Notes from running afara end-to-end locally (fresh clone) + a pass over toju.network

[yashksaini-coder]

Hi toju team 👋

I cloned afara at b801877 (main, identical to dev), ran the full stack locally and tried the live app at toju.network. The product works: on mainnet, a 2 MB file for 30 days quotes at 1713 lamports. I didn't do a paid upload.

Getting a fresh clone running took a few detours, and I found some things that don't match between the site, the docs and the code. Here they are, in the order I think matters most. I'm happy to open PRs for any of them; tell me which ones you'd take and whether to target dev.

1. The landing page says files are encrypted. The Terms say they aren't.

• The landing page says "Your data is encrypted, hashed, and prepared for decentralized warm storage" (ui/src/containers/home/index.tsx:213).
• Terms §3.2 says "We do not provide encryption services. Any encryption is your responsibility" (ui/src/content/terms.md:49-51).

The code matches the Terms: nothing in server/, packages/sol or ui/ encrypts files. Data on IPFS is public, so the landing-page wording could lead people to upload sensitive files without encrypting them first. I'd suggest dropping "encrypted" from that copy, or saying something like "content-addressed".

2. Migrations 0006 and 0008 fail on a fresh Postgres

I applied server/drizzle/*.sql in order to a clean Postgres 17:

0006_add_payment_chain_columns.sql
ERROR:  cannot use column reference in DEFAULT expression
ERROR:  relation "transactions" does not exist

There are two separate problems:

• Wrong quotes. DEFAULT "sol" and DEFAULT "SOL" use double quotes, so Postgres reads them as column names instead of strings. They should be 'sol' and 'SOL'.
• Wrong table name. 0006 (lines 4-5) and 0008 (line 2) alter "transactions", but schema.ts:48 and the earlier migrations create transaction.

Your existing databases were presumably fixed by hand. A new contributor's database can't get past 0006.

3. seed.ts seeds a storage rate that's far too large

server/scripts/seed.ts:55 inserts ratePerBytePerDay: 3000000000.0. Its own comment says 0.000000000003, and production returns 3e-12.

With the seeded value, a local quote for 2 MB × 30 days is 1.7121658898506614e+24 lamports. After changing it to 3e-12, the local quote is 1713, the same as api.toju.network.

4. The setup docs still describe Storacha

After the move to Pinata (#8, ca04dba), the README, CONTRIBUTING and Terms §4.1 still describe Storacha. The env docs also need updating:

• Required by the server but missing from server/.env.example: server/src/index.ts:28-36 won't start without PINATA_JWT and PINATA_GATEWAY. .env.example also leaves out DATABASE_URL and SOLANA_PROGRAM_IDL.
• Documented but no longer read by the server: STORACHA_KEY and STORACHA_PROOF.

It may also help to say in CONTRIBUTING that SOLANA_PROGRAM_IDL can be the contents of server/src/utils/solana/idl.json. That program (CSXnf…FquxH) is already deployed on testnet, so contributors don't need Anchor or a local validator to run the server against testnet.

5. The dev ports don't line up

• What the UI calls. In dev mode, the UI and SDK call a hard-coded http://localhost:5040 (ui/src/lib/utils.ts:12, packages/sol/src/client.ts:36). For pricing calls this ignores VITE_API_URL.
• Where the server listens. The server defaults to PORT=3000 (server/src/index.ts:21). That's also the port Vite uses (ui dev script: vite --port 3000).

So with default settings, the UI's API calls fail with ERR_CONNECTION_REFUSED until you set PORT=5040. One possible fix is to default the server to 5040 and mention it in CONTRIBUTING.

6. The server crashes on Node 26

@sentry/profiling-node (server/src/instrument.ts:2) has no prebuilt binary for Node 26, so startup fails with:

Error: Cannot find module './sentry_cpu_profiler-linux-x64-glibc-147.node'

The server runs on Node 22 LTS. CONTRIBUTING only says "Node >= 20", and the repo has no engines field or .nvmrc. Pinning Node 22, or loading the profiler only when SENTRY_DSN is set, would avoid the crash.

7. Smaller things

• A failed quote shows as free. When /pricing/quote fails, the upload page shows the cost as "0 SOL" instead of an error. I hit this before the database was set up.
• There are no tests. pnpm test in both server/ and ui/ exits 1 with "No tests found". CI (biome.yml, knip.yml) doesn't run tests either. A single smoke test, such as a /health check or a migrations-apply check, would have caught finding 2.
• Stale branding and labels:
  • The page title is still "Keep - Decentralized Storage Payments" (ui/index.html).
  • The "Live on Mainnet" badge is hard-coded (ui/src/containers/home/index.tsx:100), so testnet builds show it too.
  • The README links Discord invite j6YEHyCV, but the site footer links 5YPxMnAf.
• CONTRIBUTING and ui/package.json disagree. CONTRIBUTING says the UI uses the workspace SDK (workspace:*), but ui/package.json:32 pins @toju.network/sol to ^1.0.0 from npm. As a result, local SDK changes don't reach the UI.

How I ran it locally without any hosted accounts

• Database: Postgres 17 in Docker. I made a local-only change to db.ts so it uses drizzle-orm/node-postgres when DATABASE_URL points at localhost, because the Neon HTTP driver can't talk to a plain Postgres. If you're interested, this could be an opt-in dev path.
• Solana: SOLANA_RPC_URL=https://api.testnet.solana.com plus the in-repo IDL. The server found the existing on-chain config ("Config already exists").
• QStash and Resend: placeholder values.
• Pinata: the only real account needed, and only for the upload step itself.

After that, /health returned 200 with the DB up, /pricing/sol worked, and local quotes matched production exactly.

Thanks for building this. Paying for IPFS storage straight from a wallet is a nice flow. Let me know which of these you'd like PRs for.

[yashksaini-coder]

Looping in @anurag-p6. During C4GT DMP'26 he worked on this same codebase in seetadev's copy, and two of his merged PRs there bear directly on the findings above:

• feat(server): meshkit server with kubo implemented seetadev/IPFS-Solana-SDK#217, "meshkit server with kubo": replaces Pinata with Meshkit and a Kubo node. That's relevant to finding 4 (the Storacha/Pinata env docs), and it would also mean a local setup needs no hosted storage account.
• Ppt token meshkit seetadev/IPFS-Solana-SDK#219, "Ppt token meshkit": adds a PPT-gated encrypted upload and retrieve flow. That's relevant to finding 1, the "encrypted" claim on the landing page.

Anurag, are there plans to bring either of these upstream here? It would help to know before anyone opens overlapping PRs for those two points.

[yashksaini-coder]

Also looping in Anirudh Sharma (@anisharma07 / @its-me-ani), another C4GT DMP'26 contributor on seetadev's projects. His SocialCalc healthcare apps (seetadev/ZKMedical-Billing#107) pin sheets, PDFs and CSVs to IPFS through Pinata or MeshKit. That makes him a downstream user of the same storage path as findings 4 and 5 above, the env/docs drift and the dev-port setup. Anirudh, if you hit any of these while integrating, or have other setup issues, please add them here.