cc.me

Small Axum service for OAuth callbacks and encrypted webhook inboxes:

GET /?at=<url>&code=...&state=... redirects to at, appending every query parameter except at.
POST /c creates or returns the short OAuth callback alias for a target.
POST /i/<ed25519-public-key> captures a webhook request, encrypts it for that public key, and stores it for later handling.
POST /i/<key-a>.<key-b> fans out one encrypted copy per recipient.
/i/<key>/webmention, /websub, /slack, /pingback, /meta, /cloudevents, and /discord/<app-public-key> add small protocol handling before storing deliveries in the same inbox.
GET /i/<key> looks ahead without removing deliveries.
POST /i/<key>/claim reserves deliveries for handling.
POST /i/<key>/ack removes handled deliveries in batches.
POST /i/<key>/release makes claimed deliveries ready again.

The inbox URL contains an Ed25519 public key. Deliveries are encrypted with the X25519 key derived from it. GET, claim, ack, and release must include a valid x-cc-me-timestamp and x-cc-me-signature header signed by the corresponding Ed25519 private key.

Requests are only stored when captured method, path, query, headers, and body fit within 64 KiB. GET and claim responses return only as many items as fit within 1 MiB. If an inbox is full, new captures are rejected and existing deliveries are not removed.

Run

process-compose up

That starts Postgres and the app. The service listens on 0.0.0.0:3000 by default.

To run the packaged service binary directly:

nix run github:xmit-co/cc.me

Configuration

Variable	Default	Meaning
`BIND_ADDR`	`127.0.0.1:3000`	HTTP bind address
`DATABASE_URL`	`postgres://127.0.0.1:5432/postgres`	Postgres connection URL
`INBOX_MAX_REQUESTS`	`100`	Stored encrypted requests per public key
`INBOX_DEFAULT_GET_LIMIT`	`1`	Default GET/claim batch size when a limit is omitted
`INBOX_MAX_GET_LIMIT`	`1000`	Cap for requested batch sizes
`INBOX_LONG_POLL_SECONDS`	`25`	Long-poll wait used by `?p` and `claim({ poll: true })`
`SHOT_CHROME_BIN`	`chromium`	Chromium binary managed for `/shot` screenshots
`SHOT_CHROME_ARGS`	empty	Extra whitespace-separated Chromium flags
`SHOT_POW_LEVEL`	`22`	Proof-of-work level required by `/shot`
`SHOT_TS_WINDOW_SECONDS`	`300`	Accepted `ts` skew in `/shot` documents
`SHOT_NAV_TIMEOUT_SECONDS`	`10`	Page-load timeout per screenshot
`SHOT_CACHE_SECONDS`	`3600`	Screenshot cache lifetime
`SHOT_CHROME_MAX_RENDERS`	`64`	Renders before the managed Chrome is recycled

Chrome's memory is bounded in layers: renderers are limited to one per concurrent render with a capped V8 heap, the browser is respawned every SHOT_CHROME_MAX_RENDERS renders, and deployments should add a hard ceiling around the service (e.g. systemd MemoryMax=2G, MemorySwapMax=0) — under cgroup OOM the kernel kills the fattest process, a Chrome renderer, and the service respawns the browser on the next request.

GET /pow documents a JWT-shaped proof-of-work token format with an in-browser solver and verifier; reference CPU (Node) and GPU (Metal, OpenCL) solvers live in pow/. GET /shot renders screenshots in a managed headless Chrome — disposable incognito-style contexts, up to 2048×2048 with Chrome-side downscaling, cached for an hour — gated by proof-of-work tokens; the required level and other expectations are served at GET /shot/config.

Static docs live in docs/. The Go client is the module at the repository root (go install cc.me@latest for the CLI, import "cc.me/ccme" for the library; the server answers the go-import handshake on ?go-get=1). The other clients live under client/: the JavaScript package in client/js/, plus ports in client/python/, client/rust/, and client/ruby/.

The client CLI can forward or inspect inbox deliveries:

npx cc-me http://example.local:8080/webhook
npx cc-me inspect

By xmit dev team. We respect privacy: HTTP deliveries are encrypted for your key and we don't inspect your emails.

cc-me

Runtime

cc.me

Run

Configuration