summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2025-12-27Add Google AuthenticatorRose Hogenson7-13/+114
2025-12-07Update finditerRose Hogenson2-10/+10
2025-12-07Use /pkg pathRose Hogenson4-4/+4
2025-12-07Increase target security to 32 bytesRose Hogenson7-9/+109
2025-12-01Fix nix vendor hashRose Hogenson1-1/+1
2025-12-01Bump cclRose Hogenson2-3/+3
2025-11-30Get rid of flakeRose Hogenson2-81/+15
2025-11-30Rename flake.nixRose Hogenson1-0/+0
2025-11-30Bump Go versionRose Hogenson1-1/+1
2025-11-30Use built-in cross-origin protectionRose Hogenson2-59/+20
2025-11-25Use a short cookie nameRose Hogenson1-1/+1
2025-11-24Update cclRose Hogenson3-4/+4
2025-11-21Slightly simplify the int encodingRose Hogenson1-14/+4
2025-11-21Separate MAC by domainRose Hogenson1-25/+18
2025-11-21Simplify the password hash and get rid of pbkdf2Rose Hogenson7-120/+7
Since the password already has 16 bytes of security, pbkdf2 isn't necessary here. We can use a simple sha256. I promise to pick a secure password.
2025-11-21Use a weird encoding for the time.TimeRose Hogenson2-15/+48
This way we can save 19 whole bytes per request 😲
2025-11-20Bump CCL versionRose Hogenson2-3/+3
2025-11-20Clean up the static filesRose Hogenson9-43/+2
2025-11-15Remove debugRose Hogenson1-2/+1
2025-11-15Fix cookie names and domainRose Hogenson1-6/+11
2025-11-15DebugRose Hogenson1-1/+2
2025-11-15Fix typoRose Hogenson1-1/+1
2025-11-15Preserve redirect path on errorRose Hogenson1-1/+2
2025-11-15Fix cross-domain loginRose Hogenson2-6/+10
2025-11-15Protect the reverse proxy with my hand-rolled authRose Hogenson2-48/+81
Defense in depth??
2025-11-10Validate the QR codeRose Hogenson2-6/+20
Since the qr code is generated by a 3rd party dependency that I probably won't update, let's make sure to only pass it trusted input.
2025-11-10Confirm passwordRose Hogenson1-0/+10
2025-11-10IP?Rose Hogenson1-1/+1
2025-11-10Fix jellyfin portRose Hogenson1-1/+1
2025-11-10Get the credentials directory from a flagRose Hogenson1-3/+3
2025-11-10Add back jellyfin proxyRose Hogenson1-1/+18
We don't need no stupid nginx
2025-11-02Fix a panicRose Hogenson1-1/+4
2025-11-02Actually show QR codeRose Hogenson1-1/+2
2025-11-02Improve the upload success screenRose Hogenson3-1/+17
2025-11-02Add QR codeRose Hogenson4-3/+16
2025-11-02Remove server sent eventsRose Hogenson3-91/+64
2025-11-02Fix flake hashRose Hogenson1-1/+1
2025-11-02Bump depsRose Hogenson2-1/+3
2025-10-28Fix flake hash (sigh)Rose Hogenson2-4/+4
2025-10-28Switch to cclRose Hogenson4-22/+17
2025-10-26Fix nix flake hashRose Hogenson1-1/+1
2025-10-26Bump depsRose Hogenson2-3/+3
2025-10-25Fix service configRose Hogenson1-4/+10
2025-10-25Fix nix flake vendor hashRose Hogenson2-4/+4
2025-10-25Fix go mod versionRose Hogenson2-10/+10
2025-10-25asspb fixesRose Hogenson1-12/+6
2025-10-25Use asspb instead of iniRose Hogenson4-91/+36
2025-10-14Revert "Remove CSRF tokens"Rose Hogenson3-32/+78
This reverts commit 21d7462b057838eb173145d79d2b9fd6c71e8053. This was a great idea, but tanjiro is still on Go 1.24
2025-10-14Remove CSRF tokensRose Hogenson3-78/+32
I think the built-in cross-origin protection will be good enough.
2025-10-08Validate that secrets were loadedRose Hogenson1-0/+6
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-04 08:07:15 +0000