puttaalu
434d2437bf
Add HTTP Basic auth on /upload, reading an Apache htpasswd file (bcrypt only, `htpasswd -B`) via a new -htpasswd flag. This lets nginx drop to a plain TLS-terminating reverse proxy with no auth of its own; the existing bcrypt htpasswd file is reused unchanged. auth.go: - LoadHtpasswd parses user:hash lines, keeps bcrypt entries ($2a/$2b/$2y, so Apache's $2y$ works), skips MD5/SHA/crypt with a warning. - Unknown users still pay for one bcrypt comparison against a dummy hash, so response timing can't enumerate valid usernames. - Failed attempts draw from a token-bucket limiter (x/time/rate, ~1/s, burst 10) returning 429 once drained; successful and bulk uploads never touch it. server.go guards both /upload routes (nil authenticator = passthrough for local --serve). /health stays open. Empty -htpasswd disables auth and logs a warning. module.nix: new top-level services.photogallery.htpasswdFile, delivered to the service via systemd LoadCredential (so a root-owned 0400 secret works). Removed nginx.htpasswdFile and basic_auth from the vhost. Both uploader apps already send Basic credentials, so no client change. Deps: golang.org/x/crypto/bcrypt, golang.org/x/time/rate (vendorHash bump).
45 lines
1.4 KiB
Nix
45 lines
1.4 KiB
Nix
{
|
|
description = "Minimal static photo gallery with Atom feed and upload API";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, flake-utils }:
|
|
flake-utils.lib.eachDefaultSystem (system:
|
|
let
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
in {
|
|
packages.default = pkgs.buildGoModule {
|
|
pname = "photogallery";
|
|
version = "0.1.0";
|
|
src = self;
|
|
|
|
# Run `go mod tidy` to generate go.sum, then `nix build`.
|
|
# Nix will fail and print the correct hash — paste it here.
|
|
vendorHash = "sha256-Q+VeDZX9DlZtOZrYRwZo19eyob8jIu19IRhdvChmVL4=";
|
|
|
|
meta = with pkgs.lib; {
|
|
description = "Minimal static photo gallery";
|
|
license = licenses.unlicense;
|
|
mainProgram = "photogallery";
|
|
platforms = platforms.linux;
|
|
};
|
|
};
|
|
|
|
devShells.default = pkgs.mkShell {
|
|
packages = [ pkgs.go pkgs.gopls pkgs.gotools ];
|
|
};
|
|
}
|
|
) // {
|
|
nixosModules.default = import ./module.nix self;
|
|
|
|
# Lets consumers add photogallery to their pkgs without
|
|
# pulling in the full flake module.
|
|
overlays.default = _final: _prev: {
|
|
photogallery = self.packages.${_final.system}.default;
|
|
};
|
|
};
|
|
}
|