mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
nvrl
ee13ae44fa
Media answers Range requests with 206 and Content-Range, so videos seek and Safari plays them. Sealed files too: the vault's opener now decrypts by record position (STREAM BE32 through StreamPrimitive, the same construction and the same files), so a range starts at the record that holds its first byte. Compression is limited to text, because a gzipped body no longer matches the byte ranges a player asks for. GET /api/health answers without a session once the database does, and the compose healthcheck asks it instead of only opening the port. Requests are logged at info with share tokens and keys left out of the path and no query strings. A request that is not answered in 30 seconds gets a 503, except uploads, imports, the export, re-sealing and backups. The backup, mail, sweep and SFTP loops run under a supervisor that logs a panic and starts the loop again. The backup loop starts without a Proton session and picks up a later proton-login without a restart. A lock file keeps backup-now and the server from mirroring at once, and an unreadable session key file turns backups off instead of failing boot. Numbers in the configuration are checked against bounds at startup, so a session length or an upload limit can no longer overflow later, and a switch that is neither on nor off is an error rather than off. Config and MailConfig print with the password, secret and SMTP URL redacted. A session epoch is signed into each cookie (migration 0014). :logout! advances it, which ends every session, and a changed WORKSPACE_PASSWORD advances it on the next start. Cookies issued before this keep working in the first epoch.
80 lines
3.2 KiB
TOML
80 lines
3.2 KiB
TOML
[package]
|
|
name = "narl-workspace"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
description = "A terminal-themed personal diary for the browser"
|
|
|
|
[dependencies]
|
|
axum = { version = "0.8", features = ["multipart", "macros"] }
|
|
tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "fs", "io-util"] }
|
|
tower = "0.5"
|
|
tokio-util = { version = "0.7", features = ["io"] }
|
|
tower-http = { version = "0.6", features = ["trace", "compression-gzip", "limit", "set-header"] }
|
|
sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "migrate", "macros"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
dotenvy = "0.15"
|
|
uuid = { version = "1", features = ["v4"] }
|
|
rand = "0.8"
|
|
hmac = "0.12"
|
|
sha2 = "0.10"
|
|
base64 = "0.22"
|
|
subtle = "2"
|
|
mime_guess = "2"
|
|
rust-embed = { version = "8", features = ["interpolate-folder-path"] }
|
|
regex = "1"
|
|
anyhow = "1"
|
|
zip = { version = "2", default-features = false, features = ["deflate"] }
|
|
tempfile = "3.27.0"
|
|
# Only for `--features keyring`, on a host that has a Secret Service; the
|
|
# container deployment has no session bus and falls back to the session file.
|
|
keyring = { version = "3", features = ["sync-secret-service", "crypto-rust"], optional = true }
|
|
|
|
# Mail. rustls rather than native-tls: the container has no OpenSSL, and the
|
|
# Proton client already pulls rustls in.
|
|
lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "pool", "builder", "hostname", "tokio1-rustls-tls"] }
|
|
# "did I write today?" and "is this due today?" are local-day questions, and DST
|
|
# rules out doing them with a fixed offset.
|
|
chrono = { version = "0.4", default-features = false, features = ["clock", "std"] }
|
|
chrono-tz = "0.10"
|
|
|
|
# The vault: files encrypted at rest under a key only a password unlocks.
|
|
# AES-256-GCM in the STREAM construction, so a file of any size is sealed and
|
|
# opened a chunk at a time; Argon2id between the password and the key.
|
|
aes-gcm = { version = "0.10", features = ["stream"] }
|
|
argon2 = "0.5"
|
|
zeroize = { version = "1", features = ["serde"] }
|
|
futures-util = { version = "0.3", default-features = false, features = ["std"] }
|
|
|
|
proton-drive-rs = "0.9.2"
|
|
proton-sdk = "0.9.2"
|
|
rpassword = "7"
|
|
hex = "0.4"
|
|
|
|
# SFTP mount: spaces and folders as a filesystem, authenticated by pubkey
|
|
# instead of the cookie session. `ring` rather than the default `aws-lc-rs`
|
|
# backend, because rustls (via lettre) already pulls `ring` in.
|
|
russh = { version = "0.63", default-features = false, features = ["ring", "rsa"] }
|
|
russh-sftp = "3"
|
|
# Only for generating the host key at first boot — ssh-key needs an rng that
|
|
# speaks rand_core 0.10, one major version past the `rand` used everywhere else.
|
|
rand10 = { package = "rand", version = "0.10" }
|
|
|
|
[dev-dependencies]
|
|
# A paused clock, so tests of timed loops do not wait in real time.
|
|
tokio = { version = "1", features = ["test-util"] }
|
|
|
|
[features]
|
|
default = []
|
|
# Keep the Proton session in the OS keyring instead of a 0600 file. Needs a
|
|
# Secret Service on D-Bus, so it is off for the container deployment.
|
|
keyring = ["dep:keyring"]
|
|
|
|
[profile.release]
|
|
opt-level = 3
|
|
lto = true
|
|
codegen-units = 1
|
|
strip = true
|