The sidecar now ships as a container image. A static musl binary sits on distroless static, runs as a non-root user, and has a /data volume, giving a 35.5 MiB image. The configuration is baked in as deploy/config.toml, with the real servers, owners and rules and nothing secret. So a config change is a new image. scripts/publish-image.sh builds for amd64, tags with the commit and latest, and pushes to public.ecr.aws/i7w5y2e0/tangled-collaborator-sidecar. It refuses a dirty tree.
/status is public now, and the status token is gone. It shows owner DIDs and states, known counts and stream states, never tokens. The SSH deploy script, the systemd unit and the example config are deleted. didbot's infra/sidecar now pulls the image on a timer.
🤖 Generated with Claude Code