From 9322e39a8ca29760066eefeb44e65594a288e724 Mon Sep 17 00:00:00 2001 From: Oier Bravo Urtasun Date: Thu, 23 Jul 2026 02:57:56 +0200 Subject: [PATCH] docs(files): oxps runs filestash auth-off (LAN-only) Two prod hosts now diverge on filestash auth: cochi stays htpasswd (internet-facing), oxps runs FILES_AUTH=none/passthrough since it is LAN-only, satisfying the internal-only gate. Document the per-host status table and the flip-back rule for if oxps ever gains an internet path. Co-Authored-By: Claude Opus 4.8 (1M context) --- plan/20-files.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/plan/20-files.md b/plan/20-files.md index 19093a7..3dc2e29 100644 --- a/plan/20-files.md +++ b/plan/20-files.md @@ -55,6 +55,20 @@ blocklisting (which would take `auth.` and the apex down with it, breaking login and the launcher for every player) all land on you. `render-config.sh` prints a loud warning when it renders this mode. +**Per-host auth status (the two prod envs diverge):** + +| Host | `files.` reachability | `FILES_AUTH` | Notes | +|---|---|---|---| +| `cochi` | internet-facing | `htpasswd` | shared `uli` login, `$6$` hash | +| `oxps` | **LAN-only** | **`none`** (passthrough) | auth off — gate satisfied (2026-07-23) | + +`oxps` runs auth-off deliberately: it is unreachable from the internet, so the +open-upload-relay risk above does not apply. Applied host-locally (`.env` +`FILES_AUTH=none` → `render-config.sh` → `docker compose up -d --force-recreate +filestash`); nothing committed — `.env` and the rendered `config.json` are both +gitignored per host. **If `oxps` ever gains an internet path, flip it back to +`htpasswd` (or set `FILES_MOUNT_MODE=ro`) before exposing it.** + **Shared credential ⇒ no audit trail, no per-person revocation.** You will never know who deleted a folder; rotating means re-telling everyone. Fine for a friends' media share — but nothing here is backed up, so treat the share as @@ -196,6 +210,7 @@ writable file manager. Pin the digest; upgrade deliberately — same discipline - **Keycloak SSO** — needs oauth2-proxy + `FILES_AUTH=passthrough`. Not built. - **Anonymous access** (`FILES_AUTH=none`) — only once the host is internal-only. + **Done on `oxps`** (LAN-only, 2026-07-23); still `htpasswd` on `cochi`. - **Landing page link** — deliberately none on day one; `plan/18-landing-rework.md` is mid-rework, so revisit with WS5 (footer) rather than merging into a moving design.