summaryrefslogtreecommitdiffstats
path: root/roseh.moe.go
AgeCommit message (Collapse)AuthorFilesLines
2026-07-23Add a helper function for making an outlined templateRose Hogenson1-9/+23
2026-07-13Handle routing errors in a more sensible wayRose Hogenson1-2/+4
2026-07-09Use PUT for the APIRose Hogenson1-2/+5
2026-07-09Include a newline at the end of the API responseRose Hogenson1-1/+1
2026-07-09Add an API uploadRose Hogenson1-6/+29
2026-07-09Add a /code directoryRose Hogenson1-1/+3
2026-06-09Fix the tar format to PAX formatRose Hogenson1-2/+2
2026-06-07Allow uploading multiple files to the wormholeRose Hogenson1-50/+151
2026-02-26Allow the previous OTPRose Hogenson1-5/+10
2026-02-06Do a little less sha256Rose Hogenson1-6/+4
Since oae2 will internally also call hkdf, there's no reason to hkdf the encryption key twice. We can hkdf it once for the primary key, and then let oae2 hkdf it again for the encryption key. Since the second hkdf uses a 32 byte random salt, the two calls will certainly use different parameters.
2026-02-06Keep redirect query param on incorrect passwordRose Hogenson1-7/+3
This makes it a little less weird when you enter an incorrect password and the URL changes.
2026-01-26Bump depsRose Hogenson1-2/+2
2026-01-21XML!!!Rose Hogenson1-20/+35
2026-01-03Support range requests for wormhole downloadsRose Hogenson1-14/+19
2025-12-29Fix error messagesRose Hogenson1-3/+10
2025-12-29Content-LengthRose Hogenson1-0/+12
2025-12-29Fix clean holeRose Hogenson1-31/+34
2025-12-29Distinguish no holeRose Hogenson1-1/+5
2025-12-29Make wormhole a little bit simplerRose Hogenson1-83/+144
2025-12-27Add Google AuthenticatorRose Hogenson1-10/+32
2025-12-07Use /pkg pathRose Hogenson1-1/+1
2025-12-07Increase target security to 32 bytesRose Hogenson1-7/+5
2025-11-30Use built-in cross-origin protectionRose Hogenson1-58/+20
2025-11-25Use a short cookie nameRose Hogenson1-1/+1
2025-11-21Slightly simplify the int encodingRose Hogenson1-14/+4
2025-11-21Separate MAC by domainRose Hogenson1-25/+18
2025-11-21Simplify the password hash and get rid of pbkdf2Rose Hogenson1-5/+6
Since the password already has 16 bytes of security, pbkdf2 isn't necessary here. We can use a simple sha256. I promise to pick a secure password.
2025-11-21Use a weird encoding for the time.TimeRose Hogenson1-14/+47
This way we can save 19 whole bytes per request 😲
2025-11-15Remove debugRose Hogenson1-2/+1
2025-11-15Fix cookie names and domainRose Hogenson1-6/+11
2025-11-15DebugRose Hogenson1-1/+2
2025-11-15Fix typoRose Hogenson1-1/+1
2025-11-15Preserve redirect path on errorRose Hogenson1-1/+2
2025-11-15Fix cross-domain loginRose Hogenson1-5/+9
2025-11-15Protect the reverse proxy with my hand-rolled authRose Hogenson1-46/+79
Defense in depth??
2025-11-10Validate the QR codeRose Hogenson1-5/+19
Since the qr code is generated by a 3rd party dependency that I probably won't update, let's make sure to only pass it trusted input.
2025-11-10IP?Rose Hogenson1-1/+1
2025-11-10Fix jellyfin portRose Hogenson1-1/+1
2025-11-10Get the credentials directory from a flagRose Hogenson1-3/+3
2025-11-10Add back jellyfin proxyRose Hogenson1-1/+18
We don't need no stupid nginx
2025-11-02Fix a panicRose Hogenson1-1/+4
2025-11-02Improve the upload success screenRose Hogenson1-1/+9
2025-11-02Add QR codeRose Hogenson1-0/+12
2025-11-02Remove server sent eventsRose Hogenson1-68/+47
2025-10-28Switch to cclRose Hogenson1-18/+11
2025-10-25Fix service configRose Hogenson1-4/+10
2025-10-25asspb fixesRose Hogenson1-12/+6
2025-10-25Use asspb instead of iniRose Hogenson1-39/+30
2025-10-14Revert "Remove CSRF tokens"Rose Hogenson1-32/+76
This reverts commit 21d7462b057838eb173145d79d2b9fd6c71e8053. This was a great idea, but tanjiro is still on Go 1.24
2025-10-14Remove CSRF tokensRose Hogenson1-76/+32
I think the built-in cross-origin protection will be good enough.
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-04 14:59:24 +0000