The editor is about to be opened to strangers: a post on Reddit and a guest access (#428). nginx served the whole workspace and ran every PHP file in it, the API let anybody guess passwords as fast as they liked, and one account could fill the disk. - nginx (shared web stack, outside this repo, backup in /root/config-backup-20261015/) hands out only the two pages, dist/, public/brand/, the uploads by kind and ending, and api/index.php. Everything else under /feuerwerk/ is a 404. - PHP behind it has display_errors off and no X-Powered-By. Plain HTTP forwards to HTTPS, the API refuses it. - Headers: a Content-Security-Policy without inline code or eval, nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP. - vite.config.ts writes the same policy into the built pages, so CI runs the whole suite under it. Pixi gets by without eval through pixi.js/unsafe-eval. The page CSS left its inline style for a file. - The harness fails a module for anything the policy refuses, from Chrome's log and from the page's securitypolicyviolation event. - LoginThrottle: five wrong passwords from one address within 15 minutes, and it gets 429 until 15 minutes after the last of them. The address is the last X-Forwarded-For entry, the Brandmauer's own. - Quota: 1 GB per account for uploads, projects and snapshots. Only a write that grows the account is refused (413). Admins have no limit. - A write whose Sec-Fetch-Site says another site is refused (403). - The session cookie carries Secure, nginx passes HTTPS on. - showFailure puts the message in as text, not as HTML. - Every PHP script outside api/ stops unless it runs on the command line. - The video worker sees the checkout read-only and can only write data/videos. No capabilities, 2 GB and 256 processes at most. - tests/php/rights.test.php runs the API under php -S on a scratch directory and asks every route as signed out, owner, stranger and admin. A route named in api/index.php but missing in the matrix fails it. limits.test.php covers the brake and the quota. Findings: - tmp/ was readable from outside, with 79 copies of project files. Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10. shows only our own requests. - Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the Brandmauer. Left as it is: the web stack is not this project's. - npm audit finds nothing in what is shipped. Dev tools (vitest, brace-expansion, source-map-js) have advisories, not touched here. Tests: check 313 files / 4843 tests. PHP limits 21, rights 60, accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41 197/198, the one red check (a click in 41) passes with 41 alone, 27/27. 67 misses frames at 1080p on stein2 with and without this. Path list from outside: 10 served, 26 refused. ZAP baseline against the live site: nothing High or Medium under /feuerwerk/. Counter-checks: rights.test.php without the cross-site guard, the quota, the brake, the admin check of users, or with an undocumented route fails each time. A policy without wasm-unsafe-eval fails e2e 41 with the harness's own CSP line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Feuerwerk
A browser-based tool "one step before a game engine": create assets (scenes, cameras, sprites), place them into scenes, tweak their properties in an inspector and press Play, all in one program, all drawn inside a single WebGL canvas.
Live: https://nockal.com/feuerwerk/ · Widget playground: https://nockal.com/feuerwerk/?playground
The documentation is the wiki: https://git.nockal.com/meleki/feuerwerk/wiki: every concept, node, tab and shortcut, plus the architecture and the development workflow. This file is the short way in.
In one screen
- An asset is a named, typed thing (scene, camera, sprite, text, behavior, variables, struct, collider, rigidbody, joint, container, clip area, texture, vector art, pixel art, palette, animation, curve, tile, tilemap, state machine, shader, shader function, font, sound, sound FX, instrument, pattern, song, bus, video, composition, particles) with properties and no position.
- A scene object places an asset: position, sparse overrides of its properties, an optional parent. Only what differs from the asset is stored; the inspector paints it gold and offers ↺ / ↑.
- A container is a reusable group edited once and placed many times; its content is resolved from the template on every read. A screen is a container switched on and off.
- A behavior is logic as a node graph, placed like anything else and parented to the object it acts on. Play has no built-in behaviour: everything that happens is a graph.
- An account owns projects: the editor asks for a user name and a password first, and each account sees only its own projects. The Account menu at the far right of the toolbar changes the password and signs out.
- Play runs a throwaway copy of the project; every panel stays usable and Stop brings back exactly what was saved. Release… shares a link that plays the saved game on its own, without the editor and without signing in.
Quick start
Node 22 is required.
npm install
npm run dev # http://localhost:5175/feuerwerk/dist/; API calls are proxied to production
npm run check # typecheck + lint + format:check + unit tests; the gate CI runs too
npm run build # writes dist/ and regenerates index.html; the folder is what nginx serves
The browser suite and the three example games need a machine with a GPU:
node tools/seed-e2e.mjs && node tools/e2e.mjs # the editor, 2090 checks (GM_STEPS=20 for one step)
# every tool signs in first; see the Accounts page
node tools/seed-jumprun.mjs && node tools/smoke-jumprun.mjs
node tools/seed-tetris.mjs && node tools/smoke-tetris.mjs
node tools/seed-actor.mjs && node tools/smoke-actor.mjs
Every push runs all of it on the Gitea runners: the gate as one job, build and suite as another beside it. So locally take the gate plus the step your change touches and leave the full run to CI. Details, the GPU requirement and the detached runner are in Development.
Documentation
| Page | What it covers |
|---|---|
| Concepts | Assets, scene objects, overrides, play mode, the camera, the console |
| Accounts | Signing in and out, the accounts, who a project belongs to, what the check tools need |
| Scenes | The edited scene, the start scene, and switching scenes from a graph |
| Scene editing | Placing, z-order, hierarchy, the editor offset |
| Behaviors | Node graphs: variables, the node set, structs and lists, loops, nesting, editing |
| Structs | Struct assets: a named shape that struct variables, fields and Pack/Expand follow |
| Colliders | Shapes (box, circle, capsule, polygon), collision events, blocking movement, one-way colliders and raycasts |
| Physics | Rigidbodies, the collider material, gravity, the fixed step, joints |
| Textures | Images, frames, nine-slice, the filter, upload limits |
| Vector art | Pictures drawn from shapes: the pen, curves, gradients and texture fills, combining shapes |
| Pixel art | Pictures painted pixel by pixel: the palette, the tools, layers and frames |
| Fonts | Font assets, the picker, what a text falls back to |
| Sounds | Sound assets and clips, Play sound, buses and the Master routing, sound FX |
| Instruments | Instruments as node graphs, Chips and presets, the keys of the Instrument tab, Play note |
| Patterns | Patterns and the piano roll, playing one in a loop or from a game |
| Songs | Songs, their tracks and items, routing, recording, playing one from a game |
| Videos | Video assets and clips, wearing one on a sprite, recording the game view or the editor |
| Animations | Animation assets and the Animation tab |
| Curves | Easings drawn by hand, the Curve tab, using one on a key or a Lerp |
| Shaders | Shader graphs that sprites, texts, particle fields and cameras wear, their node set, passes, shader functions |
| Particles | Particle graphs: a particle as a function of its age |
| State machines | The asset, named transitions, State branch, Set state and State transition |
| Containers | Templates, instances, screens |
| Compositions | Objects, videos and sounds laid out in time, the Composition tab, playing one in a game |
| Tiles | The tile asset, plain tiles and the two autotile kinds, the pictures as animation steps, the Tile tab |
| Tilemaps | The tilemap asset, painting in the scene view, layers, what it looks like in the game |
| Plugins | Extending the editor: the plugin file, how it is loaded, switching one on and off, API v1 |
| Keyboard | Every shortcut |
| Architecture | Stack, source layout, the rules that keep it organised |
| Development | Commands, the e2e suite, the example games, CI |
| API | The PHP JSON API and the project document |
Ideas, gaps and bugs
They live in the issue tracker: https://git.nockal.com/meleki/feuerwerk/issues. What is not there yet is listed on the wiki's Home page.
