- commit
- ee9ef22ed7e72b6f1e788c50ae7db1cfaf01e0fa
- parent
- bc588cfe22f2071ccb1d86a9d45abf7c746a3a7f
- author
- cat <admin@dev.site>
- kind
- docs risk score 0.2 of 3, Jev's estimate
| M | README.md | 13 | ++----------- |
| M | site/ | 10 | +--------- |
@@ -1,6 +1,6 @@
11 # nz22 3-Push a directory of HTML, get a url back. A small, readable take on [nzip](https://github.com/FelineStateMachine/nzip).3+Push a directory of HTML, get a url back.44 55 ```console66 $ nz push ./report --password meow@@ -19,11 +19,7 @@ nz is three files you can read in one sitting:
1919 | `test.sh` | end-to-end test against `wrangler dev` |2020 2121 A site is **one KV entry**: the value is a tar of the directory, and the metadata is22-`{ exp, pw }`. KV expiration deletes it, so there is no database, blob store, cron, or GC.23-24-nz does push, update, ttl, and password. It does not do vaults, aliases, history/revert,25-dedup, notifications, feedback, apps, listing, or deletion (let it expire, or `--ttl 1m`).26-If you need those, use nzip.22+`{ exp, pw }`. KV expiration deletes it when the TTL runs out.2723 2824 ## Install2925 @@ -71,11 +67,6 @@ sites show a form. Unlocking sets a host-only `__Host-nz` cookie that lasts 7 da
7167 over the password verifier, so changing the password logs everyone out. Unlock attempts are7268 rate-limited to 5 per minute per ip and site.7369 74-## Caveats75-76-- KV is eventually consistent: an update can take up to ~60s to show up in other regions.77-- KV free tier allows 1,000 writes/day (one per push) and 25 MiB per site.78-7970 ## License8071 8172 0BSD@@ -42,7 +42,6 @@
4242 svg .arrow { stroke: var(--dim); stroke-width: 1.5; fill: none; marker-end: url(#head); }4343 svg .accent { stroke: var(--accent); }4444 figcaption { color: var(--dim); font-size: .9rem; margin-top: .5rem; }45- .omit { color: var(--dim); }4645 footer { margin-top: 4rem; color: var(--dim); font-size: .9rem; }4746 </style>4847 @@ -57,9 +56,6 @@ https://k3x9q.example.com/
5756 <span class="c">$</span> nz push ./report <span class="c"># same path, same url, new content</span>5857 <span class="c">$</span> nz update k3x9q --no-password <span class="c"># policy only, content kept</span></code></pre>5958 60- <p>A small take on <a href="https://github.com/FelineStateMachine/nzip">nzip</a>, written the way61- <a href="https://fixiproject.org">fixi</a> is: few moving parts, nothing to build, and code short enough to read.62- It does four things: <b>push</b>, <b>update</b>, <b>ttl</b>, and <b>password</b>.</p>6359 6460 <h2>Three files</h2>6561 <table>@@ -126,7 +122,6 @@ value <ustar bytes> <span class="c">the whole site, 2
126122 metadata { exp: 1795895602, <span class="c">unix seconds, or null for never</span>127123 pw: "<salt>.<pbkdf2>" } <span class="c">absent when public</span>128124 expiration exp <span class="c">KV deletes the entry for us</span></code></pre>129- <p>That covers what nzip needed a database, a blob store, a cron job and a garbage collector for.</p>130125 131126 <h3>Push</h3>132127 <ul>@@ -144,7 +139,7 @@ expiration exp <span class="c">KV deletes the entry fo
144139 <h3>Password</h3>145140 <ul>146141 <li>Only a PBKDF2-SHA256 verifier is stored, never the password. A locked site shows a small form, and unlock attempts are limited to 5 per minute per IP and site.</li>147- <li>Unlocking sets a host-only <code>__Host-nz</code> cookie, valid for 7 days, whose HMAC covers the id, the expiry and the verifier. Changing the password changes the verifier, which invalidates every outstanding cookie with no counter or session table.</li>142+ <li>Unlocking sets a host-only <code>__Host-nz</code> cookie, valid for 7 days, whose HMAC covers the id, the expiry and the verifier. Changing the password changes the verifier, which invalidates every outstanding cookie.</li>148143 </ul>149144 150145 <h2>API</h2>@@ -158,9 +153,6 @@ curl -X PUT ... https://example.com/k3x9q <span class="c"># 200, update
158153 curl -X PUT -H 'nz-password;' ... <span class="c"># empty: no password</span></code></pre>159154 <p>The response is the url on line one and a details line on line two. TTL takes <code>30m</code>, <code>12h</code>, <code>14d</code>, <code>2w</code> or <code>never</code>, and the default is <code>DEFAULT_TTL</code> (14d).</p>160155 161- <h2>Left out on purpose</h2>162- <p class="omit">Vaults, aliases, push history and revert, cross-site dedup, notifications, feedback, app origins, listing and deletion (let a site expire, or set <code>--ttl 1m</code>). If you need these, use nzip.</p>163- <p>Two caveats come with KV: an update can take up to about a minute to reach other regions, and the free tier allows 1,000 writes (pushes) a day.</p>164156 165157 <h2>Install</h2>166158 <pre><code>wrangler kv namespace create SITES <span class="c"># id into wrangler.jsonc</span>