Files

T

root 8bbb3179a1 Add KeepOrg sync server: accounts, nested groups, versioned KDBX sync

Why: collaborative KeePass use needs one arbiter of "who wrote last" that
never sees a master password, plus access control that follows an org chart.

What: stdlib-only Go server. Metadata is a single JSON document with one
writer and atomic commit; KDBX payloads are versioned blobs on disk. Access
comes from a group tree where a grant on a group reaches every member below
it. Login is password+TOTP, invite links, or OIDC through a browser-approved
device flow. Pushes carry If-Match and are arbitrated by a per-database merge
strategy (server-wins by default). Updates are pushed to clients over SSE.

Proved: go test ./internal/... covers RFC 6238 vectors, ACL inheritance and
isolation, store rollback, blob pruning, every push verdict, and an
end-to-end HTTP pass over login, conflict, force, read-only grants, invite
redemption, TOTP enrolment, device login and the event stream.

2026-10-29 15:54:10 +01:00

1.4 KiB

Raw Blame History

General rules

Be absolutely frugal about spending remaining resources. Default to short, direct answers. Drop the opening pleasantries and the wrap-up summary. Lead with the answer, add detail only if it's needed, and stop when you're done.

Naming and versioning

Applications shall use cc.tiredsysadmin.<operating_system>.<application> namespace for their unique identifiers. Versioning is done automatically each change according to semantic versioning policy. Track application versions of each platform accordingly (Android, macOS, Linux, BSD, Windows).

Tools and building

Use Makefile as an entrypoint for building and publishing applications. Each target is atomic, construct dependencies.

For macOS versions always produce a DMG with a symlink to /Applications folder.

For Linux versions always produce a boilerplate for building .deb packages, also track changelog.

Documentation

Write developer handover documentation explaining architecture and decisions.

Publishing

Android applications shall be published to a private F-Droid repository at rcmd@garage.rcmd.space:/var/lib/fdroid/unsigned, and the application metadata must be published at rcmd@garage.rcmd.space:/var/lib/fdroid/metadata. Publishing is always a manual action, never automatic.

Android artifact naming scheme for publishing to unsigned directory is always <application_id>_<version_code>.apk

MacOS, Linux, and Windows versions keep builds locally.