0b639dfc3c
Adds a "Via AnyDrop" flow for senders who need to reach someone not present on the mesh. The file is sealed client-side (XChaCha20-Poly1305), uploaded directly to an in-cluster MinIO bucket via a presigned PUT, and handed off to the recipient as a URL whose fragment carries the key. The server only ever sees ciphertext, opaque metadata blobs, and sizes. - server: transfers table (drizzle migration), /api/transfers CRUD + consume endpoint, presigned PUT/GET via @aws-sdk/client-s3, cleanup loop that purges expired + exhausted blobs. - web: @noble/ciphers sealFile/openFile, high-level sendCloud/receive helpers, CloudSharePanel on Home, /r/:id receive page, /inbox page for signed-in users (sent + received tabs). - k8s: MinIO StatefulSet with bucket-init initContainer, S3 env vars on the server Deployment (credentials pulled from minio-credentials Secret). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
60 lines
2.0 KiB
YAML
60 lines
2.0 KiB
YAML
# ---------------------------------------------------------------------------
|
|
# Template for cluster secrets. DO NOT commit the real file.
|
|
#
|
|
# To create the real secrets on the cluster:
|
|
#
|
|
# # Postgres — generate a strong password
|
|
# POSTGRES_PASSWORD=$(openssl rand -base64 32 | tr -d '=+/')
|
|
# kubectl -n anydrop create secret generic postgres-credentials \
|
|
# --from-literal=username=anydrop \
|
|
# --from-literal=password="$POSTGRES_PASSWORD"
|
|
#
|
|
# # App secrets — session signing + DB URL
|
|
# SESSION_SECRET=$(openssl rand -base64 64 | tr -d '=+/')
|
|
# DATABASE_URL="postgres://anydrop:${POSTGRES_PASSWORD}@postgres.anydrop.svc.cluster.local:5432/anydrop"
|
|
# kubectl -n anydrop create secret generic anydrop-app-secrets \
|
|
# --from-literal=SESSION_SECRET="$SESSION_SECRET" \
|
|
# --from-literal=DATABASE_URL="$DATABASE_URL"
|
|
#
|
|
# # MinIO (object storage for the encrypted relay)
|
|
# MINIO_ACCESS_KEY=$(openssl rand -hex 16)
|
|
# MINIO_SECRET_KEY=$(openssl rand -base64 40 | tr -d '=+/')
|
|
# kubectl -n anydrop create secret generic minio-credentials \
|
|
# --from-literal=access_key="$MINIO_ACCESS_KEY" \
|
|
# --from-literal=secret_key="$MINIO_SECRET_KEY"
|
|
#
|
|
# Rotate by replacing the secret and restarting the pods:
|
|
# kubectl -n anydrop rollout restart deployment/anydrop-server
|
|
# ---------------------------------------------------------------------------
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: postgres-credentials
|
|
namespace: anydrop
|
|
type: Opaque
|
|
stringData:
|
|
username: anydrop
|
|
password: CHANGE_ME_STRONG_PASSWORD
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: anydrop-app-secrets
|
|
namespace: anydrop
|
|
type: Opaque
|
|
stringData:
|
|
SESSION_SECRET: CHANGE_ME_64_BYTE_RANDOM_STRING
|
|
DATABASE_URL: postgres://anydrop:CHANGE_ME@postgres.anydrop.svc.cluster.local:5432/anydrop
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: minio-credentials
|
|
namespace: anydrop
|
|
type: Opaque
|
|
stringData:
|
|
access_key: CHANGE_ME_ACCESS_KEY
|
|
secret_key: CHANGE_ME_SECRET_KEY
|