How can create account for Service DID on self-hosting PDS?

[itaru2622]

I'm trying to integrate https://github.com/bluesky-social/ozone with self-hosting PDS.

ozone's HOSTING.md says it needs account ${OZONE_SERVICE_ACCOUNT_HANDLE} in PDS before starting ozone as below:

OZONE_SERVICE_ACCOUNT_HANDLE="mylabeler.bsky.social"
OZONE_SERVER_DID="$(curl --fail --silent --show-error "https://api.bsky.app/xrpc/com.atproto.identity.resolveHandle?handle=${OZONE_SERVICE_ACCOUNT_HANDLE}" | jq --raw-output .did)"

cat <<OZONE_CONFIG | sudo tee /ozone/ozone.env
OZONE_SERVER_DID=${OZONE_SERVER_DID}
:

when I create ordinal account and try to sign-in ozone UI, I got error 'could not find identity info' on UI.
and in curl, got below error message.

{"error":"BadJwtAudience","message":"jwt audience does not match service did"}

how can create account for ozone service did?

in ozone's HACKING.md, it says: use mod.test for login.
I also checked atproto (dev-env and atporoto/packages/pds/tests/moderator-auth.test.ts). but those use different operation each others and those made me confused to find out exact code for getting ozone service DID.

[itaru2622]

when I tested with self-hosting ozone X official bsky PDS (bsky.social) X ordinal account created via bsky.app UI, I got below page.
but I didn't get below page while testing with self-hosting PDS based on atproto/packages/pds.
so, some logic may be lacked or not working when integrating with self-hosting PDS by unknown reason.

after processing the above page, I got additional record in my DID Document, and succeeded to sign-in ozone service UI.

[itaru2622]

I found the above page at below IdentityConfigurationFlow in ozone repo.

https://github.com/bluesky-social/ozone/blob/main/components/shell/ConfigurationFlow.tsx#L198-L205

to get the above page, it needs to pass conditions of ConfigurationFlow in components/shell/ConfigurationFlow.tsx L20.
then, I can debug it.

[itaru2622]

hmm, I found the reason, and bugs in https://github.com/bluesky-social/ozone.

I found that even I set NEXT_PUBLIC_PLC_DIRECTORY_URL in ozone.env , the value isn't used in the above (configuration) flow.
I confirmed as below with patch.

ozone server recognize my configuration as expecteed, as below, by curl -L https://ozone.mysky.local.com/env

:
NEXT_PUBLIC_PLC_DIRECTORY_URL: https://plc.mysky.local.com

but browser side code doesn't know it, according to browser's console log:

############## fetch: { "url": "https://plc.directory/did:plc:.../data",
                        "PLC_DIRECTORY_URL": "https://plc.directory"}
############## Object.entries(process.env).length>0 ?  false
then nothing dumped for process.env.*

my patch to check the above:

diff --git a/lib/identity.ts b/lib/identity.ts
index 24c64cd..659f8f7 100644
--- a/lib/identity.ts
+++ b/lib/identity.ts
@@ -23,6 +23,9 @@ export const resolveDidDocData = async function (
 ): Promise<DidDocData | null> {
   if (did.startsWith('did:plc:')) {
     const url = new URL(`/${did}/data`, PLC_DIRECTORY_URL)
+    console.log("############## fetch:", {url, PLC_DIRECTORY_URL }) // check in browser's development-tool
+    console.log("############## Object.entries(process.env).length>0 ? ", Object.entries(process.env).length>0 ) 
+    Object.keys(process.env).sort().forEach(key => { console.log(`############# process.env.${key}: ${process.env[key]}`) });
     const res = await fetch(url)
     if (res.status !== 200) return null
     const doc = await res.json()
diff --git a/service/index.js b/service/index.js
index 1b7a221..4b66a58 100644
--- a/service/index.js
+++ b/service/index.js
@@ -31,6 +31,9 @@ async function main() {
   }
   const ozone = await OzoneService.create(config, secrets)
   // setup handlers
+  ozone.app.get('/env', (_req, res) => { // check on server-side by curl
+      return res.json({...process.env})
+  })
   ozone.app.get('/.well-known/ozone-metadata.json', (_req, res) => {
     return res.json({
       did: ozone.ctx.cfg.service.did,

[itaru2622]

I post this as issue at bluesky-social/ozone#94

[itaru2622]

close this discussion, the title and content match by investigation.
and migrates to #2412 from here.