No description
c3b8af7189
The previous split (MediaAttacher + MediaDownloader + UrlSafetyGuard interface + DnsUrlSafetyGuard impl + provider binding) was over-engineered for one production implementation. Roll it all back into a single MediaAttacher class and delegate to the existing `Workspace::addMediaFromPath` helper for storage + Media row creation (the same path the web upload flow uses). What's gone: - app/Services/Post/MediaDownloader.php - app/Services/Post/UrlSafetyGuard.php (interface) - app/Services/Post/DnsUrlSafetyGuard.php (impl) - tests/Unit/Services/Post/DnsUrlSafetyGuardTest.php - The provider bind in AppServiceProvider What's still defended: - Streaming download via Http::sink with a Guzzle progress callback that aborts mid-stream once MAX_BYTES is exceeded (no body buffered in PHP). - Redirects disabled so a 200→302 trick can't pivot to internal hosts. - IP-literal SSRF guard: rejects loopback / private / link-local / reserved ranges via FILTER_FLAG_NO_PRIV_RANGE | NO_RES_RANGE. DNS hostnames are accepted — finer SSRF (DNS rebinding etc.) is left to network-level egress controls. This is a deliberate simplification: the prior DNS resolution defense added a class + interface + provider binding for marginal gain when the realistic attack surface is hard-coded internal IPs. - Strict MIME allowlist (no SVG, no PDF, no application/*). - Lock-then-merge into post.media[] to avoid lost-update races. Tests bypass the SSRF check via the static `MediaAttacher::fakeUrlSafety()` called once in tests/TestCase::setUp — same idiom as Mail::fake / Bus::fake. |
||
|---|---|---|
| .claude/skills | ||
| .github | ||
| app | ||
| bootstrap | ||
| config | ||
| database | ||
| lang | ||
| maizzle | ||
| public | ||
| resources | ||
| routes | ||
| storage | ||
| stubs | ||
| templates | ||
| tests | ||
| .editorconfig | ||
| .env.ci | ||
| .env.example | ||
| .env.testing | ||
| .gitattributes | ||
| .gitignore | ||
| .mcp.json | ||
| .prettierignore | ||
| .prettierrc | ||
| artisan | ||
| boost.json | ||
| CLAUDE.md | ||
| components.json | ||
| compose.yaml | ||
| composer.json | ||
| composer.lock | ||
| eslint.config.js | ||
| GEMINI.md | ||
| LICENSE.md | ||
| package-lock.json | ||
| package.json | ||
| phpunit.xml | ||
| pint.json | ||
| README.md | ||
| tsconfig.json | ||
| vite.config.ts | ||
The open-source social media scheduling platform
Schedule, manage, and publish content to all your social media accounts from one place.
Self-hosted. Privacy-focused. No limits.
Documentation • Roadmap • Community
Why TryPost?
Tired of paying expensive monthly fees for social media scheduling tools? Want full control over your data? TryPost is the solution.
| 100% Open Source | Inspect the code, contribute, make it yours |
| Self-Hosted | Your data stays on your servers |
| No Limits | Schedule unlimited posts, connect unlimited accounts |
| Privacy First | No tracking, no analytics, no data selling |
Features
| Visual Calendar | Drag and drop posts across your content calendar |
| Post Composer | Create and preview posts for multiple platforms at once |
| Media Library | Upload images and videos with automatic optimization |
| Team Collaboration | Invite team members with role-based permissions (Owner, Admin, Member) |
| Workspaces | Manage multiple brands or clients separately |
| REST API | Full API with Bearer token authentication |
| MCP Server | AI-ready with Model Context Protocol support |
| Google Login | Sign up and log in with Google OAuth |
| Notifications | In-app and email notifications for post status |
| i18n | Available in English, Spanish, and Portuguese |
Supported Platforms
 X (Twitter) |
 |
 |
 |
 TikTok |
 YouTube |
 |
 Threads |
 Bluesky |
 Mastodon |
Tech Stack
| Layer | Technology |
|---|---|
| Backend | Laravel 13, PHP 8.4 |
| Frontend | Vue 3, Inertia.js v3, Tailwind CSS v4 |
| Database | PostgreSQL |
| Queue | Redis + Laravel Horizon |
| WebSockets | Laravel Reverb |
| API | REST with Bearer token auth |
| MCP | Laravel MCP for AI integrations |
| Payments | Laravel Cashier (Stripe) |
Getting Started
Get TryPost running in minutes:
| Installation Guide | Step-by-step setup |
| Docker Setup | Run with Laravel Sail |
| Configuration | Environment setup |
| Platform Setup | Connect your social accounts |
Quick Start
git clone https://github.com/trypost-it/trypost.git
cd trypost
cp .env.example .env
composer install
npm install
php artisan key:generate
php artisan migrate
npm run build
API
TryPost includes a REST API for programmatic access. All endpoints are under /api and require a Bearer token.
curl -H "Authorization: Bearer tp_your_token" \
https://your-domain.com/api/posts
See the API documentation for all available endpoints.
MCP Server
TryPost ships with a Model Context Protocol (MCP) server at /mcp/trypost, enabling AI assistants to manage your social media directly.
Contributing
We love contributions! Check the issues for open tasks.
- Discussions - Ask questions, share ideas
- Issues - Report bugs, request features
License
TryPost is licensed under the Functional Source License (FSL).
You can: Use for personal or business use, self-host, modify and contribute.
You cannot: Offer as a competing SaaS, white-label and resell.
If TryPost helps you, please give us a star