mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
nvrl
a641d9b6ba
Argon2id turns the vault password into a key that seals a random master key; only the sealed copy is kept. Each file gets its own key, sealed under the master key in its header with its media id, and its bytes are AES-256-GCM STREAM records, so a swapped, cut or altered file refuses to open. Uploads with ?encrypt=true are sealed as they stream in. :vault, :unlock, :lock, :passwd, :encrypt, :decrypt and :upload! drive it. The vault locks after WORKSPACE_VAULT_IDLE_MIN idle minutes, on logout and on restart; while locked, sealed files answer 423, share links never serve them, and :export! refuses rather than leave them out. Sealing an existing file rewrites it under a new id and retires the old one: the mirror deletes the plaintext from Proton Drive outright, trash included, whatever WORKSPACE_BACKUP_PRUNE says, and drops it from the readable files/ view. The mirror now compares on-disk sizes, so sealed files are not re-hashed every run.
97 lines
4.0 KiB
Bash
97 lines
4.0 KiB
Bash
# Every setting is read as WORKSPACE_<NAME>. The old DIARY_<NAME> spelling is
|
|
# still accepted, so a deployment configured before the rename keeps running.
|
|
|
|
# The one and only account. Both are checked in constant time on login.
|
|
WORKSPACE_USER=narl
|
|
WORKSPACE_PASSWORD=change-me
|
|
|
|
# Signs session cookies. Rotate it to log every device out. 32+ random chars.
|
|
# Generate one with: openssl rand -base64 32
|
|
WORKSPACE_SECRET=replace-with-32-random-characters
|
|
|
|
# Where the SQLite database and uploaded media live.
|
|
WORKSPACE_DATA_DIR=./data
|
|
|
|
# Address to listen on. Put a TLS terminating reverse proxy in front of this.
|
|
WORKSPACE_BIND=127.0.0.1:4242
|
|
|
|
# How long a login lasts, in days.
|
|
WORKSPACE_SESSION_DAYS=30
|
|
|
|
# Largest upload, in megabytes: one request, or what an imported zip unpacks
|
|
# to. Uploads stream to disk, so this bounds the disk, not the memory.
|
|
WORKSPACE_MAX_UPLOAD_MB=1024
|
|
|
|
# Set to 1 once the app is served over HTTPS, so the cookie gets `Secure`.
|
|
WORKSPACE_SECURE_COOKIE=0
|
|
|
|
# --- SFTP mount --------------------------------------------------------------
|
|
# Off until this is set. Once it's up, register a key with `:sshkey add <name>
|
|
# <ssh-ed25519 ...>` in the app, then `sshfs -P <port> anything@host:/ mnt/`
|
|
# (the username is ignored — only the key decides who gets in).
|
|
#
|
|
# On the mount, `mkdir` at the root makes a space and anywhere else a folder;
|
|
# a new `.md` file is a new document. A leading `# Heading` is the document's
|
|
# title. Editor temp, swap and backup files are kept in memory for the session
|
|
# only, and renaming one onto a `.md` name saves it into that document.
|
|
#
|
|
# Under Docker, bind 0.0.0.0 (not 127.0.0.1) as the app listens inside the
|
|
# container — the host-side address in compose.yml's `ports:` is what
|
|
# actually restricts who can reach it.
|
|
# WORKSPACE_SFTP_BIND=127.0.0.1:2222
|
|
|
|
# --- Proton Drive backup -----------------------------------------------------
|
|
# Off until `narl-workspace proton-login` stores a session under WORKSPACE_DATA_DIR.
|
|
# These only shape how often the mirror runs.
|
|
|
|
# The device the server registers in Proton Drive; its sync root is the folder
|
|
# the diary is mirrored into.
|
|
WORKSPACE_PROTON_DEVICE=narl-workspace
|
|
|
|
# Backstop between runs, in minutes. 0 leaves it change-driven only.
|
|
WORKSPACE_BACKUP_INTERVAL_MIN=60
|
|
|
|
# How long the diary must be quiet after a change before it is mirrored, so a
|
|
# writing session uploads once rather than after every save.
|
|
WORKSPACE_BACKUP_DEBOUNCE_SEC=300
|
|
|
|
# Set to 1 to let a deletion here trash the mirrored file there. Off by
|
|
# default: a backup that forgets on command is one accident from being none.
|
|
WORKSPACE_BACKUP_PRUNE=0
|
|
|
|
# --- Notification mail -------------------------------------------------------
|
|
# Off until WORKSPACE_SMTP_URL is set. Nothing is even queued while it is unset.
|
|
|
|
# The relay. `smtps://host:465` is implicit TLS, `smtp://host:587?tls=required`
|
|
# is STARTTLS, and a bare `smtp://host:1025` is plain — which only belongs on a
|
|
# local mail catcher. Credentials may live in the URL or in the two variables
|
|
# below.
|
|
# WORKSPACE_SMTP_URL=smtps://mail.example.org:465
|
|
# WORKSPACE_SMTP_USER=
|
|
# WORKSPACE_SMTP_PASSWORD=
|
|
|
|
# Where the mail comes from and goes to. FROM defaults to TO.
|
|
# WORKSPACE_MAIL_FROM=workspace@example.org
|
|
# WORKSPACE_MAIL_TO=you@example.org
|
|
|
|
# "Did I write today?" and "is this due today?" are local-day questions, and the
|
|
# answer changes with the timezone rather than with a fixed offset.
|
|
WORKSPACE_TIMEZONE=Europe/Berlin
|
|
|
|
# When to ask about the diary, if nothing was written in it that day. `off`
|
|
# turns it into no reminder at all.
|
|
WORKSPACE_REMINDER_AT=20:00
|
|
|
|
# When to mail about cards that are due today or already overdue.
|
|
WORKSPACE_CARD_DUE_AT=08:00
|
|
|
|
# Weekday and time of the weekly digest.
|
|
WORKSPACE_DIGEST_AT=sun 18:00
|
|
|
|
# Which of the four kinds may be sent. Drop one from the list to switch it off.
|
|
WORKSPACE_MAIL_KINDS=reminder,card_due,digest,login
|
|
|
|
# Minutes the vault stays open with nothing using it, before it locks itself.
|
|
# It also locks on logout and whenever the server restarts.
|
|
WORKSPACE_VAULT_IDLE_MIN=15
|