r-zakarya
ec4fa433a9
Alternative to WebDAV, and the base for an Android client. The server never decrypts: it stores and serves opaque bytes, so a compromise yields ciphertext plus size and mtime. GET only for now, with a strong ETag and If-None-Match; PUT answers 405 explicitly so a client fails loudly rather than believing it wrote. A bad token answers 404 like a missing snapshot, so an unauthenticated caller learns nothing. HTTPS is required - the bearer token rides a header on every call.
18 lines
681 B
PHP
18 lines
681 B
PHP
<?php
|
|
/**
|
|
* Copy to config.php and fill in. config.php is gitignored — it holds a secret.
|
|
*/
|
|
|
|
declare(strict_types=1);
|
|
|
|
// Bearer token the clients send. Generate one, never reuse a password:
|
|
// php -r "echo bin2hex(random_bytes(32)), PHP_EOL;"
|
|
// It authenticates the DEVICE, not the vault: it grants access to the
|
|
// ciphertext only. The sync password (which decrypts it) never leaves the
|
|
// clients and is never known to this server.
|
|
const SYNC_TOKEN = 'PUT-A-64-HEX-TOKEN-HERE';
|
|
|
|
// Where the snapshot lives. Keep it OUTSIDE the web root: served through this
|
|
// script only, never fetchable as a static file.
|
|
const SYNC_FILE = __DIR__ . '/../vault-data/vault-sync.json';
|