feat: public note sharing (/s/<slug>) + management API

.github/workflows/ci.yml

@@ -0,0 +1,54 @@
+name: Quality Checks
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  trunk:
+    name: Trunk Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: trunk-io/trunk-action@v1
+
+  build:
+    name: Build & Typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: worker-dist
+          path: dist/
+          retention-days: 1
+
+  terraform:
+    name: Terraform Validate
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: worker-dist
+          path: dist
+      - uses: opentofu/setup-opentofu@v1
+      - working-directory: terraform
+        run: tofu init -backend=false
+      - working-directory: terraform
+        run: tofu fmt -check
+      - working-directory: terraform
+        run: tofu validate

.github/workflows/deploy.yml

@@ -4,15 +4,22 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     name: Deploy to Cloudflare Workers
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install dependencies
-        run: npm install
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - run: npm ci
 
       - name: Typecheck
         run: npm run typecheck

.gitignore

@@ -1,4 +1,13 @@
 node_modules/
 .wrangler/
-dist/
 *.local
+
+# Terraform
+terraform/.terraform/
+terraform/terraform.tfstate
+terraform/terraform.tfstate.backup
+terraform/terraform.tfvars
+# terraform/.terraform.lock.hcl is intentionally committed (provider version pinning)
+
+# Worker build output (generated by scripts/build.sh before tf apply)
+dist/

.trunk/.gitignore

@@ -0,0 +1,9 @@
+*out
+*logs
+*actions
+*notifications
+*tools
+plugins
+user_trunk.yaml
+user.yaml
+tmp

.trunk/configs/.markdownlint.yaml

@@ -0,0 +1,2 @@
+# Prettier friendly markdownlint config (all formatting rules disabled)
+extends: markdownlint/style/prettier

.trunk/configs/.shellcheckrc

@@ -0,0 +1,7 @@
+enable=all
+source-path=SCRIPTDIR
+disable=SC2154
+
+# If you're having issues with shellcheck following source, disable the errors via:
+# disable=SC1090
+# disable=SC1091

.trunk/configs/.yamllint.yaml

@@ -0,0 +1,7 @@
+rules:
+  quoted-strings:
+    required: only-when-needed
+    extra-allowed: ["{|}"]
+  key-duplicates: {}
+  octal-values:
+    forbid-implicit-octal: true

.trunk/trunk.yaml

@@ -0,0 +1,38 @@
+# This file controls the behavior of Trunk: https://docs.trunk.io/cli
+# To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
+version: 0.1
+cli:
+  version: 1.25.0
+# Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
+plugins:
+  sources:
+    - id: trunk
+      ref: v1.7.4
+      uri: https://github.com/trunk-io/plugins
+# Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
+runtimes:
+  enabled:
+    - go@1.21.0
+    - node@22.16.0
+    - python@3.10.8
+# This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
+lint:
+  enabled:
+    - actionlint@1.7.8
+    - checkov@3.2.506
+    - git-diff-check
+    - markdownlint@0.47.0
+    - osv-scanner@2.2.4
+    - prettier@3.8.1
+    - shellcheck@0.11.0
+    - shfmt@3.6.0
+    - taplo@0.10.0
+    - tflint@0.61.0
+    - trufflehog@3.90.13
+    - yamllint@1.38.0
+actions:
+  enabled:
+    - trunk-announce
+    - trunk-check-pre-push
+    - trunk-fmt-pre-commit
+    - trunk-upgrade-available

Makefile

@@ -0,0 +1,33 @@
+.PHONY: build tf-init tf-plan tf-apply tf-destroy deploy
+
+# Bundle the worker (required before tf-plan / tf-apply)
+build:
+	./scripts/build.sh
+
+# Init Terraform providers
+tf-init:
+	cd terraform && tofu init
+
+# Plan infra changes (builds first)
+tf-plan: build
+	cd terraform && \
+	  TF_VAR_publish_token="$$(pass obsidian-redirect/publish-token)" \
+	  CLOUDFLARE_API_TOKEN="$$(pass cloudflare/workers-api-token)" \
+	  tofu plan
+
+# Apply infra changes (builds first)
+tf-apply: build
+	cd terraform && \
+	  TF_VAR_publish_token="$$(pass obsidian-redirect/publish-token)" \
+	  CLOUDFLARE_API_TOKEN="$$(pass cloudflare/workers-api-token)" \
+	  tofu apply
+
+# Full deploy: build → apply
+deploy: tf-apply
+
+# Destroy all infra (use with care)
+tf-destroy:
+	cd terraform && \
+	  TF_VAR_publish_token="$$(pass obsidian-redirect/publish-token)" \
+	  CLOUDFLARE_API_TOKEN="$$(pass cloudflare/workers-api-token)" \
+	  tofu destroy

README.md

@@ -9,13 +9,15 @@ Get your own instance running in ~5 minutes:
 1. **Fork** [gisk0/obsidian-redirect](https://github.com/gisk0/obsidian-redirect)
 
 2. **Configure your domain** — edit `wrangler.toml`:
+
    ```toml
    routes = [
      { pattern = "obs.yourdomain.com/*", zone_name = "yourdomain.com" }
    ]
    ```
 
 3. **Deploy:**
+
    ```bash
    npm install
    npx wrangler login        # authenticate with Cloudflare
@@ -32,6 +34,7 @@ Get your own instance running in ~5 minutes:
 After the first manual deploy, pushes to `main` auto-deploy via GitHub Actions.
 
 Add one GitHub secret: **`CF_API_TOKEN`**
+
 - Create at [Cloudflare → Profile → API Tokens](https://dash.cloudflare.com/profile/api-tokens)
 - Template: **Edit Cloudflare Workers**
 - Scope: Account → Workers Scripts → Edit
@@ -83,10 +86,10 @@ GET /health  →  200 "ok"
 - A **"Open in Obsidian →" button** — user-initiated taps pass WKWebView's security checks (iOS)
 - A **JS auto-redirect** — fires immediately on macOS/desktop browsers for zero-friction UX
 
-| Platform | Experience |
-|---|---|
-| **macOS** | Click link → browser flashes → Obsidian opens instantly |
-| **iOS** | Tap link → see "Open in Obsidian" page → tap button → Obsidian opens |
+| Platform  | Experience                                                           |
+| --------- | -------------------------------------------------------------------- |
+| **macOS** | Click link → browser flashes → Obsidian opens instantly              |
+| **iOS**   | Tap link → see "Open in Obsidian" page → tap button → Obsidian opens |
 
 The extra tap on iOS is unavoidable — it's a WKWebView security constraint. The button approach is the most reliable method available (Obsidian doesn't support Universal Links).