Andreas Reinhold / reiniandClaude Opus 5
40e35bab0e
A 6 GB upload kept a customer waiting long after its progress bar
reached 100%. The server wrote every upload three times: PHP's
temporary file, Livewire's copy of it ("Processing files...") and the
encrypted file ("Create Share Link"), each a full rewrite of a slow
disk. The unencrypted copy also stayed behind in livewire-tmp.
Now the uploader's browser encrypts each file in 16 MB chunks with
WebCrypto and PUTs them one at a time; the server checks each chunk in
memory and writes it once, already encrypted. Creating the share only
wraps its key and saves the options. A 200 MB upload through the
Docker image took 2.8 s, and its download matched byte for byte.
- SEALCHK2: a 19-byte header (chunk size, 7-byte nonce prefix), then
ciphertext and tag per chunk. Each nonce holds the chunk index and a
last-chunk flag (the STREAM construction), so cut or reordered files
fail to decrypt. SEALCHK1 and the single-block format still read.
- Envelope encryption: one random key per share. With a password it is
wrapped with Argon2id (sodium, libsodium's interactive limits) in
shares.wrapped_key, which names its parameters. Password shares from
before keep their PBKDF2-derived key.
- The upload page registers each selection with FileUploader into a
pending share of its own, lists the files with their progress, retries
a failed chunk after 1-16 s, then offers Retry; Remove and Cancel
abort. UploadChunkController only accepts chunks from the session that
started the share: a repeat is acknowledged, a skip gets 409 with the
count stored. Chunks go out as Blobs, which Chromium sends about eight
times faster than ArrayBuffers.
- Uploads need a secure context: over plain HTTP the page says HTTPS is
needed and takes no files. The Docker image gains AUTO_HTTPS, which
serves Let's Encrypt on 443 for SERVER_NAME and redirects 80; without
it the container stays on HTTP 80 behind a proxy. docker/Caddyfile was
never loaded and is gone; docker/healthcheck.sh covers both modes.
- "Download all" streams the ZIP with maennchen/zipstream-php (STORE,
ZIP64) instead of decrypting whole files into memory and writing the
archive unencrypted to /tmp.
- Pending shares count towards the quota, stay out of the admin
dashboard and 404 everywhere else. shares:cleanup deletes uploads idle
for 4 hours and Livewire temporary files older than that.
- PHP's upload limits no longer cap the admin's max file size and
default to 64M; LIVEWIRE_MAX_UPLOAD_TIME is gone and
UPLOAD_CHUNK_SIZE_MB is new.
- Tests cover the format, key wrapping, registration limits, the chunk
endpoint's answers, completing a share, the streamed ZIP, cleanup,
and in Chromium a real chunked upload and the HTTPS warning; the
selected-files overflow test runs again. README, website, CHANGELOG
and .ai/rules follow.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
107 lines
3.2 KiB
Docker
107 lines
3.2 KiB
Docker
# ============================================
|
|
# Stage 1: Install PHP dependencies
|
|
# ============================================
|
|
# Built on the build machine's own platform: vendor/ is plain PHP, the same for every target, so a
|
|
# multi-arch build runs it once and never under emulation.
|
|
FROM --platform=$BUILDPLATFORM composer:2 AS vendor
|
|
|
|
WORKDIR /app
|
|
|
|
COPY composer.json composer.lock* ./
|
|
|
|
RUN composer install \
|
|
--no-dev \
|
|
--no-interaction \
|
|
--no-autoloader \
|
|
--no-scripts \
|
|
--prefer-dist
|
|
|
|
COPY . .
|
|
|
|
RUN composer dump-autoload --optimize --no-dev
|
|
|
|
# ============================================
|
|
# Stage 2: Build frontend assets
|
|
# ============================================
|
|
# After Composer: the stylesheet and script import Livewire Material from vendor/. On the build
|
|
# machine's platform too: the output is CSS and JavaScript, whatever the target.
|
|
FROM --platform=$BUILDPLATFORM node:24-alpine AS assets
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package.json package-lock.json* ./
|
|
RUN npm ci --prefer-offline
|
|
|
|
COPY vite.config.js ./
|
|
COPY resources/ ./resources/
|
|
COPY --from=vendor /app/vendor/nonameweb ./vendor/nonameweb
|
|
|
|
RUN npm run build
|
|
|
|
# ============================================
|
|
# Stage 3: Production image (FrankenPHP/Octane)
|
|
# ============================================
|
|
FROM dunglas/frankenphp:php8.5-alpine AS production
|
|
|
|
LABEL maintainer="surtic86"
|
|
LABEL org.opencontainers.image.source="https://gitea.nonameweb.ch/noNameWEB/SealShare"
|
|
LABEL org.opencontainers.image.description="Self-hosted encrypted file sharing"
|
|
|
|
# Install required PHP extensions
|
|
RUN install-php-extensions \
|
|
intl \
|
|
pcntl \
|
|
zip
|
|
|
|
# Laravel environment defaults
|
|
ENV APP_NAME="SealShare" \
|
|
APP_ENV="production" \
|
|
APP_DEBUG="false" \
|
|
APP_URL="http://localhost" \
|
|
LOG_CHANNEL="stderr" \
|
|
LOG_LEVEL="warning" \
|
|
DB_CONNECTION="sqlite" \
|
|
SESSION_DRIVER="database" \
|
|
QUEUE_CONNECTION="database" \
|
|
CACHE_STORE="database" \
|
|
FILESYSTEM_DISK="local" \
|
|
BROADCAST_CONNECTION="log" \
|
|
BCRYPT_ROUNDS="12" \
|
|
OCTANE_SERVER="frankenphp"
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy PHP ini for upload limits
|
|
COPY docker/php/uploads.ini /usr/local/etc/php/conf.d/99-uploads.ini
|
|
|
|
# Copy application code
|
|
COPY . .
|
|
|
|
# Copy vendor dependencies from composer stage
|
|
COPY --from=vendor /app/vendor ./vendor
|
|
|
|
# Copy built frontend assets from node stage
|
|
COPY --from=assets /app/public/build ./public/build
|
|
|
|
# Remove dev/build files and stale cache not needed in production
|
|
RUN rm -rf node_modules tests .gitea docker/dev.Dockerfile docker/dev-entrypoint.sh .env .env.example \
|
|
bootstrap/cache/*.php \
|
|
&& mkdir -p storage/app/shares storage/app/public storage/framework/cache \
|
|
storage/framework/sessions storage/framework/testing storage/framework/views \
|
|
storage/logs database \
|
|
&& chmod -R 777 storage database bootstrap/cache
|
|
|
|
# Create SQLite database file if it doesn't exist
|
|
RUN touch database/database.sqlite \
|
|
&& chmod 666 database/database.sqlite
|
|
|
|
# Make entrypoint and healthcheck executable
|
|
RUN chmod +x docker/entrypoint.sh docker/healthcheck.sh
|
|
|
|
EXPOSE 80 443 443/udp
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD /app/docker/healthcheck.sh
|
|
|
|
ENTRYPOINT ["docker/entrypoint.sh"]
|