feat(sync): read-only PHP endpoint serving the encrypted snapshot

Alternative to WebDAV, and the base for an Android client. The server never decrypts: it stores and serves opaque bytes, so a compromise yields ciphertext plus size and mtime. GET only for now, with a strong ETag and If-None-Match; PUT answers 405 explicitly so a client fails loudly rather than believing it wrote. A bad token answers 404 like a missing snapshot, so an unauthenticated caller learns nothing. HTTPS is required - the bearer token rides a header on every call.
2026-08-14 17:41:34 +01:00
parent c74b708b39
commit ec4fa433a9
4 changed files with 168 additions and 0 deletions
@@ -66,3 +66,7 @@ delphi-backend/vault - Copie*.db
 # Delphi build artifacts
 delphi-backend/*.vrc
 delphi-backend/*.$manifest
+
+# PHP sync endpoint — holds the bearer token / the snapshot itself
+server-php/config.php
+vault-data/