Link thumbnails: post og:image previews + WOTD default-off

URL link previews now post the page's og:image as an inline m.image
thumbnail above the title/description reply. All outbound fetches in the
preview path (page scrape, image HEAD probe, image download) route through
a new SSRF/DoS-hardened safehttp client so a posted link can't steer
fetches at loopback/RFC1918/cloud-metadata IPs or OOM the parser.

Also flips the daily WOTD auto-post to opt-in (ENABLE_WOTD_POST=true)
instead of opt-out.
This commit is contained in:
prosolis
2026-06-24 21:55:25 -07:00
parent cbfca525f5
commit 8122973b74
7 changed files with 443 additions and 37 deletions

View File

@@ -406,8 +406,8 @@ func setupScheduledJobs(
}
})
// WOTD post at 08:00
if strings.ToLower(os.Getenv("DISABLE_WOTD_POST")) != "true" {
// WOTD post at 08:00 (disabled by default; opt in via ENABLE_WOTD_POST=true)
if strings.ToLower(os.Getenv("ENABLE_WOTD_POST")) == "true" {
c.AddFunc("0 8 * * *", func() {
slog.Info("scheduler: posting WOTD")
for _, r := range rooms {
@@ -415,7 +415,7 @@ func setupScheduledJobs(
}
})
} else {
slog.Info("scheduler: WOTD daily post disabled via DISABLE_WOTD_POST")
slog.Info("scheduler: WOTD daily post disabled (set ENABLE_WOTD_POST=true to enable)")
}
// Game releases Monday 09:00