Julius Joska
8b452a5593
- stop counting ACK and Pong frames toward the per-connection frame window; draining a large queue used to trip the 429 limit, disconnect the client and, after eight rounds, drop the remaining envelopes - deliver to online recipients with try_send: a recipient that stops reading its socket no longer pins the sender's task and memory - throttle call wake-ups per recipient (1 per 10 s, 6 per 10 min) and ordinary wake-ups (1 per 5 s); collapse ids for APNs and FCM - POST /v1/register accepts X-Sepot-Identity-Proof and lets a new device take over an existing identity (restore from the recovery phrase) - POST /v1/keys uploads one-time prekeys and rotates signed/Kyber prekeys; PrekeysLow is sent after AUTH when fewer than 20 remain - GET /v1/keys hands out at most 30 one-time prekeys per address per hour - reqwest errors are logged without the URL; UnifiedPush POSTs pin the addresses the SSRF guard resolved; NAT64/6to4 embedded addresses are checked - absolute AUTH deadline, at most 3 AUTH attempts, length limits on push endpoints and VoIP tokens - TURN credentials live 12 h and are reissued per connection every 10 min - global attachment storage cap (SEPOT_ATTACHMENTS_TOTAL_BYTES), nosniff and attachment disposition on downloads - SEPOT_MAX_CONNS_PER_IP, /v1/ready backed by the database, graceful shutdown, RLIMIT_NOFILE raised to the hard limit, server-info reports source and revision - Dockerfile: rust 1.99, GIT_SHA build arg for the image label and SEPOT_REVISION; Tor image on alpine 3.24
11 lines
369 B
Docker
11 lines
369 B
Docker
# Tor hidden service pro sepot-relay — vlastní minimální image
|
|
# (žádný third-party tor image; privacy produkt nemá kam outsourcovat důvěru)
|
|
FROM alpine:3.24
|
|
RUN apk add --no-cache tor \
|
|
&& mkdir -p /var/lib/tor \
|
|
&& chown -R tor:tor /var/lib/tor \
|
|
&& chmod 700 /var/lib/tor
|
|
COPY torrc /etc/tor/torrc
|
|
USER tor
|
|
CMD ["tor", "-f", "/etc/tor/torrc"]
|