summaryrefslogtreecommitdiffstats
path: root/roseh.moe.go
AgeCommit message (Collapse)AuthorFilesLines
2026-08-15Revert "Properly use code unauthorized"Rose Hogenson1-25/+18
This reverts commit 5325d4b10d39a8873b445ce956a059ad6c2811fb.
2026-08-15Properly use code unauthorizedRose Hogenson1-18/+25
2026-08-15Fix redirect for /nezuko after loginRose Hogenson1-1/+1
2026-08-15Expose nezuko partition on /nezuko endpointRose Hogenson1-0/+14
2026-07-25Rename stallman-shooter to RMS shooterRose Hogenson1-2/+2
2026-07-25Port a game I wrote a long time ago to JSRose Hogenson1-2/+28
2026-07-24Fix path for URL and package indexesRose Hogenson1-2/+2
2026-07-23Avoid some allocations for the index pagesRose Hogenson1-83/+21
2026-07-23Add a command indexRose Hogenson1-2/+45
2026-07-23Add a package indexRose Hogenson1-11/+74
2026-07-23Add a helper function for making an outlined templateRose Hogenson1-9/+23
2026-07-13Handle routing errors in a more sensible wayRose Hogenson1-2/+4
2026-07-09Use PUT for the APIRose Hogenson1-2/+5
2026-07-09Include a newline at the end of the API responseRose Hogenson1-1/+1
2026-07-09Add an API uploadRose Hogenson1-6/+29
2026-07-09Add a /code directoryRose Hogenson1-1/+3
2026-06-09Fix the tar format to PAX formatRose Hogenson1-2/+2
2026-06-07Allow uploading multiple files to the wormholeRose Hogenson1-50/+151
2026-02-26Allow the previous OTPRose Hogenson1-5/+10
2026-02-06Do a little less sha256Rose Hogenson1-6/+4
Since oae2 will internally also call hkdf, there's no reason to hkdf the encryption key twice. We can hkdf it once for the primary key, and then let oae2 hkdf it again for the encryption key. Since the second hkdf uses a 32 byte random salt, the two calls will certainly use different parameters.
2026-02-06Keep redirect query param on incorrect passwordRose Hogenson1-7/+3
This makes it a little less weird when you enter an incorrect password and the URL changes.
2026-01-26Bump depsRose Hogenson1-2/+2
2026-01-21XML!!!Rose Hogenson1-20/+35
2026-01-03Support range requests for wormhole downloadsRose Hogenson1-14/+19
2025-12-29Fix error messagesRose Hogenson1-3/+10
2025-12-29Content-LengthRose Hogenson1-0/+12
2025-12-29Fix clean holeRose Hogenson1-31/+34
2025-12-29Distinguish no holeRose Hogenson1-1/+5
2025-12-29Make wormhole a little bit simplerRose Hogenson1-83/+144
2025-12-27Add Google AuthenticatorRose Hogenson1-10/+32
2025-12-07Use /pkg pathRose Hogenson1-1/+1
2025-12-07Increase target security to 32 bytesRose Hogenson1-7/+5
2025-11-30Use built-in cross-origin protectionRose Hogenson1-58/+20
2025-11-25Use a short cookie nameRose Hogenson1-1/+1
2025-11-21Slightly simplify the int encodingRose Hogenson1-14/+4
2025-11-21Separate MAC by domainRose Hogenson1-25/+18
2025-11-21Simplify the password hash and get rid of pbkdf2Rose Hogenson1-5/+6
Since the password already has 16 bytes of security, pbkdf2 isn't necessary here. We can use a simple sha256. I promise to pick a secure password.
2025-11-21Use a weird encoding for the time.TimeRose Hogenson1-14/+47
This way we can save 19 whole bytes per request 😲
2025-11-15Remove debugRose Hogenson1-2/+1
2025-11-15Fix cookie names and domainRose Hogenson1-6/+11
2025-11-15DebugRose Hogenson1-1/+2
2025-11-15Fix typoRose Hogenson1-1/+1
2025-11-15Preserve redirect path on errorRose Hogenson1-1/+2
2025-11-15Fix cross-domain loginRose Hogenson1-5/+9
2025-11-15Protect the reverse proxy with my hand-rolled authRose Hogenson1-46/+79
Defense in depth??
2025-11-10Validate the QR codeRose Hogenson1-5/+19
Since the qr code is generated by a 3rd party dependency that I probably won't update, let's make sure to only pass it trusted input.
2025-11-10IP?Rose Hogenson1-1/+1
2025-11-10Fix jellyfin portRose Hogenson1-1/+1
2025-11-10Get the credentials directory from a flagRose Hogenson1-3/+3
2025-11-10Add back jellyfin proxyRose Hogenson1-1/+18
We don't need no stupid nginx
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-04 13:09:24 +0000