Rename Nurse to Mako

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-01 00:07:43 -06:00
1 parent 6a4be5b2f4
commit e3147597e8
@@ -1,11 +1,11 @@
-# Nurse
+# Mako

 A private notebook in the spirit of Obsidian and Notion, for people who would rather run their own.
 Pages that nest inside each other, `[[links]]` between them with backlinks, a journal page for each
 day, tags, and quick search, all kept as plain markdown files. One small binary, no database, no
-dependencies. You sign in with **Authentik** and nothing else: there are no passwords in Nurse.
+dependencies. You sign in with **Authentik** and nothing else: there are no passwords in Mako.

-Named for the nurse shark, which rests on the sea floor and stays close to home.
+Named for the mako shark, the fastest in the sea, because a notebook should keep up with you.

 ## What it does

@@ -27,9 +27,9 @@ Named for the nurse shark, which rests on the sea floor and stays close to home.
  other: `[[2026-10-31]]` goes to that day.
 - **Quick notes.** The box on Home takes a thought in two keystrokes (`n`, then Ctrl+Enter). They stay
  out of the sidebar until you give them a title.
- **Tags by typing.** Write `#errands` or `#projects/nurse` anywhere. Numbers such as `#12` and
+- **Tags by typing.** Write `#errands` or `#projects/mako` anywhere. Numbers such as `#12` and
  anything in code are left alone.
- **Autosave that does not lose things.** Changes save as you type. If the connection drops, Nurse
+- **Autosave that does not lose things.** Changes save as you type. If the connection drops, Mako
  keeps your text and retries. If your Authentik session ends mid-sentence, it keeps the text, offers
  to sign in again in another tab, and saves when you are back. If a page changed on another device,
  it asks which version to keep instead of overwriting.
@@ -38,44 +38,44 @@ Named for the nurse shark, which rests on the sea floor and stays close to home.

 ## Signing in with Authentik

-Nurse never sees a password. Who may open it is decided in Authentik, and each person gets a
+Mako never sees a password. Who may open it is decided in Authentik, and each person gets a
 notebook that only they can read.

 1. In Authentik, go to **Applications → Providers → Create** and choose **OAuth2/OpenID Provider**.
   Set the client type to **Confidential**, add the redirect URI (strict)
-   `https://notes.example.com/auth/callback` (use the address you will open Nurse at), and keep the
+   `https://notes.example.com/auth/callback` (use the address you will open Mako at), and keep the
   default scopes (openid, profile, email).
-2. **Applications → Create**: name it Nurse and pick that provider. To limit who can open it, bind a
+2. **Applications → Create**: name it Mako and pick that provider. To limit who can open it, bind a
   user or group to the application.
 3. Copy the provider's **Client ID** and **Client Secret**, and note its **OpenID Configuration
-   Issuer**, which looks like `https://auth.example.com/application/o/nurse/`.
-4. Give Nurse those four things (see below), then run `nurse check`. It tells you whether
+   Issuer**, which looks like `https://auth.example.com/application/o/mako/`.
+4. Give Mako those four things (see below), then run `mako check`. It tells you whether
   Authentik answers and what redirect URI to allow.

-Nurse asks for the `openid profile email` scopes and uses the authorization code flow with PKCE, a
+Mako asks for the `openid profile email` scopes and uses the authorization code flow with PKCE, a
 `state` and a `nonce`. Whoever Authentik lets into the application can sign in; to be stricter, list
-people under `allowed` (emails or usernames), and Nurse turns anyone else away even if Authentik
+people under `allowed` (emails or usernames), and Mako turns anyone else away even if Authentik
 lets them through.

 ## Installing on Linux (systemd)

 ```sh
-curl -fsSL https://git.veillax.com/Veillax/nurse/raw/branch/main/deploy/install.sh | sudo sh
+curl -fsSL https://git.veillax.com/Veillax/mako/raw/branch/main/deploy/install.sh | sudo sh
 ```

-This downloads the latest release (checking its SHA-256), installs `/usr/local/bin/nurse`, creates a
-`nurse` user, `/etc/nurse/` (settings) and `/var/lib/nurse/` (your notes), and writes the
-systemd service and `/etc/nurse/nurse.env`. Then:
+This downloads the latest release (checking its SHA-256), installs `/usr/local/bin/mako`, creates a
+`mako` user, `/etc/mako/` (settings) and `/var/lib/mako/` (your notes), and writes the
+systemd service and `/etc/mako/mako.env`. Then:

 ```sh
-sudoedit /etc/nurse/nurse.env      # fill in the four Authentik lines at the top
-sudo systemctl start nurse
-journalctl -u nurse -f               # it says at once if a setting is missing or wrong
+sudoedit /etc/mako/mako.env      # fill in the four Authentik lines at the top
+sudo systemctl start mako
+journalctl -u mako -f               # it says at once if a setting is missing or wrong
 ```

-Nurse listens on `127.0.0.1:8490`. Put an HTTPS reverse proxy (or
+Mako listens on `127.0.0.1:8490`. Put an HTTPS reverse proxy (or
 [Hammerhead](https://git.veillax.com/Veillax/hammerhead)) in front of it and open the address you gave
-as `NURSE_PUBLIC_URL`. Authentik will only send people back to an address you allowed, and cookies
+as `MAKO_PUBLIC_URL`. Authentik will only send people back to an address you allowed, and cookies
 are marked Secure when that address is https.

 Run the installer again to upgrade; your settings and notes are kept and a running service is
@@ -86,12 +86,12 @@ instead) and `--uninstall` (add `--purge` to delete settings and notes). Read it
 ## Running it by hand or in Docker

 ```sh
-export NURSE_PUBLIC_URL=https://notes.example.com
-export NURSE_OIDC_ISSUER=https://auth.example.com/application/o/nurse/
-export NURSE_OIDC_CLIENT_ID=...
-export NURSE_OIDC_CLIENT_SECRET=...
-./nurse check     # optional: test the settings
-./nurse serve
+export MAKO_PUBLIC_URL=https://notes.example.com
+export MAKO_OIDC_ISSUER=https://auth.example.com/application/o/mako/
+export MAKO_OIDC_CLIENT_ID=...
+export MAKO_OIDC_CLIENT_SECRET=...
+./mako check     # optional: test the settings
+./mako serve
 ```

 Docker: see [`Dockerfile`](Dockerfile) and [`deploy/docker-compose.yml`](deploy/docker-compose.yml).
@@ -99,9 +99,9 @@ Docker: see [`Dockerfile`](Dockerfile) and [`deploy/docker-compose.yml`](deploy/
 ### Commands

 ```
-nurse serve [-config nurse.json] [-listen addr] [-data dir]
-nurse check [-config nurse.json]     test the Authentik settings without starting
-nurse version
+mako serve [-config mako.json] [-listen addr] [-data dir]
+mako check [-config mako.json]     test the Authentik settings without starting
+mako version
 ```

 ## Settings
@@ -111,15 +111,15 @@ written to it:

 | Setting | Variable | |
 | --- | --- | --- |
-| `public_url` | `NURSE_PUBLIC_URL` | where you open Nurse, no path |
-| `oidc.issuer` | `NURSE_OIDC_ISSUER` | the provider's issuer |
-| `oidc.client_id` | `NURSE_OIDC_CLIENT_ID` | |
-| `oidc.client_secret` | `NURSE_OIDC_CLIENT_SECRET` | |
-| `allowed` | `NURSE_ALLOWED` | optional; emails, usernames or Authentik ids, comma separated |
-| `listen` | `NURSE_LISTEN` | default `127.0.0.1:8490` |
-| `data_dir` | `NURSE_DATA` | default `data` |
+| `public_url` | `MAKO_PUBLIC_URL` | where you open Mako, no path |
+| `oidc.issuer` | `MAKO_OIDC_ISSUER` | the provider's issuer |
+| `oidc.client_id` | `MAKO_OIDC_CLIENT_ID` | |
+| `oidc.client_secret` | `MAKO_OIDC_CLIENT_SECRET` | |
+| `allowed` | `MAKO_ALLOWED` | optional; emails, usernames or Authentik ids, comma separated |
+| `listen` | `MAKO_LISTEN` | default `127.0.0.1:8490` |
+| `data_dir` | `MAKO_DATA` | default `data` |

-`nurse.json` also holds a `secret` that signs session cookies. It is made on first run and written
+`mako.json` also holds a `secret` that signs session cookies. It is made on first run and written
 with mode `0600`. Changing it signs everyone out.

 ## Where your notes are
@@ -147,13 +147,13 @@ Flights and hotels, see [[Packing list]] #travel
 ```

 A plain `.md` file dropped into `notes/` is picked up too, with its file time as its date (name it with
-lower-case letters, numbers and dashes). Restart Nurse to see files added by hand.
+lower-case letters, numbers and dashes). Restart Mako to see files added by hand.

 ## Security notes

 - Sign-in is Authentik only: the authorization code flow with PKCE, `state` and `nonce`, over https. The
  ID token comes straight from Authentik's token endpoint, and its issuer, audience, expiry and nonce
-  are checked. Authentik and Nurse must be reachable over https unless both are on the same machine.
+  are checked. Authentik and Mako must be reachable over https unless both are on the same machine.
 - Sessions are `HttpOnly`, `SameSite=Lax` cookies that last 14 days, signed with the secret in the
  settings file. Nothing is kept on the server, so a restart does not sign anyone out. The `allowed`
  list is checked on every request.
@@ -170,7 +170,7 @@ lower-case letters, numbers and dashes). Restart Nurse to see files added by han
 - No scripts or tokens for posting notes from elsewhere: Authentik is the only way in.
 - Searching holds every page in memory, which is comfortable for tens of thousands of pages and not
  built for millions.
- Pages are only reloaded from disk when Nurse starts.
+- Pages are only reloaded from disk when Mako starts.
 - Live preview works a line at a time (a code block counts as one), so a table or a quote spread over
  several lines shows rendered line by line. View shows the whole page as one.

@@ -183,7 +183,7 @@ The interface follows the Lightwell design language, the same one Hammerhead and

 ```sh
 go test ./...
-go run ./cmd/nurse serve        # with the NURSE_* variables set
+go run ./cmd/mako serve        # with the MAKO_* variables set
 ```

 Releases are built by the Gitea workflow when a `v*` tag is pushed.