Files
keep/docker-compose.yml

19 lines
475 B
YAML
Raw Normal View History

Implement keep: self-hosted E2E encrypted secrets sync Server: Express + better-sqlite3 (WAL), multi-recipient key-wrapping per IMPLEMENTATION.md's design — vaults/recipients/vault_grants/ access_log. Two auth paths: ADMIN_PASSWORD header for recipient management and revoke (pure metadata operations), signed-request auth (Ed25519 signature over method+path+timestamp+body-hash) for push/pull/grant, mirroring the spirit of this project family's other signed-handshake patterns without naming them. CLI: identity init/show/set-id, push/pull/grant/log, admin recipient add/list/remove and revoke. Grant is a client-side crypto operation (the granter unwraps the vault's current key locally and reseals it for the new recipient) rather than a server-side operation, since the server never holds an unwrapped key to grant with. Verified end-to-end with two independent local identities against a live server and separately against the built Docker image: register, push, pull (granted and ungranted), grant without re-pushing, admin revoke, a subsequent rotation confirming the revoked recipient stays excluded, and rejection of missing/malformed signed-request auth. Two real bugs caught during verification, not just written up: - libsodium-wrappers' published ESM build does a relative import only resolvable under bundler-style resolution — broken under plain Node ESM. Fixed via createRequire to force the CJS build. - Express's req.path inside a sub-router is relative to the mount point, which would have silently mismatched a client signing the full request path. Fixed by verifying against req.originalUrl. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-12 19:38:24 +02:00
services:
app:
image: ${IMAGE}
container_name: keep
restart: unless-stopped
pull_policy: always
ports:
- "${HOST_PORT:-3050}:3050"
environment:
- ADMIN_PASSWORD=${ADMIN_PASSWORD}
- REQUEST_MAX_SKEW_SECONDS=${REQUEST_MAX_SKEW_SECONDS:-300}
volumes:
# Named volume, not a bind mount — the SQLite DB holding vaults,
# recipients, and grants must survive redeploys.
- keep-data:/app/data
volumes:
keep-data: