GitXplorerGitXplorer
u

mysteryshack

public
116 stars
6 forks
16 issues

Commits

List of commits on branch master.
Unverified
7413ecc205568ac3ad0696411f6b9a55526546c6

NOT MAINTAINED

uuntitaker committed 7 years ago
Unverified
deaa8e5340008a853de2742184043095bcf5fb54

Fix makefile

uuntitaker committed 8 years ago
Unverified
9812201ad3441f8879f23a25c9368fb8d570e084

Fix config again

uuntitaker committed 8 years ago
Unverified
b2154ed0ba5528f833e699e7389808f7d6ebc5db

Fix config parser

uuntitaker committed 8 years ago
Unverified
9e43e7890de22a18caf316317cb580945ba50aea

toml upgrade

uuntitaker committed 8 years ago
Unverified
7a7b06efc2252feefcf681c19a3a892218e7f447

rustup

uuntitaker committed 8 years ago

README

The README file for this repository.

not maintained

Please see https://github.com/untitaker/mysteryshack/issues/74

mysteryshack Build Status

Mysteryshack is a lightweight, yet self-contained remoteStorage-server.

This project is still in active development. Do not use with sensitive data, or without backup.

Use username demo and password demo on my server to try it out. Don't use that account for actual data though: It is reset daily.

Installation

You need OpenSSL installed.

  • Install Rust and Cargo.
  • Clone this repository.
  • Run make.
  • Stick ./target/release/mysteryshack into your PATH.

Usage

  • Edit config.example and save it as config.
  • mysteryshack user create foo to create a new user called foo.
  • mysteryshack serve to run the server as configured in ./config.

For advanced usage, see mysteryshack --help and mysteryshack user --help.

Updating

Just git pull and make again.

Troubleshooting

OS X and OpenSSL

As of OS X 10.11, OpenSSL isn't installed anymore. You'll need to install it manually:

brew install openssl
brew link --force openssl

Implementation notes

  • Mysteryshack mostly implements draft-dejong-remotestorage-05.txt, however:

    • it sends two kinds of webfinger responses to stay compatible with remotestorage.js.

    • The app-provided client_id is ignored, Origin of redirect_uri is used for app identification.

  • Mysteryshack is set up to be tested against the official api test suite automatically (in Travis).

  • Mysteryshack's approach to concurrency is very simplistic. Only storage operations are safe to perform concurrently. User creation and deletion, app authorization and de-authorization are not, because it is assumed that the user performing those operations is a single human with only two hands and one keyboard.

  • Web admin sessions are stored inside signed cookies. The key is generated at server startup. To log everybody out, restart the server.

  • OAuth tokens are JSON signed with a per-user key. The server stores a list of client_ids the user has authorized, and checks if the token's client_id claim is found in that list.

  • Mysteryshack violates the WebFinger RFC by returning bogus information for nonexistent accounts. This is done to prevent account enumeration.

License