mirror of
https://github.com/storytold/figcraft.git
synced 2026-10-24 10:27:00 -06:00
bflatastic
e0435d4eb4
Second security review: - a broadcast counts once against the queued-bytes budget; each block of addresses gets at most an eighth; when the budget runs out the biggest consumer is shed, not the receiver - forced compactions at most once a minute per file - plugin downloads check the per-address share before the global budget and before reading - install.sh never replaces a Caddyfile with other sites (one import line, once; install-test.sh in packaging lint); the built binary runs only as the server's account - bytes being read count against per-block and global budgets, the biggest readers dropped first - block multipliers x2 (/56) and x4 (/48), connection caps at most a sixteenth/eighth of all; global publish and download budgets eight times a /48's share - problems capped at 200; writes refused below max(1 GiB, two files) free; the private-server file cap documented
47 lines
1.6 KiB
TOML
47 lines
1.6 KiB
TOML
[package]
|
|
name = "figcraft-server"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
publish = false
|
|
description = "FigCraft's standalone collaboration server: keeps many files with share links (edit or view), persists them as snapshots plus a log, and serves live sessions (headless, native only)"
|
|
|
|
[lib]
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "figcraft-server"
|
|
path = "src/main.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
figcraft-collab = { workspace = true }
|
|
figcraft-collab-net = { workspace = true }
|
|
# Checking a team library before keeping it (read as files using it read it).
|
|
figcraft-format = { workspace = true }
|
|
# Checking plugin bundles before the plugin directory keeps them (never run here).
|
|
figcraft-plugin = { workspace = true }
|
|
log = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
crc32fast = { workspace = true }
|
|
toml = "1"
|
|
env_logger = { version = "0.11", default-features = false, features = ["humantime"] }
|
|
# Stopping gracefully on SIGTERM/SIGINT/SIGHUP (systemd, Docker, Ctrl+C) and Ctrl+C/close on Windows.
|
|
ctrlc = { version = "3", features = ["termination"] }
|
|
|
|
# Free space on the data directory's disk (statvfs, without unsafe code of our own).
|
|
[target.'cfg(unix)'.dependencies]
|
|
rustix = { version = "1", default-features = false, features = ["std", "fs"] }
|
|
|
|
[dev-dependencies]
|
|
# Crafting hostile archives (zip bombs) in tests.
|
|
zip = { workspace = true }
|
|
wat = { workspace = true }
|
|
figcraft-engine = { workspace = true }
|
|
figcraft-doc = { workspace = true }
|
|
tungstenite = { version = "0.30", default-features = false, features = ["handshake"] }
|