Julius Joska
4f2cbdbdc4
Rate limiting and the per-IP WebSocket cap trusted X-Forwarded-For and X-Real-Ip unconditionally. Onion traffic bypasses the reverse proxy, so a client could set the header itself and slip past every limit. Forwarded headers are now honoured only from peers inside SEPOT_TRUSTED_PROXIES; everyone else is keyed by peer address, and onion clients share one bucket. The queue flush also read the whole backlog into memory at once, and the certificate authority kept the trust-root private key in the database even though it is only ever needed offline.
54 lines
1.8 KiB
TOML
54 lines
1.8 KiB
TOML
[package]
|
|
name = "sepot-relay"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[dependencies]
|
|
sepot-proto = { path = "../sepot-proto" }
|
|
prost = { workspace = true }
|
|
tokio = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
sqlx = { version = "0.8", default-features = false, features = [
|
|
"postgres",
|
|
"runtime-tokio",
|
|
"tls-rustls",
|
|
"chrono",
|
|
"migrate",
|
|
"macros",
|
|
] }
|
|
dashmap = "6"
|
|
# CIDR match trusted proxy sítí pro anti-abuse klíč (viz net.rs)
|
|
ipnet = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
base64 = "0.22"
|
|
hex = "0.4"
|
|
chrono = "0.4"
|
|
rand = "0.9"
|
|
futures-util = "0.3"
|
|
# Streaming download příloh z disku (ReaderStream)
|
|
tokio-util = { version = "0.7", features = ["io"] }
|
|
|
|
# Oficiální Signal krypto — POUZE pro roli certifikační autority sealed
|
|
# senderu (ServerCertificate/SenderCertificate) a ověření XEdDSA podpisů
|
|
# při AUTH. Relay NIKDY nešifruje/nedešifruje zprávy (hloupý relay).
|
|
libsignal-protocol = { git = "https://github.com/signalapp/libsignal", tag = "v0.96.4" }
|
|
libsignal-core = { git = "https://github.com/signalapp/libsignal", tag = "v0.96.4" }
|
|
tower_governor = "0.8.0"
|
|
tower-http = { version = "0.7.0", features = ["timeout"] }
|
|
|
|
# Push budíčky (UnifiedPush/WebPush = POST na endpoint). rustls, ať build
|
|
# zůstane bez OpenSSL (stejně jako sqlx tls-rustls). Bez default featur —
|
|
# nechceme native-tls ani zbytečné kodeky.
|
|
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
|
|
# FCM fast mode: RS256 JWT pro OAuth2 service account flow
|
|
jsonwebtoken = "9"
|
|
|
|
[dev-dependencies]
|
|
tokio = { workspace = true, features = ["full"] }
|