRESS_DOMAIN"].presence || self.primary_domain
+
+  #
+  # MediaWiki
+  #
+
+  field :mediawiki_public_url, type: :string,
+    default: ENV["MEDIAWIKI_PUBLIC_URL"].presence
+
+  field :mediawiki_enabled, type: :boolean,
+    default: ENV["MEDIAWIKI_PUBLIC_URL"].present?
+
+  #
+  # Nostr
+  #
+
+  field :nostr_enabled, type: :boolean, default: false
+
+  #
+  # OpenCollective
+  #
+
+  field :opencollective_enabled, type: :boolean, default: true
+
+  #
+  # RemoteStorage
+  #
+
+  field :remotestorage_enabled, type: :boolean,
+    default: ENV["RS_STORAGE_URL"].present?
+
+  field :rs_storage_url, type: :string,
+    default: ENV["RS_STORAGE_URL"].presence
+
+  field :rs_redis_url, type: :string,
+    default: ENV["RS_REDIS_URL"] || "redis://localhost:6379/1"
+
+
+  #
+  # E-Mail Service
+  #
+
+  field :email_enabled, type: :boolean,
+    default: ENV["EMAIL_SMTP_HOST"].present?
+
+  # field :email_smtp_host, type: :string,
+  #   default: ENV["EMAIL_SMTP_HOST"].presence
+  #
+  # field :email_smtp_port, type: :string,
+  #   default: ENV["EMAIL_SMTP_PORT"].presence || 587
+  #
+  # field :email_smtp_enable_starttls, type: :string,
+  #   default: ENV["EMAIL_SMTP_PORT"].presence || true
+  #
+  # field :email_auth_method, type: :string,
+  #   default: ENV["EMAIL_AUTH_METHOD"].presence || "plain"
+  #
+  # field :email_imap_host, type: :string,
+  #   default: ENV["EMAIL_IMAP_HOST"].presence
+  #
+  # field :email_imap_port, type: :string,
+  #   default: ENV["EMAIL_IMAP_PORT"].presence || 993
 end
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -17,15 +17,16 @@ class User < ApplicationRecord
  has_one  :invitation, inverse_of: :invitee, foreign_key: 'invited_user_id'
  has_one  :inviter, through: :invitation, source: :user
  has_many :invitees, through: :invitations
+
  has_many :donations, dependent: :nullify
-  has_many :remote_storage_authorizations
-  has_many :zaps

  has_one  :lndhub_user, class_name: "LndhubUser", inverse_of: "user",
                         primary_key: "ln_account", foreign_key: "login"

  has_many :accounts, through: :lndhub_user

+  has_many :remote_storage_authorizations
+
  #
  # Validations
  #
@@ -49,6 +50,8 @@ class User < ApplicationRecord
  validates_length_of :display_name, minimum: 3, maximum: 35, allow_blank: true,
                                     if: -> { defined?(@display_name) }

+  validates_uniqueness_of :nostr_pubkey, allow_blank: true
+
  validate :acceptable_avatar

  #
@@ -92,7 +95,9 @@ class User < ApplicationRecord
      LdapManager::UpdateEmail.call(dn: self.dn, address: self.email)
    else
      # E-Mail from signup confirmed (i.e. account activation)
-      enable_default_services
+
+      # TODO Make configurable, only activate globally enabled services
+      enable_service %w[ discourse gitea mediawiki xmpp ]

      # TODO enable in development when we have easy setup of ejabberd etc.
      return if Rails.env.development? || !Setting.ejabberd_enabled?
@@ -130,7 +135,7 @@ class User < ApplicationRecord

  def mastodon_address
    return nil unless Setting.mastodon_enabled?
-    "#{self.cn.gsub("-", "_")}@#{Setting.mastodon_address_domain}"
+    "#{self.cn}@#{Setting.mastodon_address_domain}"
  end

  def valid_attribute?(attribute_name)
@@ -138,8 +143,10 @@ class User < ApplicationRecord
    self.errors[attribute_name].blank?
  end

-  def enable_default_services
-    enable_service Setting.default_services
+  def ln_create_invoice(payload)
+    lndhub = Lndhub.new
+    lndhub.authenticate self
+    lndhub.addinvoice payload
  end

  def dn
@@ -156,45 +163,37 @@ class User < ApplicationRecord
    @display_name ||= ldap_entry[:display_name]
  end

-  def nostr_pubkey
-    @nostr_pubkey ||= ldap_entry[:nostr_key]
-  end
-
-  def nostr_pubkey_bech32
-    return nil unless nostr_pubkey.present?
-    Nostr::PublicKey.new(nostr_pubkey).to_bech32
-  end
-
  def avatar
    @avatar_base64 ||= LdapManager::FetchAvatar.call(cn: cn)
  end

  def services_enabled
-    ldap_entry[:services_enabled] || []
-  end
-
-  def service_enabled?(name)
-    services_enabled.map(&:to_sym).include?(name.to_sym)
+    ldap_entry[:service] || []
  end

  def enable_service(service)
    current_services = services_enabled
    new_services = Array(service).map(&:to_s)
-    services = (current_services + new_services).uniq.sort
-    ldap.replace_attribute(dn, :serviceEnabled, services)
+    services = (current_services + new_services).uniq
+    ldap.replace_attribute(dn, :service, services)
  end

  def disable_service(service)
    current_services = services_enabled
    disabled_services = Array(service).map(&:to_s)
-    services = (current_services - disabled_services).uniq.sort
-    ldap.replace_attribute(dn, :serviceEnabled, services)
+    services = (current_services - disabled_services).uniq
+    ldap.replace_attribute(dn, :service, services)
  end

  def disable_all_services
    ldap.delete_attribute(dn,:service)
  end

+  def nostr_pubkey_bech32
+    return nil unless nostr_pubkey.present?
+    Nostr::PublicKey.new(nostr_pubkey).to_bech32
+  end
+
  private

    def ldap
--- a/app/models/user_preferences.rb
+++ b/app/models/user_preferences.rb
@@ -26,8 +26,4 @@ class UserPreferences
    end
    hash.stringify_keys!.to_h
  end
-
-  def self.pref_keys
-    DEFAULT_PREFS.keys.map(&:to_sym)
-  end
 end
--- a/app/models/zap.rb
+++ b/app/models/zap.rb
@@ -1,20 +0,0 @@
-class Zap < ApplicationRecord
-  belongs_to :user
-
-  scope :settled, -> { where.not(settled_at: nil) }
-  scope :unpaid, -> { where(settled_at: nil) }
-
-  def request_event
-    nostr_event_from_hash(request)
-  end
-
-  def receipt_event
-    nostr_event_from_hash(receipt)
-  end
-
-  private
-
-    def nostr_event_from_hash(hash)
-      Nostr::Event.new(**hash.symbolize_keys)
-    end
-end
--- a/app/services/app_catalog_manager/update_metadata.rb
+++ b/app/services/app_catalog_manager/update_metadata.rb
@@ -18,10 +18,6 @@ module AppCatalogManager
        @app.metadata[prop] = metadata.send(prop) if prop
      end

-      @app.save!
-
-      # TODO move icon downloads to separate, async job
-
      if icon = metadata.select_icon(sizes: "256x256") ||
         icon = metadata.select_icon(sizes: "192x192")
        attach_remote_image(:icon, icon)
@@ -31,6 +27,8 @@ module AppCatalogManager
      if apple_touch_icon = metadata.select_icon(purpose: "apple-touch-icon")
        attach_remote_image(:apple_touch_icon, apple_touch_icon)
      end
+
+      @app.save!
    rescue Manifique::Error => e
      msg = "Fetching web app manifest failed for #{e.url}: #{e.type}"
      Rails.logger.warn(msg)
@@ -44,19 +42,14 @@ module AppCatalogManager
      else
        download_url = "#{@app.url}/#{icon["src"].gsub(/^\//,'')}"
      end
-      filename = "#{attachment_name}-#{Time.now.to_i}.png"
-      key = "web_apps/#{@app.id}/icons/#{filename}"
+      filename = "#{attachment_name}.png"
+      key = "web_apps/#{@app.id}/icons/#{attachment_name}.png"

      begin
        tempfile = Down.download(download_url)
        @app.send(attachment_name).attach(key: key, io: tempfile, filename: filename)
      rescue Down::NotFound
-        msg = "Download of \"#{attachment_name}\" failed: NotFound error for #{download_url}"
-        Rails.logger.warn(msg)
-        Sentry.capture_message(msg)
-      rescue => e
-        Rails.logger.warn "Saving attachment \"#{attachment_name}\" failed: \"#{e.message}\""
-        Sentry.capture_exception(e) if Setting.sentry_enabled?
+        Rails.logger.warn "Icon download failed: NotFound error for #{download_url}"
      end
    end
  end
--- a/app/services/create_account.rb
+++ b/app/services/create_account.rb
@@ -35,15 +35,11 @@ class CreateAccount < ApplicationService
    @invitation.update! invited_user_id: user_id, used_at: DateTime.now
  end

+  # TODO move to confirmation
+  # (and/or add email_confirmed to entry and use in login filter)
  def add_ldap_document
    hashed_pw = Devise.ldap_auth_password_builder.call(@password)
-    CreateLdapUserJob.perform_later(
-      username: @username,
-      domain: @domain,
-      email: @email,
-      hashed_pw: hashed_pw,
-      confirmed: @confirmed
-    )
+    CreateLdapUserJob.perform_later(@username, @domain, @email, hashed_pw)
  end

  def create_lndhub_account(user)
--- a/app/services/ldap_manager/fetch_avatar.rb
+++ b/app/services/ldap_manager/fetch_avatar.rb
@@ -9,7 +9,7 @@ module LdapManager
      attributes = %w{ jpegPhoto }
      filter     = Net::LDAP::Filter.eq("cn", @cn)

-      entry = client.search(base: treebase, filter: filter, attributes: attributes).first
+      entry = ldap_client.search(base: treebase, filter: filter, attributes: attributes).first
      entry.try(:jpegPhoto) ? entry.jpegPhoto.first : nil
    end
  end
--- a/app/services/ldap_manager/fetch_user_by_nostr_key.rb
+++ b/app/services/ldap_manager/fetch_user_by_nostr_key.rb
@@ -1,18 +0,0 @@
-module LdapManager
-  class FetchUserByNostrKey < LdapManagerService
-    def initialize(pubkey:)
-      @ou = Setting.primary_domain
-      @pubkey = pubkey
-    end
-
-    def call
-      treebase   = "ou=#{@ou},cn=users,#{ldap_suffix}"
-      attributes = %w{ cn }
-      filter     = Net::LDAP::Filter.eq("nostrKey", @pubkey)
-
-      entry = client.search(base: treebase, filter: filter, attributes: attributes).first
-
-      User.find_by cn: entry.cn, ou: @ou  unless entry.nil?
-    end
-  end
-end
--- a/app/services/ldap_manager/update_nostr_key.rb
+++ b/app/services/ldap_manager/update_nostr_key.rb
@@ -1,16 +0,0 @@
-module LdapManager
-  class UpdateNostrKey < LdapManagerService
-    def initialize(dn:, pubkey:)
-      @dn = dn
-      @pubkey = pubkey
-    end
-
-    def call
-      if @pubkey.present?
-        replace_attribute @dn, :nostrKey, @pubkey
-      else
-        delete_attribute @dn, :nostrKey
-      end
-    end
-  end
-end
--- a/app/services/ldap_manager_service.rb
+++ b/app/services/ldap_manager_service.rb
@@ -1,2 +1,5 @@
 class LdapManagerService < LdapService
+  def suffix
+    @suffix ||= ENV["LDAP_SUFFIX"] || "dc=kosmos,dc=org"
+  end
 end
--- a/app/services/ldap_service.rb
+++ b/app/services/ldap_service.rb
@@ -1,47 +1,41 @@
 class LdapService < ApplicationService
-  def modify(dn, operations=[])
-    client.modify dn: dn, operations: operations
-    client.get_operation_result.code
+  def initialize
+    @suffix = ENV["LDAP_SUFFIX"] || "dc=kosmos,dc=org"
  end

  def add_attribute(dn, attr, values)
-    client.add_attribute dn, attr, values
-    client.get_operation_result.code
+    ldap_client.add_attribute dn, attr, values
  end

  def replace_attribute(dn, attr, values)
-    client.replace_attribute dn, attr, values
-    client.get_operation_result.code
+    ldap_client.replace_attribute dn, attr, values
  end

  def delete_attribute(dn, attr)
-    client.delete_attribute dn, attr
-    client.get_operation_result.code
+    ldap_client.delete_attribute dn, attr
  end

  def add_entry(dn, attrs, interactive=false)
-    puts "Add entry: #{dn}" if interactive
-    client.add dn: dn, attributes: attrs
-    client.get_operation_result.code
+    puts "Adding entry: #{dn}" if interactive
+    res = ldap_client.add dn: dn, attributes: attrs
+    puts res.inspect if interactive && !res
+    res
  end

  def delete_entry(dn, interactive=false)
-    puts "Delete entry: #{dn}" if interactive
-    client.delete dn: dn
-    client.get_operation_result.code
+    puts "Deleting entry: #{dn}" if interactive
+    res = ldap_client.delete dn: dn
+    puts res.inspect if interactive && !res
+    res
  end

-  def delete_all_users!
-    delete_all_entries!(objectclass: "person")
-  end
-
-  def delete_all_entries!(objectclass: "*")
+  def delete_all_entries!
    if Rails.env.production?
      raise "Mass deletion of entries not allowed in production"
    end

-    filter  = Net::LDAP::Filter.eq("objectClass", objectclass)
-    entries = client.search(base: ldap_suffix, filter: filter, attributes: %w{dn})
+    filter  = Net::LDAP::Filter.eq("objectClass", "*")
+    entries = ldap_client.search(base: @suffix, filter: filter, attributes: %w{dn})
    entries.sort_by!{ |e| e.dn.length }.reverse!

    entries.each do |e|
@@ -51,18 +45,18 @@ class LdapService < ApplicationService

  def fetch_users(args={})
    if args[:ou]
-      treebase = "ou=#{args[:ou]},cn=users,#{ldap_suffix}"
+      treebase = "ou=#{args[:ou]},cn=users,#{@suffix}"
    else
      treebase = ldap_config["base"]
    end

    attributes = %w[
-      dn cn uid mail displayName admin serviceEnabled
-      mailRoutingAddress mailpassword nostrKey
+      dn cn uid mail displayName admin service
+      mailRoutingAddress mailpassword
    ]
    filter = Net::LDAP::Filter.eq("uid", args[:uid] || "*")

-    entries = client.search(base: treebase, filter: filter, attributes: attributes)
+    entries = ldap_client.search(base: treebase, filter: filter, attributes: attributes)
    entries.sort_by! { |e| e.cn[0] }
    entries = entries.collect do |e|
      {
@@ -70,10 +64,9 @@ class LdapService < ApplicationService
        mail: e.try(:mail) ? e.mail.first : nil,
        display_name: e.try(:displayName) ? e.displayName.first : nil,
        admin: e.try(:admin) ? 'admin' : nil,
-        services_enabled: e.try(:serviceEnabled),
+        service: e.try(:service),
        email_maildrop: e.try(:mailRoutingAddress),
-        email_password: e.try(:mailpassword),
-        nostr_key: e.try(:nostrKey) ? e.nostrKey.first : nil
+        email_password: e.try(:mailpassword)
      }
    end
  end
@@ -82,9 +75,9 @@ class LdapService < ApplicationService
    attributes = %w{dn ou description}
    filter     = Net::LDAP::Filter.eq("objectClass", "organizationalUnit")
    # filter     = Net::LDAP::Filter.eq("objectClass", "*")
-    treebase   = "cn=users,#{ldap_suffix}"
+    treebase   = "cn=users,#{@suffix}"

-    entries = client.search(base: treebase, filter: filter, attributes: attributes)
+    entries = ldap_client.search(base: treebase, filter: filter, attributes: attributes)

    entries.sort_by! { |e| e.ou[0] }

@@ -98,10 +91,10 @@ class LdapService < ApplicationService
  end

  def add_organization(ou, description, interactive=false)
-    dn = "ou=#{ou},cn=users,#{ldap_suffix}"
+    dn = "ou=#{ou},cn=users,#{@suffix}"

    aci = <<-EOS
-(target="ldap:///cn=*,ou=#{ou},cn=users,#{ldap_suffix}")(targetattr="cn || sn || uid || userPassword || mail || mailRoutingAddress || serviceEnabled || nostrKey || nsRole || objectClass") (version 3.0; acl "service-#{ou.gsub(".", "-")}-read-search"; allow (read,search) userdn="ldap:///uid=service,ou=#{ou},cn=applications,#{ldap_suffix}";)
+(target="ldap:///cn=*,ou=#{ou},cn=users,#{@suffix}")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "service-#{ou.gsub(".", "-")}-read-search"; allow (read,search) userdn="ldap:///uid=service,ou=#{ou},cn=applications,#{@suffix}";)
    EOS

    attrs = {
@@ -122,22 +115,22 @@ class LdapService < ApplicationService
    delete_all_entries!

    user_read_aci = <<-EOS
-(target="ldap:///#{ldap_suffix}")(targetattr="*") (version 3.0; acl "user-read-search-own-attributes"; allow (read,search) userdn="ldap:///self";)
+(target="ldap:///#{@suffix}")(targetattr="*") (version 3.0; acl "user-read-search-own-attributes"; allow (read,search) userdn="ldap:///self";)
    EOS

-    add_entry ldap_suffix, {
+    add_entry @suffix, {
      dc: "kosmos", objectClass: ["top", "domain"], aci: user_read_aci
    }, true

-    add_entry "cn=users,#{ldap_suffix}", {
+    add_entry "cn=users,#{@suffix}", {
       cn: "users", objectClass: ["top", "organizationalRole"]
    }, true
  end

  private

-  def client
-    client ||= Net::LDAP.new host: ldap_config['host'],
+  def ldap_client
+    ldap_client ||= Net::LDAP.new host: ldap_config['host'],
      port: ldap_config['port'],
      # TODO has to be :simple_tls if TLS is enabled
      # encryption: ldap_config['ssl'],
@@ -151,8 +144,4 @@ class LdapService < ApplicationService
  def ldap_config
    ldap_config ||= YAML.load(ERB.new(File.read("#{Rails.root}/config/ldap.yml")).result)[Rails.env]
  end
-
-  def ldap_suffix
-    @ldap_suffix ||= ENV["LDAP_SUFFIX"] || "dc=kosmos,dc=org"
-  end
 end
--- a/app/services/lndhub_manager/create_user_invoice.rb
+++ b/app/services/lndhub_manager/create_user_invoice.rb
@@ -1,13 +0,0 @@
-module LndhubManager
-  class CreateUserInvoice < LndhubV2
-    def initialize(user:, payload:)
-      @user = user
-      @payload = payload
-    end
-
-    def call
-      authenticate @user
-      create_invoice @payload
-    end
-  end
-end
--- a/app/services/nostr_manager/create_zap_receipt.rb
+++ b/app/services/nostr_manager/create_zap_receipt.rb
@@ -1,25 +0,0 @@
-module NostrManager
-  class CreateZapReceipt < NostrManagerService
-    def initialize(zap:, paid_at:, preimage:)
-      @zap, @paid_at, @preimage = zap, paid_at, preimage
-    end
-
-    def call
-      request_tags = parse_tags(@zap.request_event.tags)
-
-      site_user.create_event(
-        kind: 9735,
-        created_at: @paid_at,
-        content: "",
-        tags: [
-          ["p", request_tags[:p].first],
-          ["e", request_tags[:e]&.first],
-          ["a", request_tags[:a]&.first],
-          ["bolt11", @zap.payment_request],
-          ["preimage", @preimage],
-          ["description", @zap.request_event.to_json]
-        ].reject { |t| t[1].nil? }
-      )
-    end
-  end
-end
--- a/app/services/nostr_manager/discover_user_profile.rb
+++ b/app/services/nostr_manager/discover_user_profile.rb
@@ -1,21 +0,0 @@
-module NostrManager
-  class DiscoverUserProfile < NostrManagerService
-    def initialize(pubkey:, relays: nil)
-      @pubkey = pubkey
-      @relays = relays.present? ? relays : Setting.nostr_discovery_relays
-    end
-
-    def call
-      filter = Nostr::Filter.new(
-        authors: [@pubkey],
-        kinds: [0],
-        limit: 1,
-      )
-
-      NostrManager::FetchLatestEvent.call(
-        relays: @relays,
-        filter: filter
-      )
-    end
-  end
-end
--- a/app/services/nostr_manager/discover_user_relays.rb
+++ b/app/services/nostr_manager/discover_user_relays.rb
@@ -1,21 +0,0 @@
-module NostrManager
-  class DiscoverUserRelays < NostrManagerService
-    def initialize(pubkey:)
-      @pubkey = pubkey
-      @relays = Setting.nostr_discovery_relays
-    end
-
-    def call
-      filter = Nostr::Filter.new(
-        authors: [@pubkey],
-        kinds: [10002],
-        limit: 1,
-      )
-
-      NostrManager::FetchLatestEvent.call(
-        relays: @relays,
-        filter: filter
-      )
-    end
-  end
-end
--- a/app/services/nostr_manager/fetch_event.rb
+++ b/app/services/nostr_manager/fetch_event.rb
@@ -1,59 +0,0 @@
-module NostrManager
-  class FetchEvent < NostrManagerService
-    TIMEOUT = 10
-
-    def initialize(filter:, relay_url:)
-      @filter = filter
-      @relay = new_relay(relay_url)
-      @client = Nostr::Client.new
-    end
-
-    def call
-      filter, client, relay = @filter, @client, @relay
-      event = nil
-      mutex = Mutex.new
-      received_event = ConditionVariable.new
-      log_prefix = "[nostr][#{@relay.name}]"
-
-      thread = Thread.new do
-        client.on :connect do
-          client.subscribe(filter: filter)
-        end
-
-        client.on :error do |e|
-          Rails.logger.info "#{log_prefix} Error: #{e}"
-          Thread.current.exit
-        end
-
-        client.on :message do |m|
-          msg = JSON.parse(m) rescue nil
-          if msg && msg[0] == "EVENT" && msg[2]
-            Rails.logger.debug "#{log_prefix} Event received: #{msg[2]["id"]}"
-            mutex.synchronize do
-              event = msg[2]
-              received_event.signal
-            end
-          elsif msg && msg[0] == "EOSE"
-            Thread.current.exit
-          end
-        end
-
-        client.connect relay
-      end
-
-      begin
-        Timeout.timeout(TIMEOUT) do
-          mutex.synchronize do
-            received_event.wait(mutex) if event.nil?
-          end
-        end
-      rescue Timeout::Error
-        Rails.logger.debug "#{log_prefix} Timeout: No event received within #{TIMEOUT} seconds"
-      ensure
-        thread.exit
-      end
-
-      event
-    end
-  end
-end
--- a/app/services/nostr_manager/fetch_latest_event.rb
+++ b/app/services/nostr_manager/fetch_latest_event.rb
@@ -1,44 +0,0 @@
-module NostrManager
-  class FetchLatestEvent < NostrManagerService
-    TIMEOUT = 20
-
-    def initialize(relays:, filter:, max_events: 2)
-      @relays = relays
-      @filter = filter
-      @max_events = max_events
-    end
-
-    def call
-      received_events = 0
-      events = []
-
-      begin
-        Timeout.timeout(TIMEOUT) do
-          @relays.each do |url|
-            event = NostrManager::FetchEvent.call(filter: @filter, relay_url: url)
-
-            if event.present?
-              events << event if events.none? { |e| e["id"] == event["id"] }
-              received_events += 1
-            end
-
-            if received_events >= @max_events
-              Rails.logger.debug "Found #{@max_events} events, ending the search"
-              break
-            end
-          end
-
-          events.min_by { |e| e["created_at"] }
-        end
-      rescue Timeout::Error
-        if events.size == 1
-          Rails.logger.debug "[nostr] Timeout: only found 1 event within #{TIMEOUT} seconds for filter: #{@filter.inspect}"
-          events.first
-        else
-          Rails.logger.debug "[nostr] Timeout: no events found within #{TIMEOUT} seconds for filter: #{@filter.inspect}"
-          nil
-        end
-      end
-    end
-  end
-end
--- a/app/services/nostr_manager/publish_event.rb
+++ b/app/services/nostr_manager/publish_event.rb
@@ -1,50 +0,0 @@
-module NostrManager
-  class PublishEvent < NostrManagerService
-    def initialize(event:, relay_url:)
-      relay_name = URI.parse(relay_url).host
-      @relay = Nostr::Relay.new(url: relay_url, name: relay_name)
-
-      if event.is_a?(Nostr::Event)
-        @event = event
-      else
-        @event = Nostr::Event.new(**event.symbolize_keys)
-      end
-
-      @client = Nostr::Client.new
-    end
-
-    def call
-      client, relay, event = @client, @relay, @event
-      log_prefix = "[nostr][#{relay.name}]"
-
-      thread = Thread.new do
-        client.on :connect do
-          Rails.logger.debug "#{log_prefix} Publishing #{event.id}..."
-          client.publish event
-        end
-
-        client.on :error do |e|
-          Rails.logger.debug "#{log_prefix} Error: #{e}"
-          Rails.logger.debug "#{log_prefix} Closing thread..."
-          thread.exit
-        end
-
-        client.on :message do |m|
-          Rails.logger.debug "#{log_prefix} Message: #{m}"
-          msg = JSON.parse(m) rescue []
-          if msg[0] == "OK" && msg[1] == event.id && msg[2]
-            Rails.logger.debug "#{log_prefix} Event published. Closing thread..."
-          else
-            Rails.logger.debug "#{log_prefix} Unexpected message from relay. Closing thread..."
-          end
-          thread.exit
-        end
-
-        Rails.logger.debug "#{log_prefix} Connecting to #{relay.url}..."
-        client.connect relay
-      end
-
-      thread.join
-    end
-  end
-end
--- a/app/services/nostr_manager/publish_zap_receipt.rb
+++ b/app/services/nostr_manager/publish_zap_receipt.rb
@@ -1,24 +0,0 @@
-module NostrManager
-  class PublishZapReceipt < NostrManagerService
-    def initialize(zap:, delayed: true)
-      @zap, @delayed = zap, delayed
-    end
-
-    def call
-      tags = parse_tags(@zap.request_event.tags)
-      relays = tags[:relays].take(Setting.nostr_zaps_relay_limit)
-
-      if Setting.nostr_relay_url.present?
-        relays << Setting.nostr_relay_url
-      end
-
-      relays.uniq.each do |relay_url|
-        if @delayed
-          NostrPublishEventJob.perform_later(event: @zap.receipt, relay_url: relay_url)
-        else
-          NostrManager::PublishEvent.call(event: @zap.receipt_event, relay_url: relay_url)
-        end
-      end
-    end
-  end
-end
--- a/app/services/nostr_manager/validate_id.rb
+++ b/app/services/nostr_manager/validate_id.rb
@@ -0,0 +1,11 @@
+module NostrManager
+  class ValidateId < NostrManagerService
+    def initialize(event:)
+      @event = Nostr::Event.new(**event)
+    end
+
+    def call
+      @event.id == Digest::SHA256.hexdigest(JSON.generate(@event.serialize))
+    end
+  end
+end
--- a/app/services/nostr_manager/verify_auth.rb
+++ b/app/services/nostr_manager/verify_auth.rb
@@ -1,18 +0,0 @@
-module NostrManager
-  class VerifyAuth < NostrManagerService
-    def initialize(event:, challenge:)
-      @event = event
-      @challenge_expected = challenge
-      @site_expected = Setting.accounts_domain
-    end
-
-    def call
-      tags            = parse_tags(@event.tags)
-      site_given      = tags[:site].first
-      challenge_given = tags[:challenge].first
-
-      site_given == @site_expected &&
-      challenge_given == @challenge_expected
-    end
-  end
-end
--- a/app/services/nostr_manager/verify_signature.rb
+++ b/app/services/nostr_manager/verify_signature.rb
@@ -0,0 +1,17 @@
+module NostrManager
+  class VerifySignature < NostrManagerService
+    def initialize(event:)
+      @event = Nostr::Event.new(**event)
+    end
+
+    def call
+      Schnorr.check_sig!(
+        [@event.id].pack('H*'),
+        [@event.pubkey].pack('H*'),
+        [@event.sig].pack('H*')
+      )
+    rescue Schnorr::InvalidSignatureError
+      false
+    end
+  end
+end
--- a/app/services/nostr_manager/verify_zap_request.rb
+++ b/app/services/nostr_manager/verify_zap_request.rb
@@ -1,51 +0,0 @@
-module NostrManager
-  class VerifyZapRequest < NostrManagerService
-    def initialize(amount:, event:, lnurl: nil)
-      @amount, @event, @lnurl = amount, event, lnurl
-    end
-
-    # https://github.com/nostr-protocol/nips/blob/27fef638e2460139cc9078427a0aec0ce4470517/57.md#appendix-d-lnurl-server-zap-request-validation
-    def call
-      tags = parse_tags(@event.tags)
-
-      @event.verify_signature &&
-      @event.kind == 9734 &&
-      tags.present? &&
-      valid_p_tag?(tags[:p]) &&
-      valid_e_tag?(tags[:e]) &&
-      valid_a_tag?(tags[:a]) &&
-      valid_amount_tag?(tags[:amount]) &&
-      valid_lnurl_tag?(tags[:lnurl])
-    end
-
-    def valid_p_tag?(tag)
-      return false unless tag.present? && tag.length == 1
-      key = Nostr::PublicKey.new(tag.first) rescue nil
-      key.present?
-    end
-
-    def valid_e_tag?(tag)
-      return true unless tag.present?
-      # TODO validate format of event ID properly
-      tag.length == 1 && tag.first.is_a?(String)
-    end
-
-    def valid_a_tag?(tag)
-      return true unless tag.present?
-      # TODO validate format of event coordinate properly
-      tag.length == 1 && tag.first.is_a?(String)
-    end
-
-    def valid_amount_tag?(tag)
-      return true unless tag.present?
-      amount = tag.first
-      amount.is_a?(String) && amount.to_i == @amount
-    end
-
-    def valid_lnurl_tag?(tag)
-      return true unless tag.present?
-      # TODO validate lnurl matching recipient's lnurlp
-      tag.first.is_a?(String)
-    end
-  end
-end
--- a/app/services/nostr_manager_service.rb
+++ b/app/services/nostr_manager_service.rb
@@ -1,27 +1,4 @@
 require "nostr"

 class NostrManagerService < ApplicationService
-  def parse_tags(tags)
-    out = {}
-    # TODO support more than 1 item for each tag type
-    tags.each do |tag|
-      out[tag[0].to_sym] = tag[1, tag.length]
-    end
-    out
-  end
-
-  def site_keypair
-    Nostr::KeyPair.new(
-      private_key: Nostr::PrivateKey.new(Setting.nostr_private_key),
-      public_key: Nostr::PublicKey.new(Setting.nostr_public_key)
-    )
-  end
-
-  def site_user
-    Nostr::User.new(keypair: site_keypair)
-  end
-
-  def new_relay(url)
-    Nostr::Relay.new(url: url, name: URI.parse(url).host)
-  end
 end
--- a/app/views/admin/donations/index.html.erb
+++ b/app/views/admin/donations/index.html.erb
@@ -35,7 +35,7 @@
      <tbody>
        <% @donations.each do |donation| %>
          <tr>
-            <td><%= link_to donation.user.cn, admin_user_path(donation.user.cn), class: 'ks-text-link' %></td>
+            <td><%= link_to donation.user.address, admin_user_path(donation.user.address), class: 'ks-text-link' %></td>
            <td class="text-right"><% if donation.amount_sats.present? %><%= number_with_delimiter donation.amount_sats %><% end %></td>
            <td class="text-right"><% if donation.fiat_amount.present? %><%= number_to_currency donation.fiat_amount.to_f / 100, unit: "" %> <%= donation.fiat_currency %><% end %></td>
            <td class="pl-2"><%= donation.public_name %></td>
--- a/app/views/admin/donations/show.html.erb
+++ b/app/views/admin/donations/show.html.erb
@@ -6,7 +6,7 @@
      <tbody>
        <tr>
          <th>User</th>
-          <td><%= link_to @donation.user.cn, admin_user_path(@donation.user.cn), class: 'ks-text-link' %></td>
+          <td><%= link_to @donation.user.address, admin_user_path(@donation.user.address), class: 'ks-text-link' %></td>
        </tr>
        <tr>
          <th>Donation Method</th>
--- a/app/views/admin/invitations/index.html.erb
+++ b/app/views/admin/invitations/index.html.erb
@@ -38,8 +38,8 @@
            <tr>
              <td class="overflow-ellipsis font-mono"><%= invitation.token %></td>
              <td><%= invitation.used_at.strftime("%Y-%m-%d (%H:%M UTC)") %></td>
-              <td><%= link_to invitation.user.cn, admin_user_path(invitation.user.cn), class: "ks-text-link" %></td>
-              <td><%= link_to invitation.invitee.cn, admin_user_path(invitation.invitee.cn), class: "ks-text-link" %></td>
+              <td><%= link_to invitation.user.address, admin_user_path(invitation.user.address), class: "ks-text-link" %></td>
+              <td><%= link_to invitation.invitee.address, admin_user_path(invitation.invitee.address), class: "ks-text-link" %></td>
            </tr>
          <% end %>
        </tbody>
--- a/app/views/admin/lightning/index.html.erb
+++ b/app/views/admin/lightning/index.html.erb
@@ -36,7 +36,7 @@
            </td>
            <td>
              <% if user = @users.find{ |u| u[2] == account.login } %>
-                <%= link_to user[0], admin_user_path(user[0]), class: "ks-text-link" %>
+                <%= link_to "#{user[0]}@#{user[1]}", admin_user_path("#{user[0]}@#{user[1]}"), class: "ks-text-link" %>
              <% end %>
            </td>
            <td><%= number_with_delimiter account.balance.to_i.to_s %></td>
--- a/app/views/admin/settings/registrations/index.html.erb
+++ b/app/views/admin/settings/registrations/index.html.erb
@@ -0,0 +1,32 @@
+<%= render HeaderComponent.new(title: "Settings") %>
+
+<%= render MainWithSidenavComponent.new(sidenav_partial: 'shared/admin_sidenav_settings') do %>
+  <%= form_for(Setting.new, url: admin_settings_registrations_path) do |f| %>
+    <section>
+      <h3>Registrations</h3>
+
+      <% if @errors && @errors.any? %>
+        <%= render partial: "admin/settings/errors", locals: { errors: @errors } %>
+      <% end %>
+
+      <label class="block">
+        <p class="font-bold mb-1">Reserved usernames</p>
+        <p class="text-gray-500">
+          These usernames cannot be registered as accounts:
+        </p>
+        <%= f.text_area :reserved_usernames,
+          value: Setting.reserved_usernames.join("\n"),
+          class: "h-44 mb-2" %>
+        <p class="text-sm text-gray-500">
+          One username per line
+        </p>
+      </label>
+    </section>
+
+    <section>
+      <p class="pt-6 border-t border-gray-200 text-right">
+        <%= f.submit 'Save', class: "btn-md btn-blue w-full md:w-auto" %>
+      </p>
+    </section>
+  <% end %>
+<% end %>
--- a/app/views/admin/settings/registrations/show.html.erb
+++ b/app/views/admin/settings/registrations/show.html.erb
@@ -1,50 +0,0 @@
-<%= render HeaderComponent.new(title: "Settings") %>
-
-<%= render MainWithSidenavComponent.new(sidenav_partial: 'shared/admin_sidenav_settings') do %>
-  <%= form_for(Setting.new, url: admin_settings_registrations_path, method: :put) do |f| %>
-    <section>
-      <h3>Registrations</h3>
-
-      <% if @errors && @errors.any? %>
-        <%= render partial: "admin/settings/errors", locals: { errors: @errors } %>
-      <% end %>
-
-      <ul role="list">
-        <%= render FormElements::FieldsetComponent.new(
-              title: "Reserved usernames",
-              description: "These usernames cannot be registered as accounts."
-            ) do %>
-          <%= f.text_area :reserved_usernames,
-            value: Setting.reserved_usernames.join("\n"),
-            class: "h-44 w-60" %>
-          <p class="text-sm text-gray-500">
-            One username per line
-          </p>
-        <% end %>
-        <li>
-          <p class="font-bold mb-1">Default services</p>
-          <p class="text-gray-500">
-            These services are enabled for new users by default after signup.
-          </p>
-          <div class="flex flex-wrap gap-x-6 gap-y-2">
-            <% Setting.available_services.each do |option| %>
-              <div class="md:inline-block">
-                <%= f.check_box :default_services,
-                  { multiple: true, checked: Setting.default_services.include?(option),
-                    class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-600 mr-0.5" },
-                  option, nil %>
-                <%= f.label "default_services_#{option.parameterize}", service_human_name(option) %>
-              </div>
-            <% end %>
-          </div>
-        </li>
-      </ul>
-    </section>
-
-    <section>
-      <p class="pt-6 border-t border-gray-200 text-right">
-        <%= f.submit 'Save', class: "btn-md btn-blue w-full md:w-auto" %>
-      </p>
-    </section>
-  <% end %>
-<% end %>
--- a/app/views/admin/settings/services/_nostr.html.erb
+++ b/app/views/admin/settings/services/_nostr.html.erb
@@ -7,52 +7,4 @@
    title: "Enable Nostr integration (experimental)",
    description: "Allow adding nostr pubkeys and resolve user addresses via NIP-05"
  ) %>
-<% if Setting.nostr_enabled? %>
-  <%= render FormElements::FieldsetResettableSettingComponent.new(
-        key: :nostr_private_key,
-        type: :password,
-        title: "Private key",
-        description: "The private key of the accounts service, used when publishing events (e.g. zap receipts)"
-      ) %>
-  <%= render FormElements::FieldsetResettableSettingComponent.new(
-        key: :nostr_public_key,
-        title: "Public key",
-        description: "The corresponding public key of the accounts service"
-      ) %>
-  <%= render FormElements::FieldsetResettableSettingComponent.new(
-        key: :nostr_public_key_primary_domain,
-        title: "Public key for primary domain (NIP-05)",
-        description: "(optional) A different pubkey to announce for the _@#{Setting.primary_domain} Nostr address"
-      ) %>
-  <%= render FormElements::FieldsetResettableSettingComponent.new(
-        key: :nostr_relay_url,
-        title: "Relay URL",
-        description: "Websockets URL of a relay associated with #{Setting.primary_domain}"
-      ) %>
 </ul>
-</section>
-
-<section>
-<h3>Zaps</h3>
-<ul role="list">
-  <%= render FormElements::FieldsetResettableSettingComponent.new(
-        key: :nostr_zaps_relay_limit,
-        title: "Relay limit",
-        description: "The maximum number of sender-defined relays to try to publish zap receipts to"
-      ) %>
-</ul>
-</section>
-
-<section>
-<h3>Onboarding</h3>
-<ul role="list">
-  <%= render FormElements::FieldsetComponent.new(
-        title: "Discovery relays",
-        description: "Used to discover a user's published relay list and/or profile"
-      ) do %>
-    <%= f.text_area :nostr_discovery_relays,
-      value: Setting.nostr_discovery_relays.join("\n"),
-      class: "h-44 w-80" %>
-  <% end %>
-</ul>
-<% end %>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Râu Cao	f57fff0087	Send email confirmation when BTC payment is confirmed All checks were successful continuous-integration/drone/push Build is passing Details	2024-02-22 15:20:17 +01:00
Râu Cao	18ff3d3f0d	Implement bitcoin donations via BTCPay	2024-02-22 15:19:27 +01:00
Râu Cao	1b3ac90ddd	Allow other controllers to access lndhub user balance	2024-02-22 15:19:27 +01:00
Râu Cao	5db0ee6658	DRY up btcpay and lndhub services Removing initialize methods from the main/manager class also allows for different iniitalizers in specific task services	2024-02-22 15:19:27 +01:00
Râu Cao	da31a027c5	Move past donations to partial	2024-02-22 15:19:27 +01:00