mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 20:27:02 +01:00
Krzysztof kuhy Rudnicki
20bc1aeb02
Add setup_dufs_cloud.sh: a self-sustaining installer that stands up dufs (single Rust binary; web UI + built-in WebDAV) on 127.0.0.1:5000 behind the existing Caddy + DuckDNS exposure stack at a new subdomain, so files are reachable from mobile network over HTTPS. An event-driven systemd path unit mirrors ~/Keepass/Passwords.kdbx into the served folder on every change, so KeePassDX syncs the vault natively over WebDAV. Paranoid secret handling for the gitignored .dufs_cloud.conf (plaintext web password): ignored at repo-root + linux_configuration + **/ globs; a new check-no-dufs-conf pre-commit hook blocks it even against `git add -f`; the installer refuses to write it unless git check-ignore confirms it is ignored; the password is hashed via `openssl passwd -6 -stdin` (never in argv); and a cloud-root guard forbids serving home/.ssh/.config/.gnupg/the repo/root. Verified: dufs auth (401/200) + WebDAV (207) against the real v0.46.0 binary, idempotent Caddy/DuckDNS/unit-render logic, and a live phone-on-cellular test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0126QvdMrv2WNeUVShFiLTc3
26 lines
1021 B
Bash
Executable File
26 lines
1021 B
Bash
Executable File
#!/bin/bash
|
|
# ============================================================================
|
|
# Pre-commit guard: never allow the dufs cloud secret config to be committed.
|
|
#
|
|
# .dufs_cloud.conf holds the plaintext dufs web password. It is gitignored, but
|
|
# `git add -f` can bypass gitignore — this hook is the backstop. It inspects the
|
|
# staged set directly (not just the files pre-commit passes) so it catches a
|
|
# force-added file regardless of any `files:` filter.
|
|
# ============================================================================
|
|
set -euo pipefail
|
|
|
|
# Added/Copied/Modified staged paths.
|
|
staged="$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)"
|
|
|
|
bad="$(printf '%s\n' "$staged" | grep -E '(^|/)\.dufs_cloud\.conf$' || true)"
|
|
|
|
if [ -n "$bad" ]; then
|
|
echo "ERROR: refusing to commit the dufs secret config (plaintext password):" >&2
|
|
printf ' %s\n' "$bad" >&2
|
|
echo "" >&2
|
|
echo "This file must stay local only. Unstage it: git rm --cached <file>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|