changelog

.dockerignore

@@ -1,15 +1,15 @@
 *
 
-!/packages
-!/package.json
-!/pnpm-lock.yaml
-!/pnpm-workspace.yaml
+!/backend/src
+!/backend/Cargo.lock
+!/backend/Cargo.toml
 
-**/target
-**/node_modules
-**/dist
-**/bin
-**/*.tsbuildinfo
-**/build
-**/.svelte
-**/.svelte-kit
+!/frontend/locales
+!/frontend/src
+!/frontend/static
+!/frontend/.npmrc
+!/frontend/package.json
+!/frontend/pnpm-lock.yaml
+!/frontend/svelte.config.js
+!/frontend/tsconfig.json
+!/frontend/vite.config.js

.env.dev

@@ -1,2 +0,0 @@
-SIZE_LIMIT=10MiB
-VERBOSITY=debug

.gitattributes

@@ -1,2 +1 @@
 *.afdesign filter=lfs diff=lfs merge=lfs -text
-test/assets/** filter=lfs diff=lfs merge=lfs -text

.github/workflows/docker.yml

@@ -0,0 +1,41 @@
+name: ci
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*.*.*"
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          install: true
+      - name: Docker Labels
+        id: meta
+        uses: crazy-max/ghaction-docker-meta@v2
+        with:
+          images: cupcakearmy/cryptgeon
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push
+        id: docker_build
+        uses: docker/build-push-action@v2
+        with:
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+      - name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}

.github/workflows/release.yml

@@ -1,61 +0,0 @@
-name: Publish
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - 'v*.*.*'
-
-jobs:
-  cli:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
-        with:
-          cache: 'pnpm'
-          node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
-
-      - run: |
-          pnpm install
-          pnpm --filter cryptgeon build
-
-      - name: Publish to npm
-        run: |
-          DIST_TAG=latest
-          if [[ "${GITHUB_REF_NAME}" == *"-"* ]]; then
-            DIST_TAG=rc
-          fi
-          pnpm publish --filter cryptgeon --tag "${DIST_TAG}" --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-  docker:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - name: Docker Labels
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: cupcakearmy/cryptgeon
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-      - name: Login to DockerHub
-        uses: docker/login-action@v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v7
-        with:
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}

.github/workflows/test.yaml

@@ -1,48 +0,0 @@
-name: Test
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      # Node
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
-        with:
-          cache: 'pnpm'
-          node-version-file: '.nvmrc'
-
-      # Docker
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - name: Prepare
-        run: |
-          pnpm install
-          pnpm exec playwright install --with-deps
-          pnpm run test:prepare
-
-      - name: Rust tests
-        run: cargo test --manifest-path packages/backend/Cargo.toml
-
-      - name: Shared tests
-        run: pnpm --filter @cryptgeon/shared test
-
-      - name: Frontend type check
-        run: pnpm --filter @cryptgeon/web check
-
-      - name: Run your tests
-        run: pnpm test
-
-      - uses: actions/upload-artifact@v7
-        if: ${{ !cancelled() }}
-        with:
-          name: playwright-report
-          path: test-results/
-          retention-days: 7

.gitignore

@@ -1,11 +1,11 @@
-.env
-*.tsbuildinfo
-node_modules
-dist
-bin
 
+# Backend
 target
 
-# Testing
-test-results
-tmp
+# Client
+.DS_Store
+node_modules
+/.svelte
+/build
+/functions
+.env

.nvmrc

@@ -1 +0,0 @@
-v26

.vscode/settings.json

@@ -0,0 +1,6 @@
+{
+  "cSpell.words": ["ciphertext", "cryptgeon"],
+  "i18n-ally.localesPaths": ["frontend/locales"],
+  "i18n-ally.enabledFrameworks": ["svelte"],
+  "i18n-ally.keystyle": "nested"
+}

CHANGELOG.md

@@ -5,327 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased] — v3 (major rewrite)
-
-### Added
-
-- New shared TypeScript package `@cryptgeon/shared` as single source of truth for crypto, content codec and API client (crypto + compression + payload + types).
-- Shared payload codec: `packContent` / `unpackContent` (encode → LZ4 → XChaCha20-Poly1305 and reverse).
-- New `pg`-backend storage of note hashes in the cache.
-
-### Changed
-
-- Encryption from AES to **XChaCha20-Poly1305** (client-side); dropped `occulto`.
-- All API bodies switched to **MessagePack**.
-- Frontend migrated to SvelteKit + `@cryptgeon/shared`.
-- CLI rebuilt with `vite-plus` (bundles all deps) and imports from `@cryptgeon/shared`.
-
-### Breaking changes
-
-- Endpoints moved to `/api/v3/notes/` and `/api/v3/status`; health check to `/healthz`.
-- `meta.extra` holds client-opaque data (e.g. scrypt derivation params), size-limited (`EXTRA_SIZE_LIMIT`, default 512 bytes).
-- Inner payload is msgpack: `{ type: "text", data }` or `{ type: "files", data: [{ name, mime, size, data }] }`.
-- Env renames: `REDIS` → `CACHE`, `REDIS_PREFIX` → `CACHE_PREFIX`; new `EXTRA_SIZE_LIMIT`.
-- Docker `redis` service → `cache`; healthcheck → `http://127.0.0.1:8000/healthz`; image stays `valkey/valkey:7-alpine` (swap for any RESP-compatible).
-- Storage switched to cache hashes with atomic `HINCRBY` view counting; the per-note lock (`lock.rs`) is removed.
-- Notes can have **both** `views` and `expiration` set simultaneously.
-- v2 notes are **not migrated**: flush the cache before deploying v3; v2/v3 notes are not interoperable.
-
-## [2.9.3] - 2026-06-25
-
-### Added
-
-- Basic file drag-and-drop support.
-
-### Changed
-
-- Publish the Docker image to GitHub Container Registry (ghcr).
-
-### Fixed
-
-- #207: keep audio/other file mime types intact.
-- Localization key typo `note_to_big` → `note_too_big`.
-
-## [2.9.2] - 2026-06-07
-
-### Added
-
-- Image paste support.
-- Czech translation.
-- `THEME_HOME_LINK` environment variable.
-- Docker compose: prevent anonymous volume creation.
-
-### Changed
-
-- Replace Redis with Valkey in docker-compose files.
-- Rust 2024 edition compat, watchexec and axum 0.8 updates.
-- Switched license checker package.
-- Frontend cleanup and readme/docs cleanup.
-
-### Security
-
-- Updated dependencies (ring, npm_and_yarn group).
-
-## [2.9.1] - 2025-02-27
-
-### Added
-
-- Docs about running Redis in RAM-only mode.
-
-### Fixed
-
-- Password eye toggle not working.
-
-### Security
-
-- Updated dependencies.
-
-## [2.9.0] - 2025-01-18
-
-### Changed
-
-- Frontend rework: migrate to Svelte 5.
-- Update Redis documentation link in compose.
-
-### Fixed
-
-- Fix race condition on the delete endpoint by introducing locks to guarantee the view counter.
-
-## [2.8.4] - 2025-01-02
-
-### Added
-
-- Chinese (zh-TW) translations.
-- Basic auth example (nginx).
-
-## [2.8.3] - 2024-09-27
-
-### Added
-
-- Options to add an imprint: `IMPRINT_URL`, `IMPRINT_HTML`.
-
-## [2.8.2] - 2024-09-20
-
-### Added
-
-- Raycast extension links.
-
-### Changed
-
-- Add `type="button"` to form elements.
-- Bump pnpm version.
-
-## [2.8.1] - 2024-09-02
-
-### Changed
-
-- Move shared package into the CLI.
-- Add a guide.
-
-## [2.8.0] - 2024-08-27
-
-### Changed
-
-- Migrate backend from actix to axum (major refactor).
-- More robust config, body limit via axum.
-- Use container for test pipeline; skip size/expiration quirks in Safari.
-
-### Fixed
-
-- Typos in English localization.
-
-## [2.7.0] - 2024-08-23
-
-### Added
-
-- Better programmatic access to the shared client.
-- Redis TLS feature, dynamically-linked and native musl targets.
-- French blog post and improved French translations.
-
-### Changed
-
-- Bump redis crate to 0.25.2.
-
-## [2.6.1] - 2024-05-04
-
-### Added
-
-- Polish translation.
-
-## [2.6.0] - 2024-03-24
-
-### Added
-
-- `ALLOW_FILES` flag.
-- `NEW_NOTE_NOTICE` → `THEME_NEW_NOTE_NOTICE` theme flag.
-- French translation update.
-
-### Changed
-
-- Reset form when clicking the logo after creating a note.
-
-## [2.5.1] - 2024-03-04
-
-### Changed
-
-- Reset translation.
-- German (`de`) translation update.
-
-## [2.5.0] - 2024-03-04
-
-### Added
-
-- Expose internal shared functionality for external/programmatic usage.
-- German translation updates.
-
-### Security
-
-- Updated dependencies (zerocopy).
-
-## [2.4.0] - 2023-11-01
-
-### Changed
-
-- Removed HTML sanitation, display the original message as string
-- Links are now displayed under the note in a separate section
-
-## [2.3.3] - 2023-08-15
-
-### Changed
-
-- Maintenance.
-- Updated dependencies.
-
-## [2.3.2] - 2023-08-04
-
-### Added
-
-- Spanish readme (`README_ES.md`).
-
-### Changed
-
-- Translation and grammar fixes (en, de, de, es).
-
-## [2.3.1] - 2023-06-23
-
-### Added
-
-- #92: Endpoint (`/api/live/`) for checking health status.
-
-## [2.3.0] - 2023-05-30
-
-### Added
-
-- New CLI 🎉.
-- Russian language.
-- Option for reducing note id size (`ID_LENGTH`).
-
-### Changed
-
-- Moved to monorepo.
-
-## [2.2.0] - 2023-01-14
-
-### Changed
-
-- Default port is now 8000, not 5000.
-- Moved to generic encryption library `occulto`.
-
-### Fixed
-
-- Bad chinese language code.
-
-### Security
-
-- Updated dependencies.
-
-## [2.1.0] - 2023-01-04
-
-### Added
-
-- QR Code to more easily copy and share links.
-
-## [2.0.7] - 2022-12-26
-
-### Changed
-
-- Svelte Kit now stable 🎉
-
-## [2.0.6] - 2022-11-12
-
-### Fixed
-
-- #66 Set minimum a view.
-
-### Security
-
-- Updated dependencies.
-
-## [2.0.5] - 2022-11-04
-
-### Fixed
-
-- Docker build pipeline.
-
-## [2.0.4] - 2022-10-29
-
-### Added
-
-- `THEME_PAGE_TITLE`.
-- `THEME_FAVICON`.
-
-## [2.0.3] - 2022-10-07
-
-### Added
-
-- Flag for verbosity.
-
-### Fixed
-
-- #58 Fixed bug in the max views frontend form.
-
-## [2.0.2] - 2022-07-20
-
-### Added
-
-- Toasts for events.
-- E2E Tests.
-- Make backend more configurable.
-
-## [2.0.1] - 2022-07-18
-
-### Added
-
-- Max file size on the client now.
-- Loading information.
-
-### Changed
-
-- Changed encoding from hex to base64.
-- Chinese language code.
-- Notable speed improvements for big files.
-
-## [2.0.0] - 2022-07-16
-
-### Added
-
-- Theming for logo and description text.
-
-### Changed
-
-- Moved to redis.
-- New html sanitizing library.
-
 ## [2.0.0-rc.0] - 2022-07-15
 
 ### Added
 
-- Theming for logo and description text.
+- Theming for logo and description text
 
 ### Changed
 
-- Moved to redis.
-- New html sanitizing library.
+- Moved to redis
+- New html sanitizing library
 
 ## [1.5.3] - 2022-06-07
 

CONTRIBUTING.md

@@ -1,47 +0,0 @@
-# Contributing
-
-## Requirements
-
-- [mise](https://mise.jdx.dev) — manages pnpm, rust, node (see `mise.toml`)
-- docker or [colima](https://github.com/abiosoft/colima) (for cache)
-
-## Setup
-
-```bash
-mise install
-pnpm install
-```
-
-## Development
-
-```bash
-pnpm run dev
-```
-
-Make sure docker/colima is running. This starts the cache (valkey/redis), the rust backend, the web client, and the CLI. The app is at [localhost:3000](http://localhost:3000).
-
-## Tests
-
-End-to-end tests with Playwright.
-
-```sh
-pnpm run test:prepare
-pnpm run test:local
-```
-
-## Release
-
-1. Update version across packages:
-
-   ```sh
-   ./version.mjs <semver>
-   ```
-
-2. Create and push the tag:
-
-   ```sh
-   git tag v<semver>
-   git push --tags
-   ```
-
-The CI workflow publishes the CLI to npm and the Docker image to Docker Hub automatically.

Dockerfile

@@ -1,30 +1,25 @@
 # FRONTEND
-FROM node:24-alpine AS client
-ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
-RUN corepack enable
-
+FROM node:16-alpine as client 
 WORKDIR /tmp
-COPY . .
-RUN pnpm install --frozen-lockfile
+RUN npm install -g pnpm@7
+COPY ./frontend ./
+RUN pnpm install
 RUN pnpm run build
 
 
 # BACKEND
-FROM rust:1.95-alpine AS backend
+FROM rust:1.61-alpine as backend
 WORKDIR /tmp
-RUN apk add --no-cache libc-dev openssl-dev alpine-sdk
-COPY ./packages/backend ./
-RUN RUSTFLAGS="-Ctarget-feature=-crt-static" cargo build --release
+RUN apk add libc-dev openssl-dev alpine-sdk
+COPY ./backend ./
+RUN cargo build --release
 
 
 # RUNNER
-FROM alpine:3
+FROM alpine
 WORKDIR /app
-RUN apk add --no-cache curl libgcc
 COPY --from=backend /tmp/target/release/cryptgeon .
-COPY --from=client /tmp/packages/frontend/build ./frontend
-ENV FRONTEND_PATH="./frontend"
-ENV CACHE="redis://cache/"
-EXPOSE 8000
+COPY --from=client /tmp/build ./frontend/build
+ENV REDIS=redis://redis/
+EXPOSE 5000
 ENTRYPOINT [ "/app/cryptgeon" ]

README.md

@@ -11,41 +11,25 @@
 
 <br/><br/>
 <a href="https://www.producthunt.com/posts/cryptgeon?utm_source=badge-featured&utm_medium=badge&utm_souce=badge-cryptgeon" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=295189&theme=light" alt="Cryptgeon - Securely share self-destructing notes | Product Hunt" height="50" /></a>
-<a title="Install cryptgeon Raycast Extension" href="https://www.raycast.com/cupcakearmy/cryptgeon"><img src="https://www.raycast.com/cupcakearmy/cryptgeon/install_button@2x.png?v=1.1" height="64" alt="" style="height: 64px;"></a>
+<a href=""><img src="./.github/lokalise.png" height="50">
 <br/><br/>
 
-EN | [简体中文](README_zh-CN.md) | [ES](README_ES.md)
+EN | [简体中文](README_zh-CN.md)
 
 ## About?
 
-_cryptgeon_ is a secure, open source sharing note or file service inspired by [_PrivNote_](https://privnote.com).
-It includes a server, a web page and a CLI client.
+_cryptgeon_ is a secure, open source sharing note or file service inspired by [_PrivNote_](https://privnote.com)
 
 > 🌍 If you want to translate the project feel free to reach out to me.
+>
+> Thanks to [Lokalise](https://lokalise.com/) for providing free access to their platform.
 
-## Live Service / Demo
+## Demo
 
-### Web
-
-Check out the live service / demo and see for yourself [cryptgeon.org](https://cryptgeon.org)
-
-### CLI
-
-```
-npx cryptgeon send text "This is a secret note"
-```
-
-For more documentation about the CLI see the [readme](./packages/cli/README.md).
-
-### Raycast Extension
-
-There is an [official Raycast extension](https://www.raycast.com/cupcakearmy/cryptgeon).
-
-<a title="Install cryptgeon Raycast Extension" href="https://www.raycast.com/cupcakearmy/cryptgeon"><img src="https://www.raycast.com/cupcakearmy/cryptgeon/install_button@2x.png?v=1.1" height="64" alt="" style="height: 64px;"></a>
+Check out the demo and see for yourself https://cryptgeon.nicco.io.
 
 ## Features
 
-- send text or files
 - server cannot decrypt contents due to client side encryption
 - view or time constraints
 - in memory, no persistence
@@ -55,45 +39,30 @@ There is an [official Raycast extension](https://www.raycast.com/cupcakearmy/cry
 
 each note has a generated <code>id (256bit)</code> and <code>key 256(bit)</code>. The
 <code>id</code>
-is used to save & retrieve the note. the note is then encrypted with XChaCha20-Poly1305 on the
+is used to save & retrieve the note. the note is then encrypted with aes in gcm mode on the
 client side with the <code>key</code> and then sent to the server. data is stored in memory and
 never persisted to disk. the server never sees the encryption key and cannot decrypt the contents
 of the notes even if it tried to.
 
-> View counts are guaranteed with one running instance of cryptgeon. Multiple instances connected to the same cache instance can run into race conditions, where a note might be retrieved more than the view count allows.
-
 ## Screenshot
 
 ![screenshot](./design/Screens.png)
 
 ## Environment Variables
 
-| Variable                | Default          | Description                                                                                                                                                                                                           |
-| ----------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `CACHE`                 | `redis://cache/` | Cache URL (valkey or redis) to connect to. [According to format](https://docs.rs/redis/latest/redis/#connection-parameters)                                                                                           |
-| `SIZE_LIMIT`            | `1 KiB`          | Max size for body. Accepted values according to [byte-unit](https://docs.rs/byte-unit/). <br> `512 MiB` is the maximum allowed. <br> Payloads are raw bytes (msgpack + cipher), so the frontend shows the full limit. |
-| `MAX_VIEWS`             | `100`            | Maximal number of views.                                                                                                                                                                                              |
-| `MAX_EXPIRATION`        | `360`            | Maximal expiration in minutes.                                                                                                                                                                                        |
-| `ALLOW_ADVANCED`        | `true`           | Allow custom configuration. If set to `false` all notes will be one view only.                                                                                                                                        |
-| `ALLOW_FILES`           | `true`           | Allow uploading files. If set to `false`, users will only be allowed to create text notes.                                                                                                                            |
-| `ID_LENGTH`             | `32`             | Set the size of the note `id` in bytes. By default this is `32` bytes. This is useful for reducing link size. _This setting does not affect encryption strength_.                                                     |
-| `CACHE_PREFIX`          | `""`             | Optional prefix for all cache keys. Useful when sharing a cache instance with other apps via ACL namespaces.                                                                                                          |
-| `EXTRA_SIZE_LIMIT`      | `512`            | Maximum size in bytes of the opaque `extra` payload (e.g. key derivation params) stored on the note metadata.                                                                                                         |
-| `VERBOSITY`             | `warn`           | Verbosity level for the backend. [Possible values](https://docs.rs/env_logger/latest/env_logger/#enabling-logging) are: `error`, `warn`, `info`, `debug`, `trace`                                                     |
-| `THEME_IMAGE`           | `""`             | Custom image for replacing the logo. Must be publicly reachable                                                                                                                                                       |
-| `THEME_TEXT`            | `""`             | Custom text for replacing the description below the logo                                                                                                                                                              |
-| `THEME_PAGE_TITLE`      | `""`             | Custom text the page title                                                                                                                                                                                            |
-| `THEME_FAVICON`         | `""`             | Custom url for the favicon. Must be publicly reachable                                                                                                                                                                |
-| `THEME_NEW_NOTE_NOTICE` | `true`           | Show the message about how notes are stored in the memory and may be evicted after creating a new note. Defaults to `true`.                                                                                           |
-| `THEME_HOME_LINK`       | `true`           | Show the `/home` link in the footer. Defaults to `true`.                                                                                                                                                              |
-| `IMPRINT_URL`           | `""`             | Custom url for an Imprint hosted somewhere else. Must be publicly reachable. Takes precedence above `IMPRINT_HTML`.                                                                                                   |
-| `IMPRINT_HTML`          | `""`             | Alternative to `IMPRINT_URL`, this can be used to specify the HTML code to show on `/imprint`. Only `IMPRINT_HTML` or `IMPRINT_URL` should be specified, not both.                                                    |
+| Variable         | Default          | Description                                                                                                               |
+| ---------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------- |
+| `REDIS`          | `redis://redis/` | Redis URL to connect to.                                                                                                  |
+| `SIZE_LIMIT`     | `1 KiB`          | Max size for body. Accepted values according to [byte-unit](https://docs.rs/byte-unit/). `512 MiB` is the maximum allowed |
+| `MAX_VIEWS`      | `100`            | Maximal number of views.                                                                                                  |
+| `MAX_EXPIRATION` | `360`            | Maximal expiration in minutes.                                                                                            |
+| `ALLOW_ADVANCED` | `true`           | Allow custom configuration. If set to `false` all notes will be one view only.                                            |
+| `THEME_IMAGE`    | `""`             | Custom image for replacing the logo. Must be publicly reachable                                                           |
+| `THEME_TEXT`     | `""`             | Custom text for replacing the description below the logo                                                                  |
 
 ## Deployment
 
-> ℹ️ `https` is required otherwise browsers will not support the cryptographic functions.
-
-> ℹ️ There is a health endpoint available at `/healthz`. It returns either 200 or 503.
+ℹ️ `https` is required otherwise browsers will not support the cryptographic functions.
 
 ### Docker
 
@@ -102,35 +71,20 @@ Docker is the easiest way. There is the [official image here](https://hub.docker
 ```yaml
 # docker-compose.yml
 
+version: '3.8'
+
 services:
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
+  redis:
+    image: redis:7-alpine
 
   app:
-    image: cupcakearmy/cryptgeon:v3
+    image: cupcakearmy/cryptgeon:latest
     depends_on:
-      - cache
+      - redis
     environment:
-      # Size limit for a single note.
-      SIZE_LIMIT: 4 MiB
+      SIZE_LIMIT: 4M
     ports:
-      - 80:8000
-
-    # Optional health checks
-    # healthcheck:
-    #   test: ["CMD", "curl", "--fail", "http://127.0.0.1:8000/healthz"]
-    #   interval: 1m
-    #   timeout: 3s
-    #   retries: 2
-    #   start_period: 5s
+      - 80:5000
 ```
 
 ### NGINX Proxy
@@ -139,43 +93,78 @@ See the [examples/nginx](https://github.com/cupcakearmy/cryptgeon/tree/main/exam
 
 ### Traefik 2
 
-See the [examples/traefik](https://github.com/cupcakearmy/cryptgeon/tree/main/examples/traefik) folder.
+Assumptions:
 
-### Scratch
+- External proxy docker network `proxy`
+- A certificate resolver `le`
+- A https entrypoint `secure`
+- Domain name `example.org`
 
-See the [examples/scratch](https://github.com/cupcakearmy/cryptgeon/tree/main/examples/scratch) folder. There you'll find a guide how to setup a server and install cryptgeon from scratch.
+```yaml
+version: '3.8'
 
-### Synology
+networks:
+  proxy:
+    external: true
 
-There is a [guide](https://mariushosting.com/how-to-install-cryptgeon-on-your-synology-nas/) you can follow.
+services:
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
 
-### YouTube Guides
+  app:
+    image: cupcakearmy/cryptgeon:latest
+    restart: unless-stopped
+    depends_on:
+      - redis
+    networks:
+      - default
+      - proxy
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.cryptgeon.rule=Host(`example.org`)
+      - traefik.http.routers.cryptgeon.entrypoints=secure
+      - traefik.http.routers.cryptgeon.tls.certresolver=le
+```
 
-- English by [Webnestify](https://www.youtube.com/watch?v=XAyD42I7wyI)
-- English by [DB Tech](https://www.youtube.com/watch?v=S0jx7wpOfNM) [Previous Video](https://www.youtube.com/watch?v=JhpIatD06vE)
-- German by [ApfelCast](https://www.youtube.com/watch?v=84ZMbE9AkHg)
+## Development
 
-### Written Guides
+**Requirements**
 
-- French by [zarevskaya](https://belginux.com/installer-cryptgeon-avec-docker/)
-- Italian by [@nicfab](https://notes.nicfab.eu/it/posts/cryptgeon/)
-- English by [@nicfab](https://notes.nicfab.eu/en/posts/cryptgeon/)
+- `pnpm`: `>=6`
+- `node`: `>=16`
+- `rust`: edition `2021`
 
-## Contributing
+**Install**
 
-See [CONTRIBUTING.md](./CONTRIBUTING.md).
+```bash
+pnpm install
+pnpm --prefix frontend install
 
-## Security
+# Also you need cargo watch if you don't already have it installed.
+# https://lib.rs/crates/cargo-watch
+cargo install cargo-watch
+```
 
-Please refer to the security section [here](./SECURITY.md).
+**Run**
 
----
+Make sure you have docker running.
 
-_Attributions_
+> If you are on `macOS` you might need to disable AirPlay Receiver as it uses port 5000 (So stupid...)
+> https://developer.apple.com/forums/thread/682332
 
-- Test data:
-  - Text for tests [Nietzsche Ipsum](https://nietzsche-ipsum.com/)
-  - [AES Paper](https://www.cs.miami.edu/home/burt/learning/Csc688.012/rijndael/rijndael_doc_V2.pdf)
-  - [Unsplash Pictures](https://unsplash.com/)
-- Loading animation by [Nikhil Krishnan](https://codepen.io/nikhil8krishnan/pen/rVoXJa)
-- Icons made by <a href="https://www.freepik.com" title="Freepik">freepik</a> from <a href="https://www.flaticon.com/" title="Flaticon">www.flaticon.com</a>
+```bash
+pnpm run dev
+```
+
+Running `pnpm run dev` in the root folder will start the following things:
+
+- redis docker container
+- rust backend
+- client
+
+You can see the app under [localhost:1234](http://localhost:1234).
+
+###### Attributions
+
+Icons made by <a href="https://www.freepik.com" title="Freepik">freepik</a> from <a href="https://www.flaticon.com/" title="Flaticon">www.flaticon.com</a>

README_ES.md

@@ -1,163 +0,0 @@
-<p align="center">
-  <img src="./design/Github.png" alt="logo">
-</p>
-
-<a href="https://discord.gg/nuby6RnxZt">
-  <img alt="discord" src="https://img.shields.io/discord/252403122348097536?style=for-the-badge" />
-  <img alt="docker pulls" src="https://img.shields.io/docker/pulls/cupcakearmy/cryptgeon?style=for-the-badge" />
-  <img alt="Docker image size badge" src="https://img.shields.io/docker/image-size/cupcakearmy/cryptgeon?style=for-the-badge" />
-  <img alt="Latest version" src="https://img.shields.io/github/v/release/cupcakearmy/cryptgeon?style=for-the-badge" />
-</a>
-
-<br/><br/>
-<a href="https://www.producthunt.com/posts/cryptgeon?utm_source=badge-featured&utm_medium=badge&utm_souce=badge-cryptgeon" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=295189&theme=light" alt="Cryptgeon - Securely share self-destructing notes | Product Hunt" height="50" /></a>
-<br/><br/>
-
-[EN](README.md) | [简体中文](README_zh-CN.md) | ES
-
-## Acerca de
-
-_cryptgeon_ es un servicio seguro y de código abierto para compartir notas o archivos inspirado en [_PrivNote_](https://privnote.com).
-Incluye un servidor, una página web y una interfaz de línea de comandos (CLI, por sus siglas en inglés).
-
-> 🌍 Si quieres traducir este proyecto no dudes en ponerte en contacto conmigo.
-
-## Demo
-
-### Web
-
-Prueba la demo y experimenta por ti mismo [cryptgeon.org](https://cryptgeon.org)
-
-### CLI
-
-```
-npx cryptgeon send text "Esto es una nota secreta"
-```
-
-Puedes revisar la documentación sobre el CLI en este [readme](./packages/cli/README.md).
-
-## Características
-
-- enviar texto o archivos
-- el servidor no puede desencriptar el contenido debido a que la encriptación se hace del lado del cliente
-- restricción de vistas o de tiempo
-- en memoria, sin persistencia
-- compatibilidad obligatoria con el modo oscuro
-
-## ¿Cómo funciona?
-
-Se genera una <code>id (256bit)</code> y una <code>llave 256(bit)</code> para cada nota. La
-<code>id</code>
-se usa para guardar y recuperar la nota. Después la nota es encriptada con XChaCha20-Poly1305 del lado del cliente y por último se envía al servidor. La información es almacenada en memoria y nunca persiste en el disco. El servidor nunca ve la llave de encriptación por lo que no puede desencriptar el contenido de las notas aunque lo intentara.
-
-## Capturas de pantalla
-
-![screenshot](./design/Screens.png)
-
-## Variables de entorno
-
-| Variable                | Default          | Descripción                                                                                                                                                                                                                                  |
-| ----------------------- | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `CACHE`                 | `redis://cache/` | URL de caché (valkey o redis) a la que conectarse. [Según el formato](https://docs.rs/redis/latest/redis/#connection-parameters)                                                                                                             |
-| `SIZE_LIMIT`            | `1 KiB`          | Tamaño máximo del cuerpo. Valores aceptados según [byte-unit](https://docs.rs/byte-unit/). <br> `512 MiB` es el máximo permitido. <br> Los payloads son bytes crudos (msgpack + cifrado), por lo que el frontend muestra el límite completo. |
-| `MAX_VIEWS`             | `100`            | Número máximo de vistas.                                                                                                                                                                                                                     |
-| `MAX_EXPIRATION`        | `360`            | Tiempo máximo de expiración en minutos.                                                                                                                                                                                                      |
-| `ALLOW_ADVANCED`        | `true`           | Permitir configuración personalizada. Si se establece en `false` todas las notas serán de una sola vista.                                                                                                                                    |
-| `ALLOW_FILES`           | `true`           | Permitir subir archivos. Si es `false`, los usuarios solo podrán crear notas de texto.                                                                                                                                                       |
-| `ID_LENGTH`             | `32`             | Establece el tamaño en bytes de la `id` de la nota. Por defecto es de `32` bytes. Útil para reducir el tamaño del link. _No afecta el nivel de encriptación_.                                                                                |
-| `CACHE_PREFIX`          | `""`             | Prefijo opcional para las claves de caché. Útil al compartir una instancia con otras apps vía namespaces ACL.                                                                                                                                |
-| `EXTRA_SIZE_LIMIT`      | `512`            | Tamaño máximo en bytes del payload `extra` opaco (p. ej. parámetros de derivación de clave) guardado en los metadatos de la nota.                                                                                                            |
-| `VERBOSITY`             | `warn`           | Nivel de verbosidad del backend. [Posibles valores](https://docs.rs/env_logger/latest/env_logger/#enabling-logging): `error`, `warn`, `info`, `debug`, `trace`                                                                               |
-| `THEME_IMAGE`           | `""`             | Imagen personalizada para reemplazar el logo. Debe ser accesible públicamente.                                                                                                                                                               |
-| `THEME_TEXT`            | `""`             | Texto personalizado para reemplazar la descripción bajo el logo.                                                                                                                                                                             |
-| `THEME_PAGE_TITLE`      | `""`             | Texto personalizado para el título.                                                                                                                                                                                                          |
-| `THEME_FAVICON`         | `""`             | Url personalizada para el favicon. Debe ser accesible públicamente.                                                                                                                                                                          |
-| `THEME_NEW_NOTE_NOTICE` | `true`           | Mostrar el mensaje sobre cómo se almacenan las notas en memoria (pueden ser expulsadas) al crear una nueva nota.                                                                                                                             |
-| `THEME_HOME_LINK`       | `true`           | Mostrar el enlace `/home` en el pie de página. El valor predeterminado es `true`.                                                                                                                                                            |
-| `IMPRINT_URL`           | `""`             | URL personalizada para un imprint alojado en otro sitio. Debe ser accesible públicamente. Tiene prioridad sobre `IMPRINT_HTML`.                                                                                                              |
-| `IMPRINT_HTML`          | `""`             | Alternativa a `IMPRINT_URL` para especificar el HTML a mostrar en `/imprint`. Usa solo `IMPRINT_HTML` o `IMPRINT_URL`, no ambos.                                                                                                             |
-
-## Despliegue
-
-> ℹ️ Se requiere `https` de lo contrario el navegador no soportará las funciones de encriptación.
-
-> ℹ️ Hay un endpoint para verificar el estado, lo encontramos en `/healthz`. Regresa un código 200 o 503.
-
-### Docker
-
-Docker es la manera más fácil. Aquí encontramos [la imagen oficial](https://hub.docker.com/r/cupcakearmy/cryptgeon).
-
-```yaml
-# docker-compose.yml
-
-services:
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1g --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
-
-  app:
-    image: cupcakearmy/cryptgeon:v3
-    depends_on:
-      - cache
-    environment:
-      # Size limit for a single note.
-      SIZE_LIMIT: 4 MiB
-    ports:
-      - 80:8000
-
-    # Optional health checks
-    # healthcheck:
-    #   test: ["CMD", "curl", "--fail", "http://127.0.0.1:8000/healthz"]
-    #   interval: 1m
-    #   timeout: 3s
-    #   retries: 2
-    #   start_period: 5s
-```
-
-### NGINX Proxy
-
-Ver la carpeta de [ejemplo/nginx](https://github.com/cupcakearmy/cryptgeon/tree/main/examples/nginx). Hay un ejemplo con un proxy simple y otro con https. Es necesario que especifiques el nombre del servidor y los certificados.
-
-### Traefik 2
-
-Ver la carpeta de [ejemplo/traefik](https://github.com/cupcakearmy/cryptgeon/tree/main/examples/traefik).
-
-### Scratch
-
-Ver la carpeta de [ejemplo/scratch](https://github.com/cupcakearmy/cryptgeon/tree/main/examples/scratch). Ahí encontrarás una guía de cómo configurar el servidor e instalar cryptgeon desde cero.
-
-### Synology
-
-Hay una [guía](https://mariushosting.com/how-to-install-cryptgeon-on-your-synology-nas/) (en inglés) que puedes seguir.
-
-### Guías en Youtube
-
-- En inglés, por [Webnestify](https://www.youtube.com/watch?v=XAyD42I7wyI)
-- En inglés, por [DB Tech](https://www.youtube.com/watch?v=S0jx7wpOfNM) [Previous Video](https://www.youtube.com/watch?v=JhpIatD06vE)
-- En alemán, por [ApfelCast](https://www.youtube.com/watch?v=84ZMbE9AkHg)
-
-## Contribuir
-
-Ver [CONTRIBUTING.md](./CONTRIBUTING.md).
-
-## Seguridad
-
-Por favor dirígete a la sección de seguridad [aquí](./SECURITY.md).
-
----
-
-_Atribuciones_
-
-- Datos del Test:
-  - Texto para los tests [Nietzsche Ipsum](https://nietzsche-ipsum.com/)
-  - [AES Paper](https://www.cs.miami.edu/home/burt/learning/Csc688.012/rijndael/rijndael_doc_V2.pdf)
-  - [Unsplash Imágenes](https://unsplash.com/)
-- Animación de carga por [Nikhil Krishnan](https://codepen.io/nikhil8krishnan/pen/rVoXJa)
-- Iconos hechos por <a href="https://www.freepik.com" title="Freepik">freepik</a> de <a href="https://www.flaticon.com/" title="Flaticon">www.flaticon.com</a>

README_zh-CN.md

@@ -11,19 +11,22 @@
 
 <br/>
 <a href="https://www.producthunt.com/posts/cryptgeon?utm_source=badge-featured&utm_medium=badge&utm_souce=badge-cryptgeon" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=295189&theme=light" alt="Cryptgeon - Securely share self-destructing notes | Product Hunt" height="50" /></a>
+<a href=""><img src="./.github/lokalise.png" height="50">
 <br/>
 
-[EN](README.md) | 简体中文 | [ES](README_ES.md)
+[EN](README.md) | 简体中文
 
 ## 关于本项目
 
 _加密鸽_ 是一个受 [_PrivNote_](https://privnote.com)项目启发的安全、开源共享密信和文件共享服务器
 
 > 🌍 如果你想翻译此项目请随时与我联系.
+>
+> 感谢 [Lokalise](https://lokalise.com/) 提供免费的平台服务支持
 
 ## 演示示例
 
-查看加密鸽的在线演示 demo： [cryptgeon.org](https://cryptgeon.org)
+查看加密鸽的在线演示 demo： https://cryptgeon.nicco.io.
 
 ## 功能
 
@@ -36,7 +39,7 @@ _加密鸽_ 是一个受 [_PrivNote_](https://privnote.com)项目启发的安全
 
 加密鸽会为每条笔记都生成一个独立的 <code>id (256bit)</code> 和 <code>key 256(bit)</code>。
 
-其中<code>id</code>用于保存和提取密信， 在这之后这封密信将会被客户端使用 XChaCha20-Poly1305 加密算法和`key`进行加密然后发送至服务器，数据将会保存在服务器的内存中且永远不会被持久化到硬盘上，服务端永远不会得到密钥并且无法解读密信的内容。
+其中<code>id</code>用于保存和提取密信， 在这之后这封密信将会被客户端使用 AES 算法的 GCM 模式和`key`进行加密然后发送至服务器，数据将会保存在服务器的内存中且永远不会被持久化到硬盘上，服务端永远不会得到密钥并且无法解读密信的内容。
 
 ## 屏幕截图
 
@@ -44,26 +47,13 @@ _加密鸽_ 是一个受 [_PrivNote_](https://privnote.com)项目启发的安全
 
 ## 环境变量
 
-| 变量名称                | 默认值           | 描述                                                                                                                                       |
-| ----------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
-| `CACHE`                 | `redis://cache/` | 缓存（valkey 或 redis）连接 URL。[连接参数](https://docs.rs/redis/latest/redis/#connection-parameters)                                     |
-| `SIZE_LIMIT`            | `1 KiB`          | 最大请求体(body)限制。可通过 [字节单位](https://docs.rs/byte-unit/) 查看支持的值。负载是原始字节（msgpack + 加密），因此前端显示完整限制。 |
-| `MAX_VIEWS`             | `100`            | 密信最多查看次数限制。                                                                                                                     |
-| `MAX_EXPIRATION`        | `360`            | 密信最长过期时间限制(分钟)。                                                                                                               |
-| `ALLOW_ADVANCED`        | `true`           | 是否允许自定义设置，该项如果设为`false`，则不会显示自定义设置模块。                                                                        |
-| `ALLOW_FILES`           | `true`           | 是否允许上传文件。为 `false` 时用户只能创建文本密信。                                                                                      |
-| `ID_LENGTH`             | `32`             | 设置密信 `id` 的字节大小。默认 `32` 字节，可用于缩短链接长度。_不影响加密强度_。                                                           |
-| `CACHE_PREFIX`          | `""`             | 缓存键可选前缀。与其它应用通过 ACL namespace 共享缓存实例时有用。                                                                          |
-| `EXTRA_SIZE_LIMIT`      | `512`            | 不透明 `extra` 负载（如密钥派生参数）的最大字节数，存于密信元数据。                                                                        |
-| `VERBOSITY`             | `warn`           | 后端日志级别。可能值见 [env_logger](https://docs.rs/env_logger/latest/env_logger/#enabling-logging)。                                      |
-| `THEME_IMAGE`           | `""`             | 自定义 Logo 图片，需可公开访问。                                                                                                           |
-| `THEME_TEXT`            | `""`             | 自定义在 Logo 下方的文本。                                                                                                                 |
-| `THEME_PAGE_TITLE`      | `""`             | 自定义页面标题。                                                                                                                           |
-| `THEME_FAVICON`         | `""`             | 自定义 favicon 地址，需可公开访问。                                                                                                        |
-| `THEME_NEW_NOTE_NOTICE` | `true`           | 创建新笔记后显示“笔记存于内存可能被清除”的提示。                                                                                           |
-| `THEME_HOME_LINK`       | `true`           | 是否在页脚显示 `/home` 链接。默认为 `true`。                                                                                               |
-| `IMPRINT_URL`           | `""`             | 托管在其它位置的印页 URL，需可公开访问。优先于 `IMPRINT_HTML`。                                                                            |
-| `IMPRINT_HTML`          | `""`             | `IMPRINT_URL` 的替代：指定 `/imprint` 展示的 HTML。`IMPRINT_HTML` 与 `IMPRINT_URL` 只应指定其一。                                          |     |
+| 变量名称          | 默认值           | 描述                                                                              |
+| ----------------- | ---------------- | --------------------------------------------------------------------------------- |
+| `REDIS`           | `redis://redis/` | Redis URL to connect to.                                                          |
+| `SIZE_LIMIT`      | `1 KiB`          | 最大请求体(body)限制。有关支持的数值请查看 [字节单位](https://docs.rs/byte-unit/) |
+| `MAX_VIEWS`       | `100`            | 密信最多查看次数限制                                                              |
+| ` MAX_EXPIRATION` | `360`            | 密信最长过期时间限制(分钟)                                                        |
+| `ALLOW_ADVANCED`  | `true`           | 是否允许自定义设置，该项如果设为`false`，则不会显示自定义设置模块                 |
 
 ## 部署
 
@@ -77,27 +67,20 @@ Docker 是最简单的部署方式。这里是[官方镜像的地址](https://hu
 
 ```yaml
 # docker-compose.yml
+version: '3.8'
 
 services:
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
+  redis:
+    image: redis:7-alpine
 
   app:
-    image: cupcakearmy/cryptgeon:v3
+    image: cupcakearmy/cryptgeon:latest
     depends_on:
-      - cache
+      - redis
     environment:
-      SIZE_LIMIT: 4 MiB
+      SIZE_LIMIT: 4M
     ports:
-      - 80:8000
+      - 80:5000
 ```
 
 ### NGINX 反向代理
@@ -114,27 +97,22 @@ services:
 - 域名 `example.org`
 
 ```yaml
+version: '3.8'
+
 networks:
   proxy:
     external: true
 
 services:
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
 
   app:
-    image: cupcakearmy/cryptgeon:v3
+    image: cupcakearmy/cryptgeon:latest
     restart: unless-stopped
     depends_on:
-      - cache
+      - redis
     networks:
       - default
       - proxy
@@ -145,15 +123,44 @@ services:
       - traefik.http.routers.cryptgeon.tls.certresolver=le
 ```
 
-## 贡献
+## 开发
 
-参见 [CONTRIBUTING.md](./CONTRIBUTING.md)。
+**环境要求**
+
+- `pnpm`: `>=6`
+- `node`: `>=14`
+- `rust`: edition `2021`
+
+**安装**
+
+```bash
+pnpm install
+pnpm --prefix frontend install
+
+# Also you need cargo watch if you don't already have it installed.
+# https://lib.rs/crates/cargo-watch
+cargo install cargo-watch
+```
+
+**运行**
+
+确保你的 Docker 正在运行
+
+> If you are on `macOS` you might need to disable AirPlay Receiver as it uses port 5000 (So stupid...)
+> https://developer.apple.com/forums/thread/682332
+
+```bash
+pnpm run dev
+```
+
+在根目录执行 `pnpm run dev` 会开启下列服务:
+
+- 一个 redis docker 容器
+- 无热重载的 rust 后端
+- 可热重载的客户端
+
+你可以通过 1234 端口进入该应用，即 [localhost:1234](http://localhost:1234).
 
 ###### Attributions
 
-- 测试数据:
-  - 测试文本 [Nietzsche Ipsum](https://nietzsche-ipsum.com/)
-  - [AES Paper](https://www.cs.miami.edu/home/burt/learning/Csc688.012/rijndael/rijndael_doc_V2.pdf)
-  - [Unsplash Pictures](https://unsplash.com/)
-- 加载动画由 [Nikhil Krishnan](https://codepen.io/nikhil8krishnan/pen/rVoXJa) 提供
-- 图标由来自 <a href="https://www.flaticon.com/" title="Flaticon">www.flaticon.com</a> 的 <a href="https://www.freepik.com" title="Freepik">freepik</a> 提供
+本项目所使用的图标由<a href="https://www.flaticon.com/" title="Flaticon">www.flaticon.com 的<a href="https://www.freepik.com" title="Freepik">freepik</a>制作</a>

SECURITY.md

@@ -1,18 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-Please ensure that you are using the latest major version available.
-
-| Version | Supported |
-| ------- | --------- |
-| 2.x     | ✅        |
-| < 1.x   | ❌        |
-
-## Reporting a vulnerability
-
-_cryptgeon_ has a full disclosure vulnerability policy.
-Report any bug / vulnerability directly to the [issue tracker](https://github.com/cupcakearmy/cryptgeon/issues).
-Please do NOT attempt to report any security vulnerability in this code privately to anybody.
-
-> Shamefully copied of the [ring security section](https://github.com/briansmith/ring#bug-reporting).

backend/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+name = "cryptgeon"
+version = "2.0.0-rc.0"
+authors = ["cupcakearmy <hi@nicco.io>"]
+edition = "2021"
+
+[[bin]]
+name = "cryptgeon"
+path = "src/main.rs"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+actix-web = "4"
+actix-files = "0.6"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1"
+lazy_static = "1"
+ring = "0.16"
+bs62 = "0.1"
+byte-unit = "4"
+dotenv = "0.15"
+mime = "0.3"
+env_logger = "0.9"
+redis = "0.21.5"

backend/src/api.rs

@@ -0,0 +1,12 @@
+use actix_web::web;
+
+use crate::note;
+use crate::status;
+
+pub fn init(cfg: &mut web::ServiceConfig) {
+    cfg.service(
+        web::scope("/api")
+            .service(note::init())
+            .service(status::init()),
+    );
+}

backend/src/client.rs

@@ -0,0 +1,14 @@
+use actix_files::{Files, NamedFile};
+use actix_web::{web, Result};
+
+pub fn init(cfg: &mut web::ServiceConfig) {
+    cfg.service(
+        Files::new("/", "./frontend/build")
+            .index_file("index.html")
+            .use_etag(true),
+    );
+}
+
+pub async fn index() -> Result<NamedFile> {
+    Ok(NamedFile::open("./frontend/build/index.html")?)
+}

backend/src/config.rs

@@ -0,0 +1,40 @@
+use byte_unit::Byte;
+
+// General
+lazy_static! {
+    pub static ref VERSION: String = option_env!("CARGO_PKG_VERSION")
+        .unwrap_or("Unknown")
+        .to_string();
+}
+
+// CONFIG
+lazy_static! {
+  pub static ref LIMIT: u32 =
+    Byte::from_str(std::env::var("SIZE_LIMIT").unwrap_or("1 KiB".to_string()))
+      .unwrap()
+      .get_bytes() as u32;
+  pub static ref MAX_VIEWS: u32 = std::env::var("MAX_VIEWS")
+    .unwrap_or("100".to_string())
+    .parse()
+    .unwrap();
+  pub static ref MAX_EXPIRATION: u32 = std::env::var("MAX_EXPIRATION")
+    .unwrap_or("360".to_string()) // 6 hours in minutes
+    .parse()
+    .unwrap();
+  pub static ref ALLOW_ADVANCED: bool = std::env::var("ALLOW_ADVANCED")
+    .unwrap_or("true".to_string())
+    .parse()
+    .unwrap();
+}
+
+// THEME
+lazy_static! {
+    pub static ref THEME_IMAGE: String = std::env::var("THEME_IMAGE")
+        .unwrap_or("".to_string())
+        .parse()
+        .unwrap();
+    pub static ref THEME_TEXT: String = std::env::var("THEME_TEXT")
+        .unwrap_or("".to_string())
+        .parse()
+        .unwrap();
+}

backend/src/main.rs

@@ -0,0 +1,35 @@
+use actix_web::{
+    middleware::{self, Logger},
+    web, App, HttpServer,
+};
+use dotenv::dotenv;
+
+#[macro_use]
+extern crate lazy_static;
+
+mod api;
+mod client;
+mod config;
+mod note;
+mod size;
+mod status;
+mod store;
+
+#[actix_web::main]
+async fn main() -> std::io::Result<()> {
+    dotenv().ok();
+    env_logger::init_from_env(env_logger::Env::new().default_filter_or("warning"));
+    return HttpServer::new(|| {
+        App::new()
+            .wrap(Logger::new("%a \"%r\" %s %b %T"))
+            .wrap(middleware::Compress::default())
+            .wrap(middleware::DefaultHeaders::default())
+            .configure(size::init)
+            .configure(api::init)
+            .configure(client::init)
+            .default_service(web::to(client::index))
+    })
+    .bind("0.0.0.0:5000")?
+    .run()
+    .await;
+}

backend/src/note/model.rs

@@ -0,0 +1,27 @@
+use bs62;
+use ring::rand::SecureRandom;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Clone)]
+pub struct Note {
+    pub meta: String,
+    pub contents: String,
+    pub views: Option<u32>,
+    pub expiration: Option<u32>,
+}
+
+#[derive(Serialize, Deserialize, Clone)]
+pub struct NoteInfo {}
+
+#[derive(Serialize, Deserialize, Clone)]
+pub struct NotePublic {
+    pub meta: String,
+    pub contents: String,
+}
+
+pub fn generate_id() -> String {
+    let mut id: [u8; 32] = [0; 32];
+    let sr = ring::rand::SystemRandom::new();
+    let _ = sr.fill(&mut id);
+    return bs62::encode_data(&id);
+}

backend/src/note/routes.rs

@@ -0,0 +1,143 @@
+use actix_web::{delete, get, post, web, HttpResponse, Responder, Scope};
+use serde::{Deserialize, Serialize};
+use std::time::SystemTime;
+
+use crate::config;
+use crate::note::{generate_id, Note, NoteInfo, NotePublic};
+use crate::store;
+
+pub fn now() -> u32 {
+    SystemTime::now()
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .unwrap()
+        .as_secs() as u32
+}
+
+#[derive(Serialize, Deserialize)]
+struct NotePath {
+    id: String,
+}
+
+#[get("/{id}")]
+async fn one(path: web::Path<NotePath>) -> impl Responder {
+    let p = path.into_inner();
+    let note = store::get(&p.id);
+
+    match note {
+        Ok(Some(_)) => HttpResponse::Ok().json(NoteInfo {}),
+        Ok(None) => HttpResponse::NotFound().finish(),
+        Err(e) => HttpResponse::InternalServerError().body(e.to_string()),
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+struct CreateResponse {
+    id: String,
+}
+
+#[post("/")]
+async fn create(note: web::Json<Note>) -> impl Responder {
+    let mut n = note.into_inner();
+    let id = generate_id();
+    let bad_req = HttpResponse::BadRequest().finish();
+    if n.views == None && n.expiration == None {
+        return bad_req;
+    }
+    if !*config::ALLOW_ADVANCED {
+        n.views = Some(1);
+        n.expiration = None;
+    }
+    match n.views {
+        Some(v) => {
+            if v > *config::MAX_VIEWS {
+                return bad_req;
+            }
+            n.expiration = None; // views overrides expiration
+        }
+        _ => {}
+    }
+    match n.expiration {
+        Some(e) => {
+            if e > *config::MAX_EXPIRATION {
+                return bad_req;
+            }
+            let expiration = now() + (e * 60);
+            n.expiration = Some(expiration);
+        }
+        _ => {}
+    }
+    match store::set(&id.clone(), &n.clone()) {
+        Ok(_) => return HttpResponse::Ok().json(CreateResponse { id: id }),
+        Err(e) => return HttpResponse::InternalServerError().body(e.to_string()),
+    }
+}
+
+#[delete("/{id}")]
+async fn delete(path: web::Path<NotePath>) -> impl Responder {
+    let p = path.into_inner();
+    let note = store::get(&p.id);
+    match note {
+        Err(e) => HttpResponse::InternalServerError().body(e.to_string()),
+        Ok(None) => return HttpResponse::NotFound().finish(),
+        Ok(Some(note)) => {
+            let mut changed = note.clone();
+            if changed.views == None && changed.expiration == None {
+                return HttpResponse::BadRequest().finish();
+            }
+            match changed.views {
+                Some(v) => {
+                    changed.views = Some(v - 1);
+                    let id = p.id.clone();
+                    if v <= 1 {
+                        match store::del(&id) {
+                            Err(e) => {
+                                return HttpResponse::InternalServerError().body(e.to_string())
+                            }
+                            _ => {}
+                        }
+                    } else {
+                        match store::set(&id, &changed.clone()) {
+                            Err(e) => {
+                                return HttpResponse::InternalServerError().body(e.to_string())
+                            }
+                            _ => {}
+                        }
+                    }
+                }
+                _ => {}
+            }
+
+            let n = now();
+            match changed.expiration {
+                Some(e) => {
+                    if e < n {
+                        match store::del(&p.id.clone()) {
+                            Ok(_) => return HttpResponse::BadRequest().finish(),
+                            Err(e) => {
+                                return HttpResponse::InternalServerError().body(e.to_string())
+                            }
+                        }
+                    }
+                }
+                _ => {}
+            }
+            return HttpResponse::Ok().json(NotePublic {
+                contents: changed.contents,
+                meta: changed.meta,
+            });
+        }
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+struct Status {
+    version: String,
+    max_size: usize,
+}
+
+pub fn init() -> Scope {
+    web::scope("/notes")
+        .service(one)
+        .service(create)
+        .service(delete)
+}

backend/src/size.rs

@@ -0,0 +1,18 @@
+use actix_web::web;
+use byte_unit::Byte;
+use mime;
+
+lazy_static! {
+    pub static ref LIMIT: usize =
+        Byte::from_str(std::env::var("SIZE_LIMIT").unwrap_or("1 KiB".to_string()))
+            .unwrap()
+            .get_bytes() as usize;
+}
+
+pub fn init(cfg: &mut web::ServiceConfig) {
+    let json = web::JsonConfig::default().limit(*LIMIT);
+    let plain = web::PayloadConfig::default()
+        .limit(*LIMIT)
+        .mimetype(mime::STAR_STAR);
+    cfg.app_data(json).app_data(plain);
+}

backend/src/status/mod.rs

@@ -0,0 +1,5 @@
+mod model;
+mod routes;
+
+pub use model::*;
+pub use routes::*;

backend/src/status/model.rs

@@ -0,0 +1,15 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize)]
+pub struct Status {
+    // General
+    pub version: String,
+    // Config
+    pub max_size: u32,
+    pub max_views: u32,
+    pub max_expiration: u32,
+    pub allow_advanced: bool,
+    // Theme
+    pub theme_image: String,
+    pub theme_text: String,
+}

backend/src/status/routes.rs

@@ -0,0 +1,21 @@
+use actix_web::{get, web, HttpResponse, Responder, Scope};
+
+use crate::config;
+use crate::status::Status;
+
+#[get("/")]
+async fn get_status() -> impl Responder {
+    return HttpResponse::Ok().json(Status {
+        version: config::VERSION.to_string(),
+        max_size: *config::LIMIT,
+        max_views: *config::MAX_VIEWS,
+        max_expiration: *config::MAX_EXPIRATION,
+        allow_advanced: *config::ALLOW_ADVANCED,
+        theme_image: config::THEME_IMAGE.to_string(),
+        theme_text: config::THEME_TEXT.to_string(),
+    });
+}
+
+pub fn init() -> Scope {
+    web::scope("/status").service(get_status)
+}

backend/src/store.rs

@@ -0,0 +1,55 @@
+use redis;
+use redis::Commands;
+
+use crate::note::now;
+use crate::note::Note;
+
+lazy_static! {
+    static ref REDIS_CLIENT: String = std::env::var("REDIS")
+        .unwrap_or("redis://127.0.0.1/".to_string())
+        .parse()
+        .unwrap();
+}
+
+fn get_connection() -> Result<redis::Connection, &'static str> {
+    let client =
+        redis::Client::open(REDIS_CLIENT.to_string()).map_err(|_| "Unable to connect to redis")?;
+    client
+        .get_connection()
+        .map_err(|_| "Unable to connect to redis")
+}
+
+pub fn set(id: &String, note: &Note) -> Result<(), &'static str> {
+    let serialized = serde_json::to_string(&note.clone()).unwrap();
+    let mut conn = get_connection()?;
+
+    conn.set(id, serialized)
+        .map_err(|_| "Unable to set note in redis")?;
+    match note.expiration {
+        Some(e) => {
+            let seconds = e - now();
+            conn.expire(id, seconds as usize)
+                .map_err(|_| "Unable to set expiration on notion")?
+        }
+        None => {}
+    };
+    Ok(())
+}
+
+pub fn get(id: &String) -> Result<Option<Note>, &'static str> {
+    let mut conn = get_connection()?;
+    let value: Option<String> = conn.get(id).map_err(|_| "Could not load note in redis")?;
+    match value {
+        None => return Ok(None),
+        Some(s) => {
+            let deserialize: Note = serde_json::from_str(&s).unwrap();
+            return Ok(Some(deserialize));
+        }
+    }
+}
+
+pub fn del(id: &String) -> Result<(), &'static str> {
+    let mut conn = get_connection()?;
+    conn.del(id).map_err(|_| "Unable to delete note in redis")?;
+    Ok(())
+}

cryptgeon.code-workspace

@@ -1,20 +0,0 @@
-{
-  "folders": [
-    {
-      "path": "."
-    },
-    {
-      "path": "packages/backend"
-    },
-    {
-      "path": "packages/frontend"
-    },
-    {
-      "path": "packages/cli"
-    }
-  ],
-  "settings": {
-    "i18n-ally.localesPaths": ["locales"],
-    "cSpell.words": ["cryptgeon"]
-  }
-}

docker-compose.dev.yaml

@@ -1,32 +0,0 @@
-# DEV Compose file.
-# For a production file see: README.md
-
-services:
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
-    ports:
-      - 6379:6379
-
-  app:
-    build: .
-    env_file: .env.dev
-    depends_on:
-      - cache
-    restart: unless-stopped
-    ports:
-      - 3000:8000
-
-    healthcheck:
-      test: ['CMD', 'curl', '--fail', 'http://127.0.0.1:8000/healthz']
-      interval: 1m
-      timeout: 3s
-      retries: 2
-      start_period: 5s

docker-compose.yaml

@@ -1,29 +0,0 @@
-services:
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
-
-  app:
-    image: cupcakearmy/cryptgeon:v3
-    depends_on:
-      - cache
-    environment:
-      # Size limit for a single note.
-      SIZE_LIMIT: 4 MiB
-    ports:
-      - 80:8000
-
-    # Optional health checks
-    # healthcheck:
-    #   test: ["CMD", "curl", "--fail", "http://127.0.0.1:8000/healthz"]
-    #   interval: 1m
-    #   timeout: 3s
-    #   retries: 2
-    #   start_period: 5s

docker-compose.yml

@@ -0,0 +1,19 @@
+# DEV Compose file.
+# For a production file see: README.md
+
+version: '3.8'
+
+services:
+  redis:
+    image: redis:7-alpine
+    ports:
+      - 6379:6379
+
+  app:
+    build: .
+    depends_on:
+      - redis
+    environment:
+      SIZE_LIMIT: 128M
+    ports:
+      - 80:5000

docs/roadmap.md

@@ -1,76 +0,0 @@
-# Roadmap
-
-## Todo
-
-- Add remaining shared tooling to the pnpm catalog (`vite`, `tsdown`).
-- Move formatting, linting and type-checking + git hooks onto `vite-plus` (oxlint, oxfmt, vitest).
-- Re-add CSP (`Content-Security-Policy`) wired into the axum router (was in `csp.rs`, removed as unused).
-
-## Unified payload (drop the text/file union)
-
-> Follow-up iteration of the inner payload, parked as `v3.1` (not part of core v3).
-
-Everything becomes a **file**. Text is just a `FileDTO` with `inline: true`. The `{ type: "text" } | { type: "files" }` union is removed.
-
-```
-# Inner layer (encrypted, client-only)
-{ files: [
-  { name: string, mime: string, size: number, data: bytes, inline?: boolean }
-] }
-```
-
-- `FileDTO` gains `inline?: boolean` (default `false`).
-- `inline: true` = the file was authored inline at compose time (e.g. an empty text file the user typed into). Purely a **client/UI hint** — rides inside the encrypted inner payload, the server never sees it.
-- `inline: true` files render as an **editable text editor**; the rest render as binary file cards (upload/download).
-- Default composer state = one empty `inline:true` text file the user edits. No `isFile` toggle.
-
-### Impact by area
-
-- **Server / wire protocol / `api.ts`**: unchanged. Still an opaque encrypted `data` blob in the outer msgpack envelope.
-- **Shared codec**: `NoteContent` becomes `{ files: FileDTO[] }`; drop the union + `switch(type)` in `unpackContent`. `packContent(input: FileDTO[], password?)`. Breaking inner-msgpack schema → ok, pre-release.
-- **Frontend (`Create.svelte` — biggest)**: one `files: FileDTO[]` model; default empty `inline` text file; editor binds a string, encodes to bytes on submit; add real files via upload (`inline:false`).
-- **CLI**: `send text "x"` → `files:[{ name:'note.txt', mime:'text/plain', data:utf8, inline:true }]`. `send file a b` → drop `type` union. `open`/download prints text files, saves the rest.
-- **Tests**: `payload.test.ts` rewritten to `{ files:[...] }`; playwright `switch-file`/`text-field` composer specs collapse + rework.
-
-### Watches
-
-- text↔bytes round-trip in the editor (encoding, line-endings);
-- `size` must be set from the _encoded_ bytes (matches `SIZE_LIMIT` / preview) — recompute after text→bytes;
-- pasted binary files keep `inline:false`; only inline-authored text is `inline:true`.
-
-### Payload pipeline
-
-```mermaid
-flowchart TD
-    subgraph WRITE["CLIENT — encode / compress / encrypt"]
-        A[Text or Files] --> B{password?}
-        B -->|yes| C1[deriveKey password+salt<br>extra=encode salt,N,r,p]
-        B -->|no| C2[generateKey random 32B]
-        C2 --> D[URL fragment hex key]
-        C1 --> E
-        D --> E
-        A --> F[encode inner files]
-        F -->|encode content| G[inner msgpack]
-        G --> H[LZ4 compress]
-        H --> I[XChaCha20 encrypt]
-        I -->|data| J[POST msgpack meta+data]
-        C1 -->|extra| J
-    end
-
-    subgraph SERVER["SERVER — agnostic"]
-        J --> K{hash store: views, expiration, extra, data}
-    end
-
-    subgraph READ["CLIENT — read"]
-        L[meta/extra from PREVIEW] --> M{extra present?}
-        M -->|yes| N[deriveKey pw+salt]
-        M -->|no| O[key from URL hex fragment]
-        N --> P[DELETE get envelope data]
-        O --> P
-        P --> Q[XChaCha20 decrypt]
-        Q --> R[LZ4 decompress]
-        R --> S[msgpack decode files]
-        S -->|inline:true| T[edit / render text]
-        S -->|inline:false| U[save files]
-    end
-```

examples/nginx/docker-compose.yaml

@@ -1,20 +1,13 @@
+version: '3.8'
 
 services:
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
+  redis:
+    image: redis:7-alpine
 
   app:
-    image: cupcakearmy/cryptgeon:v3
+    image: cupcakearmy/cryptgeon:latest
     depends_on:
-      - cache
+      - redis
     
   proxy:
     image: nginx:alpine

examples/nginx/nginx-plain.conf

@@ -4,7 +4,7 @@ server {
     server_name _;
 
     location / {
-      proxy_pass http://app:8000/;
+      proxy_pass http://app:5000/;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

examples/nginx/nginx-tls.conf

@@ -20,7 +20,7 @@ server {
     ssl_trusted_certificate /path/to/fullchain.pem;
 
     location / {
-      proxy_pass http://app:8000/;
+      proxy_pass http://app:5000/;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

examples/scratch/README.md

@@ -25,26 +25,27 @@ This is a tiny guide to install cryptgeon on (probably) any unix system (and may
 ```yaml
 # docker-compose.yaml
 
+version: '3.8'
 services:
   traefik:
     image: traefik:2.6
     restart: unless-stopped
     ports:
-      - "80:80"
-      - "443:443"
+      - '80:80'
+      - '443:443'
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./traefik.yaml:/etc/traefik/traefik.yaml:ro
       - ./data:/data
     labels:
-      - "traefik.enable=true"
+      - 'traefik.enable=true'
 
       # HTTP to HTTPS redirection
-      - "traefik.http.routers.http_catchall.rule=HostRegexp(`{any:.+}`)"
-      - "traefik.http.routers.http_catchall.entrypoints=insecure"
-      - "traefik.http.routers.http_catchall.middlewares=https_redirect"
-      - "traefik.http.middlewares.https_redirect.redirectscheme.scheme=https"
-      - "traefik.http.middlewares.https_redirect.redirectscheme.permanent=true"
+      - 'traefik.http.routers.http_catchall.rule=HostRegexp(`{any:.+}`)'
+      - 'traefik.http.routers.http_catchall.entrypoints=insecure'
+      - 'traefik.http.routers.http_catchall.middlewares=https_redirect'
+      - 'traefik.http.middlewares.https_redirect.redirectscheme.scheme=https'
+      - 'traefik.http.middlewares.https_redirect.redirectscheme.permanent=true'
 
 networks:
   default:
@@ -61,15 +62,15 @@ api:
 # Define HTTP and HTTPS entrypoint
 entryPoints:
   insecure:
-    address: ":80"
+    address: ':80'
   secure:
-    address: ":443"
+    address: ':443'
 
 # Dynamic configuration will come from docker labels
 providers:
   docker:
-    endpoint: "unix:///var/run/docker.sock"
-    network: "proxy"
+    endpoint: 'unix:///var/run/docker.sock'
+    network: 'proxy'
     exposedByDefault: false
 
 # Enable acme with http file challenge
@@ -99,27 +100,22 @@ Create another docker-compose.yaml file in another folder. We will assume that t
 ```
 
 ```yaml
+version: '3.8'
+
 networks:
   proxy:
     external: true
 
 services:
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
 
   app:
-    image: cupcakearmy/cryptgeon:v3
+    image: cupcakearmy/cryptgeon:latest
     restart: unless-stopped
     depends_on:
-      - cache
+      - redis
     environment:
       SIZE_LIMIT: 4 MiB
     networks:
@@ -152,6 +148,8 @@ docker-compose up -d
 ```yaml
 # docker-compose.yaml
 
+version: '3.8'
+
 services:
   watchtower:
     image: containrrr/watchtower

examples/traefik/README.md

@@ -1,89 +0,0 @@
-# Install Cryptgeon with Traefik
-
-Assumptions:
-
-- Traefik 2/3 installed.
-- External proxy docker network `proxy`.
-- A certificate resolver `le`.
-- A https entrypoint `secure`.
-- Domain name `example.org`.
-
-```yaml
-networks:
-  proxy:
-    external: true
-
-services:
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
-
-  app:
-    image: cupcakearmy/cryptgeon:v3
-    restart: unless-stopped
-    depends_on:
-      - cache
-    networks:
-      - default
-      - proxy
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.cryptgeon.rule=Host(`example.org`)
-      - traefik.http.routers.cryptgeon.entrypoints=secure
-      - traefik.http.routers.cryptgeon.tls.certresolver=le
-```
-
-## With basic auth
-
-Some times it's useful to hide the service behind auth. This is easily achieved with traefik middleware. Many reverse proxies support similar features, so while traefik is used in this example, other reverse proxies can do the same.
-
-```yaml
-services:
-  traefik:
-    image: traefik:v3.0
-    command:
-      - "--api.insecure=true"
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--entrypoints.web.address=:80"
-    ports:
-      - "80:80"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-
-  cache:
-    image: valkey/valkey:7-alpine
-    # This is required to stay in RAM only.
-    command: valkey-server --save "" --appendonly no
-    # Set a size limit. See link below on how to customise.
-    # https://valkey.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
-    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
-    # This prevents the creation of an anonymous volume.
-    tmpfs:
-      - /data
-
-  cryptgeon:
-    image: cupcakearmy/cryptgeon:v3
-    depends_on:
-      - cache
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.cryptgeon.rule=Host(`cryptgeon.localhost`)"
-      - "traefik.http.routers.cryptgeon.entrypoints=web"
-      - "traefik.http.routers.cryptgeon.middlewares=cryptgeon-auth"
-      - "traefik.http.middlewares.cryptgeon-auth.basicauth.users=user:$$2y$$05$$juUw0zgc5ebvJ00MFPVVLujF6P.rcEMbGZ99Jfq6ZWEa1dgetacEq"
-```
-
-```bash
-docker compose up -d
-```
-
-1. Open http://cryptgeon.localhost
-2. Log in with `user` and `secret`

frontend/.dockerignore

@@ -0,0 +1,5 @@
+.DS_Store
+node_modules
+/.svelte
+/build
+/functions

frontend/.npmrc

@@ -0,0 +1 @@
+engine-strict=true

frontend/licenses.csv

@@ -0,0 +1,8 @@
+├─ MIT: 12
+├─ BSD-3-Clause: 1
+├─ (MPL-2.0 OR Apache-2.0): 1
+├─ BSD-2-Clause: 1
+├─ ISC: 1
+├─ 0BSD: 1
+└─ Apache-2.0: 1
+

frontend/locales/cn.json

@@ -0,0 +1,42 @@
+{
+	"common": {
+		"note": "密信",
+		"file": "上传文件",
+		"advanced": "高级设置",
+		"create": "创建",
+		"loading": "加载中...",
+		"mode": "模式",
+		"views": "{n, plural, =0 {可查看次数} =1 {1 次查看} other {# 次查看}}",
+		"minutes": "{n, plural, =0 {有效期(分钟)} =1 {1 分钟} other {# 分钟}}",
+		"max": "最大值",
+		"share_link": "分享链接",
+		"copy_clipboard": "复制到剪切版"
+	},
+	"home": {
+		"intro": "一键轻松发送 <i>完全加密的</i> 密信或者文件。只需创建一个密信然后分享链接。",
+		"explanation": "该密信会在{type}后失效。",
+		"new_note": "新建密信",
+		"new_note_notice": "<b>可用性警示：</b><br />由于加密鸽的所有数据是全部保存在内存中的，所以如果加密鸽的可用内存被用光了那么它将会删除最早的密信以释放内存，因此不保证该密信的可用性。<br />(一般情况下是您应该是不会遇到这个问题，只是警示一下。)",
+		"errors": {
+			"note_to_big": "无法创建密信，这个密信太大了！",
+			"note_error": "无法创建密信，请再试一遍。",
+			"max": "最大文件大小: {n}",
+			"empty_content": "密信为空！"
+		},
+		"copied_to_clipboard": "已复制到剪切板 🔗"
+	},
+	"show": {
+		"errors": {
+			"not_found": "该密信无法被找到或者它已经被删除了！",
+			"decryption_failed": "密钥错误！您可能不小心粘贴了一个不完整的链接或者正在尝试破解该密信！但无论如何，该密信已被销毁！"
+		},
+		"explanation": "点击下方的按钮可以查看密信，如果它到达了限制将会被删除",
+		"show_note": "查看密信",
+		"warning_will_not_see_again": "您将<b>无法</b>再次查看该密信",
+		"download_all": "下载全部"
+	},
+	"file_upload": {
+		"selected_files": "已选中的文件",
+		"no_files_selected": "没有文件被选中"
+	}
+}

frontend/locales/de.json

@@ -0,0 +1,42 @@
+{
+	"common": {
+		"note": "Hinweis",
+		"file": "Datei",
+		"advanced": "erweitert",
+		"create": "erstellen",
+		"loading": "Läd...",
+		"mode": "Modus",
+		"views": "{n, plural, =0 {Ansichten} =1 {1 Ansicht} other {# Ansichten}}",
+		"minutes": "{n, plural, =0 {Minuten} =1 {1 Minute} other {# Minuten}}",
+		"max": "max",
+		"share_link": "Link teilen",
+		"copy_clipboard": "in die Zwischenablage kopieren"
+	},
+	"home": {
+		"intro": "Senden Sie ganz einfach <i>vollständig verschlüsselte</i>, sichere Notizen oder Dateien mit einem Klick. Erstellen Sie einfach eine Notiz und teilen Sie den Link.",
+		"explanation": "die Notiz verfällt und wird nach {type} zerstört.",
+		"new_note": "neue Note",
+		"new_note_notice": "<b>Verfügbarkeit:</b><br />es ist nicht garantiert, dass die Notiz gespeichert wird, da alles im Speicher gehalten wird. Wenn dieser voll ist, werden die ältesten Notizen entfernt.<br />(Sie werden wahrscheinlich keine Probleme haben, seien Sie nur gewarnt).",
+		"errors": {
+			"note_to_big": "Notiz konnte nicht erstellt werden. Notiz ist zu groß",
+			"note_error": "konnte keine Notiz erstellen. Bitte versuchen Sie es erneut.",
+			"max": "max: {n}",
+			"empty_content": "Notiz ist leer."
+		},
+		"copied_to_clipboard": "in die Zwischenablage kopiert 🔗"
+	},
+	"show": {
+		"errors": {
+			"not_found": "wurde nicht gefunden oder wurde bereits gelöscht.",
+			"decryption_failed": "falsches Passwort. konnte nicht entziffert werden. wahrscheinlich ein defekter Link. Notiz wurde zerstört."
+		},
+		"explanation": "Klicken Sie unten, um die Notiz anzuzeigen und zu löschen, wenn der Zähler sein Limit erreicht hat",
+		"show_note": "Notiz anzeigen",
+		"warning_will_not_see_again": "haben Sie <b>keine</b> Gelegenheit, die Notiz noch einmal zu sehen.",
+		"download_all": "alle herunterladen"
+	},
+	"file_upload": {
+		"selected_files": "Ausgewählte Dateien",
+		"no_files_selected": "Keine Dateien ausgewählt"
+	}
+}

frontend/locales/en.json

@@ -4,20 +4,13 @@
 		"file": "file",
 		"advanced": "advanced",
 		"create": "create",
-		"loading": "loading",
+		"loading": "loading...",
 		"mode": "mode",
 		"views": "{n, plural, =0 {views} =1 {1 view} other {# views}}",
 		"minutes": "{n, plural, =0 {minutes} =1 {1 minute} other {# minutes}}",
 		"max": "max",
 		"share_link": "share link",
-		"copy_clipboard": "copy to clipboard",
-		"copied_to_clipboard": "copied to clipboard",
-		"encrypting": "encrypting",
-		"decrypting": "decrypting",
-		"uploading": "uploading",
-		"downloading": "downloading",
-		"qr_code": "qr code",
-		"password": "password"
+		"copy_clipboard": "copy to clipboard"
 	},
 	"home": {
 		"intro": "Easily send <i>fully encrypted</i>, secure notes or files with one click. Just create a note and share the link.",
@@ -25,37 +18,25 @@
 		"new_note": "new note",
 		"new_note_notice": "<b>availability:</b><br />the note is not guaranteed to be stored as everything is kept in ram, if it fills up the oldest notes will be removed.<br />(you probably will be fine, just be warned.)",
 		"errors": {
-			"note_too_big": "could not create note. note is too big",
+			"note_to_big": "could not create note. note is to big",
 			"note_error": "could not create note. please try again.",
 			"max": "max: {n}",
 			"empty_content": "note is empty."
 		},
-		"messages": {
-			"note_created": "note created."
-		},
-		"advanced": {
-			"explanation": "By default, a securely generated password is used for each note. You can however also choose your own password, which is not included in the link.",
-			"custom_password": "custom password"
-		},
-		"pasting": "Pasting...",
-		"pasted_files": "Pasted Files",
-		"remove": "Remove"
+		"copied_to_clipboard": "copied to clipboard 🔗"
 	},
 	"show": {
 		"errors": {
 			"not_found": "note was not found or was already deleted.",
-			"decryption_failed": "wrong password. could not decipher. probably a broken link. note was destroyed.",
-			"unsupported_type": "unsupported note type."
+			"decryption_failed": "wrong password. could not decipher. probably a broken link. note was destroyed."
 		},
-		"explanation": "click below to show and delete the note if the counter has reached its limit",
+		"explanation": "click below to show and delete the note if the counter has reached it's limit",
 		"show_note": "show note",
 		"warning_will_not_see_again": "you will <b>not</b> get the chance to see the note again.",
-		"download_all": "download all",
-		"links_found": "links found inside the note:"
+		"download_all": "download all"
 	},
 	"file_upload": {
 		"selected_files": "Selected Files",
-		"no_files_selected": "No Files Selected",
-		"clear": "Reset"
+		"no_files_selected": "No Files Selected"
 	}
 }

frontend/locales/es.json

@@ -4,58 +4,39 @@
 		"file": "archivo",
 		"advanced": "avanzado",
 		"create": "crear",
-		"loading": "cargando",
+		"loading": "cargando...",
 		"mode": "modo",
 		"views": "{n, plural, =0 {vistas} =1 {1 vista} other {# vistas}}",
 		"minutes": "{n, plural, =0 {minutos} =1 {1 minuto} other {# minutos}}",
 		"max": "max",
 		"share_link": "compartir enlace",
-		"copy_clipboard": "copiar al portapapeles",
-		"copied_to_clipboard": "copiado al portapapeles",
-		"encrypting": "encriptando",
-		"decrypting": "descifrando",
-		"uploading": "cargando",
-		"downloading": "descargando",
-		"qr_code": "código qr",
-		"password": "contraseña"
+		"copy_clipboard": "copiar al portapapeles"
 	},
 	"home": {
 		"intro": "Envía fácilmente notas o archivos <i>totalmente encriptados</i> y seguros con un solo clic. Solo tienes que crear una nota y compartir el enlace.",
 		"explanation": "la nota expirará y se destruirá después de {type}.",
 		"new_note": "nueva nota",
-		"new_note_notice": "<b>disponibilidad:</b><br />no se garantiza que la nota se almacene, ya que todo se guarda en la memoria RAM, si se llena se eliminarán las notas más antiguas.<br />(probablemente estará bien, solo está advertido.)",
+		"new_note_notice": "<b>disponibilidad:</b><br />no se garantiza que la nota se almacene, ya que todo se guarda en la memoria RAM, si se llena se eliminarán las notas más antiguas.<br />(probablemente estará bien, sólo está advertido.)",
 		"errors": {
-			"note_too_big": "no se pudo crear la nota. la nota es demasiado grande",
+			"note_to_big": "no se pudo crear la nota. la nota es demasiado grande",
 			"note_error": "No se ha podido crear la nota. Por favor, inténtelo de nuevo.",
 			"max": "max: {n}",
 			"empty_content": "la nota está vacía."
 		},
-		"messages": {
-			"note_created": "nota creada."
-		},
-		"advanced": {
-			"explanation": "Por defecto, se utiliza una contraseña generada de forma segura para cada nota. No obstante, también puede elegir su propia contraseña, la cual no se incluye en el enlace.",
-			"custom_password": "contraseña personalizada"
-		},
-		"pasting": "Pegando...",
-		"pasted_files": "Archivos pegados",
-		"remove": "Eliminar"
+		"copied_to_clipboard": "copiado al portapapeles 🔗"
 	},
 	"show": {
 		"errors": {
 			"not_found": "la nota no se encontró o ya fue borrada.",
-			"decryption_failed": "contraseña incorrecta. no se pudo descifrar. probablemente un enlace roto. la nota fue destruida.",
-			"unsupported_type": "tipo de nota no compatible."
+			"decryption_failed": "contraseña incorrecta. no se pudo descifrar. probablemente un enlace roto. la nota fue destruida."
 		},
 		"explanation": "pulse abajo para mostrar y borrar la nota si el contador ha llegado a su límite",
 		"show_note": "mostrar nota",
-		"warning_will_not_see_again": "<b>no</b> tendrás la oportunidad de volver a ver la nota.",
-		"download_all": "descargar todo",
-		"links_found": "enlaces que se encuentran dentro de la nota:"
+		"warning_will_not_see_again": " <b>no</b> tendrás la oportunidad de volver a ver la nota.",
+		"download_all": "descargar todo"
 	},
 	"file_upload": {
 		"selected_files": "Archivos seleccionados",
-		"no_files_selected": "No hay archivos seleccionados",
-		"clear": "Restablecer"
+		"no_files_selected": "No hay archivos seleccionados"
 	}
 }

frontend/locales/fr.json

@@ -0,0 +1,42 @@
+{
+	"common": {
+		"note": "note",
+		"file": "fichier",
+		"advanced": "avancé",
+		"create": "créer",
+		"loading": "chargement...",
+		"mode": "mode",
+		"views": "{n, plural, =0 {vues} =1 {1 vue} other {# vues}}",
+		"minutes": "{n, plural, =0 {minutes} =1 {1 minute} other {# minutes}}",
+		"max": "max",
+		"share_link": "partager le lien",
+		"copy_clipboard": "copier dans le presse-papiers"
+	},
+	"home": {
+		"intro": "Envoyez facilement des notes ou des fichiers <i>entièrement cryptés</i> et sécurisés en un seul clic. Il suffit de créer une note et de partager le lien.",
+		"explanation": "la note expirera et sera détruite après {type}.",
+		"new_note": "nouvelle note",
+		"new_note_notice": "<b>disponibilité :</b><br />la note n'est pas garantie d'être stockée car tout est conservé dans la mémoire vive, si elle se remplit les notes les plus anciennes seront supprimées.<br />(vous serez probablement bien, soyez juste averti.)",
+		"errors": {
+			"note_to_big": "Impossible de créer une note. La note est trop grande",
+			"note_error": "n'a pas pu créer de note. Veuillez réessayer.",
+			"max": "max: {n}",
+			"empty_content": "La note est vide."
+		},
+		"copied_to_clipboard": "copié dans le presse-papiers 🔗"
+	},
+	"show": {
+		"errors": {
+			"not_found": "La note n'a pas été trouvée ou a déjà été supprimée.",
+			"decryption_failed": "mauvais mot de passe. impossible à déchiffrer. probablement un lien brisé. la note a été détruite."
+		},
+		"explanation": "Cliquez ci-dessous pour afficher et supprimer la note si le compteur a atteint sa limite.",
+		"show_note": "note de présentation",
+		"warning_will_not_see_again": "vous <b>n'aurez pas</b> la chance de revoir la note.",
+		"download_all": "télécharger tout"
+	},
+	"file_upload": {
+		"selected_files": "Fichiers sélectionnés",
+		"no_files_selected": "Aucun fichier sélectionné"
+	}
+}

frontend/locales/it.json

@@ -4,20 +4,13 @@
 		"file": "file",
 		"advanced": "avanzato",
 		"create": "crea",
-		"loading": "carica",
-		"mode": "modalità",
+		"loading": "carica...",
+		"mode": "modalita",
 		"views": "{n, plural, =0 {viste} =1 {1 vista} other {# viste}}",
 		"minutes": "{n, plural, =0 {minuti} =1 {1 minuto} other {# minuti}}",
 		"max": "max",
 		"share_link": "condividi link",
-		"copy_clipboard": "copia negli appunti",
-		"copied_to_clipboard": "copiato negli appunti",
-		"encrypting": "criptando",
-		"decrypting": "decifrando",
-		"uploading": "caricamento",
-		"downloading": "scaricando",
-		"qr_code": "codice qr",
-		"password": "password"
+		"copy_clipboard": "copia negli appunti"
 	},
 	"home": {
 		"intro": "Invia facilmente note o file <i>completamente criptati</i> e sicuri con un solo clic. Basta creare una nota e condividere il link.",
@@ -25,37 +18,25 @@
 		"new_note": "nuova nota",
 		"new_note_notice": "<b>disponibilità:</b><br />la nota non è garantita per essere memorizzata come tutto è tenuto in ram, se si riempie le note più vecchie saranno rimosse.<br />(probabilmente andrà bene, basta essere avvertiti).",
 		"errors": {
-			"note_too_big": "impossibile creare una nota. la nota è troppo grande",
+			"note_to_big": "impossibile creare una nota. la nota è troppo grande",
 			"note_error": "Impossibile creare la nota. Riprova.",
 			"max": "max: {n}",
 			"empty_content": "la nota è vuota."
 		},
-		"messages": {
-			"note_created": "nota creata."
-		},
-		"advanced": {
-			"explanation": "Per impostazione predefinita, per ogni nota viene utilizzata una password generata in modo sicuro. È tuttavia possibile scegliere la propria password, che non è inclusa nel link.",
-			"custom_password": "password personalizzata"
-		},
-		"pasting": "Incollando...",
-		"pasted_files": "File incollati",
-		"remove": "Rimuovi"
+		"copied_to_clipboard": "copiato negli appunti 🔗"
 	},
 	"show": {
 		"errors": {
 			"not_found": "non è stata trovata o è stata già cancellata.",
-			"decryption_failed": "password sbagliata. non ha potuto decifrare. probabilmente un link rotto. la nota è stata distrutta.",
-			"unsupported_type": "tipo di nota non supportato."
+			"decryption_failed": "password sbagliata. non ha potuto decifrare. probabilmente un link rotto. la nota è stata distrutta."
 		},
 		"explanation": "clicca sotto per mostrare e cancellare la nota se il contatore ha raggiunto il suo limite",
 		"show_note": "mostra la nota",
-		"warning_will_not_see_again": "<b>non</b> avrete la possibilità di rivedere la nota.",
-		"download_all": "scarica tutti",
-		"links_found": "link presenti all'interno della nota:"
+		"warning_will_not_see_again": " <b>non</b> avrete la possibilità di rivedere la nota.",
+		"download_all": "scarica tutti"
 	},
 	"file_upload": {
 		"selected_files": "File selezionati",
-		"no_files_selected": "Nessun file selezionato",
-		"clear": "Reset"
+		"no_files_selected": "Nessun file selezionato"
 	}
 }

frontend/package.json

@@ -0,0 +1,35 @@
+{
+	"private": true,
+	"scripts": {
+		"dev": "vite dev",
+		"build": "vite build",
+		"preview": "svelte-kit preview",
+		"check": "svelte-check --tsconfig tsconfig.json",
+		"licenses": "license-checker --summary > licenses.csv",
+		"locale:download": "node scripts/locale.js"
+	},
+	"type": "module",
+	"devDependencies": {
+		"@lokalise/node-api": "^7.3.1",
+		"@sveltejs/adapter-static": "^1.0.0-next.34",
+		"@sveltejs/kit": "^1.0.0-next.361",
+		"@types/dompurify": "^2.3.3",
+		"@types/file-saver": "^2.0.5",
+		"adm-zip": "^0.5.9",
+		"dotenv": "^16.0.1",
+		"svelte": "^3.49.0",
+		"svelte-check": "^2.8.0",
+		"svelte-intl-precompile": "^0.10.1",
+		"svelte-preprocess": "^4.10.7",
+		"tslib": "^2.4.0",
+		"typescript": "^4.7.4",
+		"vite": "^3.0.0"
+	},
+	"dependencies": {
+		"@fontsource/fira-mono": "^4.5.8",
+		"copy-to-clipboard": "^3.3.1",
+		"dompurify": "^2.3.9",
+		"file-saver": "^2.0.5",
+		"pretty-bytes": "^5.6.0"
+	}
+}

frontend/scripts/locale.js

@@ -0,0 +1,54 @@
+import dotenv from 'dotenv'
+import { LokaliseApi } from '@lokalise/node-api'
+import https from 'https'
+import AdmZip from 'adm-zip'
+
+dotenv.config()
+
+const apiKey = process.env.LOKALISE_API_KEY
+const project_id = process.env.LOKALISE_PROJECT
+if (!apiKey) throw new Error('No API Key set for Lokalize! Set with "LOKALISE_API_KEY"')
+if (!project_id) throw new Error('No project id set for Lokalize! Set with "LOKALISE_PROJECT"')
+const client = new LokaliseApi({ apiKey })
+
+const WGet = (url) =>
+	new Promise((done) => {
+		https
+			.get(url, (res) => {
+				const data = []
+				res
+					.on('data', (chunk) => {
+						data.push(chunk)
+					})
+					.on('end', () => {
+						let buffer = Buffer.concat(data)
+						done(buffer)
+					})
+			})
+			.on('error', (err) => {
+				console.log('download error:', err)
+			})
+	})
+
+async function download() {
+	// For details see: https://app.lokalise.com/api2docs/curl/#transition-download-files-post
+	const download = await client.files().download(project_id, {
+		format: 'json',
+		indentation: 'tab',
+		json_unescaped_slashes: true,
+		original_filenames: false,
+		bundle_structure: '%LANG_ISO%.%FORMAT%',
+		export_sort: 'first_added',
+		export_empty_as: 'skip',
+		add_newline_eof: true,
+		replace_breaks: false,
+	})
+	const buffered = await WGet(download.bundle_url)
+	const zip = new AdmZip(buffered)
+	zip.extractAllTo('./locales', true)
+}
+
+download().catch((e) => {
+	console.error(e)
+	process.exit(1)
+})

frontend/src/app.css

@@ -14,9 +14,7 @@
 	--ui-text-0: #fefefe;
 	--ui-text-1: #eee;
 	--ui-clr-primary: hsl(186, 65%, 55%);
-	--ui-clr-primary-alt: hsl(186, 85%, 35%);
 	--ui-clr-error: hsl(357, 77%, 51%);
-	--ui-clr-error-alt: hsl(357, 87%, 41%);
 
 	--ui-anim: all 150ms ease;
 }
@@ -87,12 +85,10 @@ button {
 	font-size: inherit;
 	background: inherit;
 	color: inherit;
-	border: none;
-	padding-inline: initial;
 }
 
 *:disabled,
-.disabled {
+*[disabled='true'] {
 	opacity: 0.5;
 }
 
@@ -126,13 +122,3 @@ fieldset {
 .tr {
 	text-align: right;
 }
-
-hr {
-	border: none;
-	border-bottom: 2px solid var(--ui-bg-1);
-	margin: 1rem 0;
-}
-
-p {
-	margin: 0;
-}

frontend/src/app.html

@@ -2,6 +2,7 @@
 <html lang="en">
 	<head>
 		<meta charset="utf-8" />
+		<link rel="icon" href="/favicon.png" />
 		<meta name="viewport" content="width=device-width, initial-scale=1" />
 
 		%sveltekit.head%

frontend/src/global.d.ts

@@ -0,0 +1,3 @@
+/// <reference types="@sveltejs/kit" />
+/// <reference types="svelte" />
+/// <reference types="vite/client" />

frontend/src/lib/api.ts

@@ -0,0 +1,74 @@
+export type NoteMeta = { type: 'text' | 'file' }
+
+export type Note = {
+	contents: string
+	meta: NoteMeta
+	views?: number
+	expiration?: number
+}
+export type NoteInfo = {}
+export type NotePublic = Pick<Note, 'contents' | 'meta'>
+export type NoteCreate = Omit<Note, 'meta'> & { meta: string }
+
+export type FileDTO = Pick<File, 'name' | 'size' | 'type'> & {
+	contents: string
+}
+
+type CallOptions = {
+	url: string
+	method: string
+	body?: any
+}
+
+export class PayloadToLargeError extends Error {}
+
+export async function call(options: CallOptions) {
+	const response = await fetch('/api/' + options.url, {
+		method: options.method,
+		body: options.body === undefined ? undefined : JSON.stringify(options.body),
+		mode: 'cors',
+		headers: {
+			'Content-Type': 'application/json',
+		},
+	})
+
+	if (!response.ok) {
+		if (response.status === 413) throw new PayloadToLargeError()
+		else throw new Error('API call failed')
+	}
+	return response.json()
+}
+
+export async function create(note: Note) {
+	const { meta, ...rest } = note
+	const body: NoteCreate = {
+		...rest,
+		meta: JSON.stringify(meta),
+	}
+	const data = await call({
+		url: 'notes/',
+		method: 'post',
+		body,
+	})
+	return data as { id: string }
+}
+
+export async function get(id: string): Promise<NotePublic> {
+	const data = await call({
+		url: `notes/${id}`,
+		method: 'delete',
+	})
+	const { contents, meta } = data
+	return {
+		contents,
+		meta: JSON.parse(meta) as NoteMeta,
+	}
+}
+
+export async function info(id: string): Promise<NoteInfo> {
+	const data = await call({
+		url: `notes/${id}`,
+		method: 'get',
+	})
+	return data
+}

frontend/src/lib/crypto.ts

@@ -0,0 +1,71 @@
+export class Hex {
+	static encode(buffer: ArrayBuffer): string {
+		let s = ''
+		for (const i of new Uint8Array(buffer)) {
+			s += i.toString(16).padStart(2, '0')
+		}
+		return s
+	}
+
+	static decode(s: string): ArrayBuffer {
+		const size = s.length / 2
+		const buffer = new Uint8Array(size)
+		for (let i = 0; i < size; i++) {
+			const idx = i * 2
+			const segment = s.slice(idx, idx + 2)
+			buffer[i] = parseInt(segment, 16)
+		}
+		return buffer
+	}
+}
+
+const ALG = 'AES-GCM'
+
+export function getRandomBytes(size = 16): Uint8Array {
+	return window.crypto.getRandomValues(new Uint8Array(size))
+}
+
+export function getKeyFromString(password: string) {
+	return window.crypto.subtle.importKey(
+		'raw',
+		new TextEncoder().encode(password),
+		'PBKDF2',
+		false,
+		['deriveBits', 'deriveKey']
+	)
+}
+
+export async function getDerivedForKey(key: CryptoKey, salt: ArrayBuffer) {
+	const iterations = 100_000
+	return window.crypto.subtle.deriveKey(
+		{
+			name: 'PBKDF2',
+			salt,
+			iterations,
+			hash: 'SHA-512',
+		},
+		key,
+		{ name: ALG, length: 256 },
+		true,
+		['encrypt', 'decrypt']
+	)
+}
+
+export async function encrypt(plaintext: string, key: CryptoKey) {
+	const salt = getRandomBytes(16)
+	const derived = await getDerivedForKey(key, salt)
+	const iv = getRandomBytes(16)
+	const encrypted = await window.crypto.subtle.encrypt(
+		{ name: ALG, iv },
+		derived,
+		new TextEncoder().encode(plaintext)
+	)
+	return [salt, iv, encrypted].map(Hex.encode).join(':')
+}
+
+export async function decrypt(ciphertext: string, key: CryptoKey) {
+	const [salt, iv, encrypted] = ciphertext.split(':').map(Hex.decode)
+	const derived = await getDerivedForKey(key, salt)
+	const plaintext = await window.crypto.subtle.decrypt({ name: ALG, iv }, derived, encrypted)
+	return new TextDecoder().decode(plaintext)
+}

frontend/src/lib/files.ts

@@ -0,0 +1,13 @@
+export class Files {
+	static toString(f: File | Blob): Promise<string> {
+		const reader = new window.FileReader()
+		reader.readAsDataURL(f)
+		return new Promise((resolve) => {
+			reader.onloadend = () => resolve(reader.result as string)
+		})
+	}
+
+	static async fromString(s: string): Promise<Blob> {
+		return fetch(s).then((r) => r.blob())
+	}
+}

frontend/src/lib/icons/IconContrast.svelte

@@ -1,5 +1,3 @@
-<script lang="ts"></script>
-
 <svg xmlns="http://www.w3.org/2000/svg" class="ionicon" viewBox="0 0 512 512"
 	><title>Contrast</title><path
 		d="M256 32C132.29 32 32 132.29 32 256s100.29 224 224 224 224-100.29 224-224S379.71 32 256 32zM128.72 383.28A180 180 0 01256 76v360a178.82 178.82 0 01-127.28-52.72z"

frontend/src/lib/icons/IconCopy.svelte

@@ -1,5 +1,3 @@
-<script lang="ts"></script>
-
 <svg xmlns="http://www.w3.org/2000/svg" class="ionicon" viewBox="0 0 512 512"
 	><title>Copy</title><path
 		d="M456 480H136a24 24 0 01-24-24V128a16 16 0 0116-16h328a24 24 0 0124 24v320a24 24 0 01-24 24z"

frontend/src/lib/icons/IconDice.svelte

@@ -1,5 +1,3 @@
-<script lang="ts"></script>
-
 <svg xmlns="http://www.w3.org/2000/svg" class="ionicon" viewBox="0 0 512 512"
 	><title>Dice</title><path
 		d="M48 366.92L240 480V284L48 170zM192 288c8.84 0 16 10.75 16 24s-7.16 24-16 24-16-10.75-16-24 7.16-24 16-24zm-96 32c8.84 0 16 10.75 16 24s-7.16 24-16 24-16-10.75-16-24 7.16-24 16-24zM272 284v196l192-113.08V170zm48 140c-8.84 0-16-10.75-16-24s7.16-24 16-24 16 10.75 16 24-7.16 24-16 24zm0-88c-8.84 0-16-10.75-16-24s7.16-24 16-24 16 10.75 16 24-7.16 24-16 24zm96 32c-8.84 0-16-10.75-16-24s7.16-24 16-24 16 10.75 16 24-7.16 24-16 24zm0-88c-8.84 0-16-10.75-16-24s7.16-24 16-24 16 10.75 16 24-7.16 24-16 24zm32 77.64zM256 32L64 144l192 112 192-112zm0 120c-13.25 0-24-7.16-24-16s10.75-16 24-16 24 7.16 24 16-10.75 16-24 16z"

frontend/src/lib/icons/IconEye.svelte

@@ -1,5 +1,3 @@
-<script lang="ts"></script>
-
 <svg xmlns="http://www.w3.org/2000/svg" class="ionicon" viewBox="0 0 512 512"
 	><title>Eye</title><circle cx="256" cy="256" r="64" /><path
 		d="M394.82 141.18C351.1 111.2 304.31 96 255.76 96c-43.69 0-86.28 13-126.59 38.48C88.52 160.23 48.67 207 16 256c26.42 44 62.56 89.24 100.2 115.18C159.38 400.92 206.33 416 255.76 416c49 0 95.85-15.07 139.3-44.79C433.31 345 469.71 299.82 496 256c-26.38-43.43-62.9-88.56-101.18-114.82zM256 352a96 96 0 1196-96 96.11 96.11 0 01-96 96z"

frontend/src/lib/icons/IconEyeOff.svelte

@@ -1,5 +1,3 @@
-<script lang="ts"></script>
-
 <svg xmlns="http://www.w3.org/2000/svg" class="ionicon" viewBox="0 0 512 512"
 	><title>Eye Off</title><path
 		d="M63.998 86.004l21.998-21.998L448 426.01l-21.998 21.998zM259.34 192.09l60.57 60.57a64.07 64.07 0 00-60.57-60.57zM252.66 319.91l-60.57-60.57a64.07 64.07 0 0060.57 60.57z"

frontend/src/lib/stores/status.ts

@@ -0,0 +1,22 @@
+import { call } from '$lib/api'
+import { writable } from 'svelte/store'
+
+export type Status = {
+	version: string
+	max_size: number
+	max_views: number
+	max_expiration: number
+	allow_advanced: boolean
+	theme_image: string
+	theme_text: string
+}
+
+export const status = writable<null | Status>(null)
+
+export async function init() {
+	const data = await call({
+		url: 'status/',
+		method: 'get',
+	})
+	status.set(data)
+}

frontend/src/lib/ui/AboutParagraph.svelte

@@ -1,17 +1,10 @@
 <script lang="ts">
-	import type { Snippet } from 'svelte'
-
-	interface Props {
-		title: string
-		children?: Snippet
-	}
-
-	let { title, children }: Props = $props()
+	export let title: string
 </script>
 
 <p>
 	<b>▶ {title}</b>
-	{@render children?.()}
+	<slot />
 </p>
 
 <style>

frontend/src/lib/ui/Button.svelte

@@ -1,14 +1,4 @@
-<script lang="ts">
-	import type { HTMLButtonAttributes } from 'svelte/elements'
-
-	interface Props {
-		children?: import('svelte').Snippet
-	}
-
-	let { children, ...rest }: HTMLButtonAttributes & Props = $props()
-</script>
-
-<button {...rest}>{@render children?.()}</button>
+<button {...$$restProps} on:click><slot /></button>
 
 <style>
 	button {

frontend/src/lib/ui/FileUpload.svelte

@@ -0,0 +1,82 @@
+<script lang="ts">
+	import type { FileDTO } from '$lib/api'
+	import { Files } from '$lib/files'
+	import { createEventDispatcher } from 'svelte'
+	import { t } from 'svelte-intl-precompile'
+	import Button from './Button.svelte'
+	import MaxSize from './MaxSize.svelte'
+
+	export let label: string = ''
+	let files: File[] = []
+
+	const dispatch = createEventDispatcher<{ file: string }>()
+
+	async function onInput(e: Event) {
+		const input = e.target as HTMLInputElement
+		if (input?.files?.length) {
+			files = [...files, ...Array.from(input.files)]
+			const data: FileDTO[] = await Promise.all(
+				files.map(async (file) => ({
+					name: file.name,
+					type: file.type,
+					size: file.size,
+					contents: await Files.toString(file),
+				}))
+			)
+			dispatch('file', JSON.stringify(data))
+		} else {
+			dispatch('file', '')
+		}
+	}
+
+	function clear(e: Event) {
+		e.preventDefault()
+		files = []
+		dispatch('file', '')
+	}
+</script>
+
+<label>
+	<small>
+		{label}
+	</small>
+	<input type="file" on:change={onInput} multiple />
+	<div class="box">
+		{#if files.length}
+			<div>
+				<b>{$t('file_upload.selected_files')}</b>
+				{#each files as file}
+					<div class="file">
+						{file.name}
+					</div>
+				{/each}
+				<div class="spacer" />
+				<Button on:click={clear}>Clear</Button>
+			</div>
+		{:else}
+			<div>
+				<b>{$t('file_upload.no_files_selected')}</b>
+				<br />
+				<small>{$t('common.max')}: <MaxSize /></small>
+			</div>
+		{/if}
+	</div>
+</label>
+
+<style>
+	input {
+		display: none;
+	}
+
+	.box {
+		display: flex;
+		flex-direction: column;
+		justify-content: center;
+		align-items: center;
+		cursor: pointer;
+	}
+
+	.spacer {
+		margin-top: 1rem;
+	}
+</style>

frontend/src/lib/ui/Icon.svelte

@@ -1,10 +1,9 @@
-<script lang="ts" module>
+<script lang="ts" context="module">
 	import IconContrast from '$lib/icons/IconContrast.svelte'
 	import IconCopy from '$lib/icons/IconCopy.svelte'
 	import IconDice from '$lib/icons/IconDice.svelte'
 	import IconEye from '$lib/icons/IconEye.svelte'
 	import IconEyeOff from '$lib/icons/IconEyeOff.svelte'
-	import type { HTMLButtonAttributes } from 'svelte/elements'
 
 	const map = {
 		contrast: IconContrast,
@@ -16,27 +15,22 @@
 </script>
 
 <script lang="ts">
-	interface Props {
-		icon: keyof typeof map
-	}
-
-	let { icon, ...rest }: HTMLButtonAttributes & Props = $props()
+	export let icon: keyof typeof map
 </script>
 
-<button type="button" {...rest}>
+<div on:click {...$$restProps}>
 	{#if map[icon]}
-		{@const SvelteComponent = map[icon]}
-		<SvelteComponent />
+		<svelte:component this={map[icon]} />
 	{/if}
-</button>
+</div>
 
 <style>
-	button {
+	div {
 		display: inline-block;
 		contain: strict;
 		box-sizing: content-box;
 	}
-	button > :global(svg) {
+	div > :global(svg) {
 		display: block;
 		fill: currentColor;
 	}

frontend/src/lib/ui/MaxSize.svelte

@@ -1,10 +1,7 @@
 <script lang="ts">
+	import { status } from '$lib/stores/status'
 	import prettyBytes from 'pretty-bytes'
 	import { _ } from 'svelte-intl-precompile'
-
-	import { status } from '$lib/stores/status'
-
-	// Payload is raw bytes (msgpack + cipher), no base64 padding overhead.
 </script>
 
 <span>

frontend/src/lib/ui/ShowNote.svelte

@@ -0,0 +1,87 @@
+<script lang="ts">
+	import type { FileDTO, NotePublic } from '$lib/api'
+	import { Files } from '$lib/files'
+	import copy from 'copy-to-clipboard'
+	import DOMPurify from 'dompurify'
+	import { saveAs } from 'file-saver'
+	import prettyBytes from 'pretty-bytes'
+	import { t } from 'svelte-intl-precompile'
+	import Button from './Button.svelte'
+
+	export let note: NotePublic
+
+	const RE_URL = /[A-Za-z]+:\/\/([A-Z a-z0-9\-._~:\/?#\[\]@!$&'()*+,;%=])+/g
+	let files: FileDTO[] = []
+
+	$: if (note.meta.type === 'file') {
+		files = JSON.parse(note.contents) as FileDTO[]
+	}
+
+	$: download = () => {
+		for (const file of files) {
+			downloadFile(file)
+		}
+	}
+
+	async function downloadFile(file: FileDTO) {
+		const f = new File([await Files.fromString(file.contents)], file.name, {
+			type: file.type,
+		})
+		saveAs(f)
+	}
+
+	function contentWithLinks(content: string): string {
+		const replaced = content.replace(
+			RE_URL,
+			(url) => `<a href="${url}" rel="noreferrer">${url}</a>`
+		)
+		return DOMPurify.sanitize(replaced, { USE_PROFILES: { html: true } })
+	}
+</script>
+
+<p class="error-text">{@html $t('show.warning_will_not_see_again')}</p>
+{#if note.meta.type === 'text'}
+	<div class="note">
+		{@html contentWithLinks(note.contents)}
+	</div>
+	<Button on:click={() => copy(note.contents)}>{$t('common.copy_clipboard')}</Button>
+{:else}
+	{#each files as file}
+		<div class="note file">
+			<b on:click={() => downloadFile(file)}>↓ {file.name}</b>
+			<small> {file.type} － {prettyBytes(file.size)}</small>
+		</div>
+	{/each}
+	<Button on:click={download}>{$t('show.download_all')}</Button>
+{/if}
+
+<style>
+	.note {
+		width: 100%;
+		margin: 0;
+		padding: 0;
+		border: 2px solid var(--ui-bg-1);
+		outline: none;
+		padding: 0.5rem;
+		white-space: pre;
+		overflow: auto;
+		margin-bottom: 0.5rem;
+	}
+
+	.note b {
+		cursor: pointer;
+		white-space: nowrap;
+		overflow: hidden;
+		text-overflow: ellipsis;
+	}
+
+	.note.file {
+		display: flex;
+		justify-content: space-between;
+		align-items: center;
+	}
+
+	.note.file small {
+		padding-left: 1rem;
+	}
+</style>

frontend/src/lib/ui/Switch.svelte

@@ -1,43 +1,46 @@
 <script lang="ts">
-	interface Props {
-		label?: string
-		value: boolean
-		color?: boolean
-		[key: string]: any
-	}
-
-	let { label = '', value = $bindable(), color = true, ...rest }: Props = $props()
+	export let label: string = ''
+	export let value: boolean
+	export let color = true
 </script>
 
-<label {...rest}>
-	<small>{label}</small>
-	<input type="checkbox" bind:checked={value} />
-	<span class:color class="slider"></span>
-</label>
+<div {...$$restProps}>
+	<label class="switch">
+		<small>{label}</small>
+		<input type="checkbox" bind:checked={value} />
+		<span class:color class="slider" />
+	</label>
+</div>
 
 <style>
-	label {
+	div {
+		height: 3.75rem;
+	}
+
+	.switch {
 		position: relative;
 		display: inline-block;
+		width: 4rem;
+		height: 2.5rem;
 	}
 
-	label input {
-		display: none;
-	}
-
-	small {
-		display: block;
-		width: max-content;
+	.switch input {
+		opacity: 0;
+		width: 0;
+		height: 0;
 	}
 
 	.slider {
-		display: block;
-		width: 4rem;
-		height: 2.5rem;
-		position: relative;
+		position: absolute;
 		cursor: pointer;
+		top: 0;
+		left: 0;
+		right: 0;
+		bottom: 0;
 		border: 2px solid var(--ui-bg-1);
 		background-color: var(--ui-bg-0);
+		transition: var(--ui-anim);
+		transform: translateY(1.2rem);
 	}
 
 	.slider:before {

frontend/src/lib/ui/TextArea.svelte

@@ -0,0 +1,11 @@
+<script lang="ts">
+	export let label: string = ''
+	export let value: string
+</script>
+
+<label>
+	<small>
+		{label}
+	</small>
+	<textarea class="box" {...$$restProps} bind:value />
+</label>

frontend/src/lib/ui/TextInput.svelte

@@ -0,0 +1,127 @@
+<script lang="ts">
+	import { getRandomBytes, Hex } from '$lib/crypto'
+	import copyToClipboard from 'copy-to-clipboard'
+	import { t } from 'svelte-intl-precompile'
+	import { fade } from 'svelte/transition'
+	import Icon from './Icon.svelte'
+
+	export let label: string = ''
+	export let value: any
+	export let validate: (value: any) => boolean | string = () => true
+	export let copy: boolean = false
+	export let random: boolean = false
+
+	const initialType = $$restProps.type
+	const isPassword = initialType === 'password'
+	let hidden = true
+	let notification: string | null = null
+	let notificationTimeout: NodeJS.Timeout | null = null
+
+	$: valid = validate(value)
+
+	$: if (isPassword) {
+		value
+		$$restProps.type = hidden ? initialType : 'text'
+	}
+
+	function toggle() {
+		hidden = !hidden
+	}
+	function copyFN() {
+		copyToClipboard(value.toString())
+		notify($t('home.copied_to_clipboard'))
+	}
+	function randomFN() {
+		value = Hex.encode(getRandomBytes(20))
+	}
+
+	function notify(msg: string, delay: number = 2000) {
+		if (notificationTimeout) {
+			clearTimeout(notificationTimeout)
+		}
+		notificationTimeout = setTimeout(() => {
+			notification = null
+		}, delay)
+		notification = msg
+	}
+</script>
+
+<label>
+	<small disabled={$$restProps.disabled}>
+		{label}
+		{#if valid !== true}
+			<span class="error-text">{valid}</span>
+		{/if}
+	</small>
+	<input bind:value {...$$restProps} class:valid={valid === true} />
+	<div class="icons">
+		{#if isPassword}
+			<Icon class="icon" icon={hidden ? 'eye' : 'eye-off'} on:click={toggle} />
+		{/if}
+		{#if random}
+			<Icon class="icon" icon="dice" on:click={randomFN} />
+		{/if}
+		{#if copy}
+			<Icon class="icon" icon="copy" on:click={copyFN} />
+		{/if}
+	</div>
+	{#if notification}
+		<div class="notification" transition:fade><small>{notification}</small></div>
+	{/if}
+</label>
+
+<style>
+	label {
+		position: relative;
+		display: block;
+	}
+
+	label > small {
+		display: block;
+	}
+
+	input {
+		width: 100%;
+		margin: 0;
+		border: 2px solid var(--ui-bg-1);
+		outline: none;
+		padding: 0.5rem;
+		height: 2.5rem;
+	}
+	input:hover,
+	input:focus {
+		border-color: var(--ui-clr-primary);
+	}
+
+	input:not(.valid) {
+		border-color: var(--ui-clr-error);
+	}
+
+	.icons {
+		border: 1px red;
+		position: absolute;
+		right: 0.3rem;
+		bottom: 0.3rem;
+		display: flex;
+		color: var(--ui-clr-primary);
+	}
+	.icons > :global(.icon) {
+		width: 1.5rem;
+		height: 1.5rem;
+		background-color: var(--ui-bg-1);
+		border: 2px solid var(--ui-bg-2);
+		padding: 1px;
+		cursor: pointer;
+		margin-left: 0.25rem;
+	}
+	.icons > :global(.icon:hover) {
+		border-color: var(--ui-clr-primary);
+	}
+
+	.notification {
+		text-align: right;
+		position: absolute;
+		right: 0;
+		bottom: -1.5em;
+	}
+</style>

frontend/src/lib/ui/ThemeToggle.svelte

@@ -1,21 +1,24 @@
-<script lang="ts" module>
+<script lang="ts" context="module">
 	import { writable } from 'svelte/store'
 
-	const themes = ['dark', 'light', 'auto'] as const
-	type Theme = (typeof themes)[number]
+	enum Theme {
+		Dark = 'dark',
+		Light = 'light',
+		Auto = 'auto',
+	}
 
-	const NextTheme: Record<Theme, Theme> = {
-		auto: 'light',
-		light: 'dark',
-		dark: 'auto',
+	const NextTheme = {
+		[Theme.Auto]: Theme.Light,
+		[Theme.Light]: Theme.Dark,
+		[Theme.Dark]: Theme.Auto,
 	}
 
 	function init(): Theme {
 		if (typeof window !== 'undefined') {
 			const saved = window.localStorage.getItem('theme') as Theme
-			if (themes.includes(saved)) return saved
+			if (Object.values(Theme).includes(saved)) return saved
 		}
-		return 'auto'
+		return Theme.Auto
 	}
 
 	export const theme = writable<Theme>(init())
@@ -37,19 +40,19 @@
 	}
 </script>
 
-<button onclick={change}>
+<div on:click={change}>
 	<Icon class="icon" icon="contrast" />
 	{$theme}
-</button>
+</div>
 
 <style>
-	button :global(.icon) {
+	div :global(.icon) {
 		height: 1rem;
 		width: 1rem;
 		margin-right: 0.5rem;
 	}
 
-	button {
+	div {
 		display: flex;
 		flex-direction: row;
 		justify-content: flex-end;

frontend/src/lib/views/Create.svelte

@@ -0,0 +1,201 @@
+<script lang="ts">
+	import type { Note } from '$lib/api'
+	import { create,PayloadToLargeError } from '$lib/api'
+	import { encrypt,getKeyFromString,getRandomBytes,Hex } from '$lib/crypto'
+	import { status } from '$lib/stores/status'
+	import Button from '$lib/ui/Button.svelte'
+	import FileUpload from '$lib/ui/FileUpload.svelte'
+	import MaxSize from '$lib/ui/MaxSize.svelte'
+	import Switch from '$lib/ui/Switch.svelte'
+	import TextArea from '$lib/ui/TextArea.svelte'
+	import TextInput from '$lib/ui/TextInput.svelte'
+	import { t } from 'svelte-intl-precompile'
+	import { blur } from 'svelte/transition'
+
+	let note: Note = {
+		contents: '',
+		meta: { type: 'text' },
+		views: 1,
+		expiration: 60,
+	}
+	let result: { password: string; id: string } | null = null
+	let advanced = false
+	let file = false
+	let timeExpiration = false
+	let message = ''
+	let loading = false
+	let error: string | null = null
+
+	$: if (!advanced) {
+		note.views = 1
+		timeExpiration = false
+	}
+
+	$: {
+		message = $t('home.explanation', {
+			values: {
+				type: $t(timeExpiration ? 'common.minutes' : 'common.views', {
+					values: { n: (timeExpiration ? note.expiration : note.views) ?? '?' },
+				}),
+			},
+		})
+	}
+
+	$: note.meta.type = file ? 'file' : 'text'
+
+	$: if (!file) {
+		note.contents = ''
+	}
+
+	class EmptyContentError extends Error {}
+
+	async function submit() {
+		try {
+			error = null
+			loading = true
+			const password = Hex.encode(getRandomBytes(32))
+			const key = await getKeyFromString(password)
+			if (note.contents === '') throw new EmptyContentError()
+			const data: Note = {
+				contents: await encrypt(note.contents, key),
+				meta: note.meta,
+			}
+			if (timeExpiration) data.expiration = parseInt(note.expiration as any)
+			else data.views = parseInt(note.views as any)
+
+			const response = await create(data)
+			result = {
+				password: password,
+				id: response.id,
+			}
+		} catch (e) {
+			if (e instanceof PayloadToLargeError) {
+				error = $t('home.errors.note_to_big')
+			} else if (e instanceof EmptyContentError) {
+				error = $t('home.errors.empty_content')
+			} else {
+				error = $t('home.errors.note_error')
+			}
+		} finally {
+			loading = false
+		}
+	}
+
+	function reset() {
+		window.location.reload()
+	}
+</script>
+
+{#if result}
+	<TextInput
+		type="text"
+		readonly
+		label={$t('common.share_link')}
+		value="{window.location.origin}/note/{result.id}#{result.password}"
+		copy
+	/>
+	<br />
+	<p>
+		{@html $t('home.new_note_notice')}
+	</p>
+	<br />
+	<Button on:click={reset}>{$t('home.new_note')}</Button>
+{:else}
+	<p>
+		{@html $status?.theme_text || $t('home.intro')}
+	</p>
+	<form on:submit|preventDefault={submit}>
+		<fieldset disabled={loading}>
+			{#if file}
+				<FileUpload label={$t('common.file')} on:file={(f) => (note.contents = f.detail)} />
+			{:else}
+				<TextArea label={$t('common.note')} bind:value={note.contents} placeholder="..." />
+			{/if}
+
+			<div class="bottom">
+				<Switch class="file" label={$t('common.file')} bind:value={file} />
+				{#if $status?.allow_advanced}
+					<Switch label={$t('common.advanced')} bind:value={advanced} />
+				{/if}
+				<div class="grow" />
+				<div class="tr">
+					<small>{$t('common.max')}: <MaxSize /> </small>
+					<br />
+					<Button type="submit">{$t('common.create')}</Button>
+				</div>
+			</div>
+
+			{#if error}
+				<div class="error-text">{error}</div>
+			{/if}
+
+			<p>
+				<br />
+				{#if loading}
+					{$t('common.loading')}
+				{:else}
+					{message}
+				{/if}
+			</p>
+
+			{#if advanced}
+				<div transition:blur={{ duration: 250 }}>
+					<br />
+					<div class="fields">
+						<TextInput
+							type="number"
+							label={$t('common.views', { values: { n: 0 } })}
+							bind:value={note.views}
+							disabled={timeExpiration}
+							max={$status?.max_views}
+							validate={(v) =>
+								($status && v < $status?.max_views) ||
+								$t('home.errors.max', { values: { n: $status?.max_views ?? 0 } })}
+						/>
+						<div class="middle-switch">
+							<Switch label={$t('common.mode')} bind:value={timeExpiration} color={false} />
+						</div>
+						<TextInput
+							type="number"
+							label={$t('common.minutes', { values: { n: 0 } })}
+							bind:value={note.expiration}
+							disabled={!timeExpiration}
+							max={$status?.max_expiration}
+							validate={(v) =>
+								($status && v < $status?.max_expiration) ||
+								$t('home.errors.max', { values: { n: $status?.max_expiration ?? 0 } })}
+						/>
+					</div>
+				</div>
+			{/if}
+		</fieldset>
+	</form>
+{/if}
+
+<style>
+	.bottom {
+		display: flex;
+		align-items: flex-end;
+		margin-top: 0.5rem;
+	}
+
+	.bottom :global(.file) {
+		margin-right: 0.5rem;
+	}
+
+	.grow {
+		flex: 1;
+	}
+
+	.middle-switch {
+		margin: 0 1rem;
+	}
+
+	.error-text {
+		margin-top: 0.5rem;
+	}
+
+	.fields {
+		display: flex;
+	}
+</style>

frontend/src/lib/views/Footer.svelte

@@ -1,23 +1,13 @@
 <script lang="ts">
 	import ThemeToggle from '$lib/ui/ThemeToggle.svelte'
-        import { status } from '$lib/stores/status'
 </script>
 
 <footer>
 	<ThemeToggle />
 	<nav>
-		{#if $status?.theme_home_link !== false}
-			<a href="/">/home</a>
-		{/if}
+		<a href="/">/home</a>
 		<a href="/about">/about</a>
-		{#if $status?.imprint_url}
-			<a href={$status.imprint_url} target="_blank" rel="noopener noreferrer">/imprint</a>
-		{:else if $status?.imprint_html}
-			<a href="/imprint">/imprint</a>
-		{/if}
-		<a href="https://github.com/cupcakearmy/cryptgeon" target="_blank" rel="noopener noreferrer">
-			code
-		</a>
+		<a href="https://github.com/cupcakearmy/cryptgeon" target="_blank" rel="noopener">/code</a>
 	</nav>
 </footer>
 
@@ -31,7 +21,6 @@
 		right: 0;
 		width: 100%;
 		background-color: var(--ui-bg-0-85);
-		backdrop-filter: blur(2px);
 	}
 
 	a {

frontend/src/lib/views/Header.svelte

@@ -1,16 +1,10 @@
 <script lang="ts">
 	import { status } from '$lib/stores/status'
-
-	function reset() {
-		window.location.reload()
-	}
 </script>
 
 <header>
-	<a onclick={reset} href="/">
-		{#if $status === null}
-			<!-- waiting for status to load to avoid flashing default logo -->
-		{:else if $status.theme_image}
+	<a href="/">
+		{#if $status?.theme_image}
 			<img alt="logo" src={$status.theme_image} />
 		{:else}
 			<svg

frontend/src/routes/__layout.svelte

@@ -1,18 +1,17 @@
+<script lang="ts" context="module">
+	import { init, waitLocale, getLocaleFromNavigator } from 'svelte-intl-precompile'
+	// @ts-ignore
+	import { registerAll } from '$locales'
+	registerAll()
+	init({ initialLocale: getLocaleFromNavigator() ?? undefined, fallbackLocale: 'en' })
+</script>
+
 <script lang="ts">
-	import { SvelteToast } from '@zerodevx/svelte-toast'
-	import { onMount } from 'svelte'
-	import { waitLocale } from 'svelte-intl-precompile'
-
-	import '../app.css'
-
-	import { init as initStores, status } from '$lib/stores/status'
+	import { init as initStores } from '$lib/stores/status'
 	import Footer from '$lib/views/Footer.svelte'
 	import Header from '$lib/views/Header.svelte'
-	interface Props {
-		children?: import('svelte').Snippet
-	}
-
-	let { children }: Props = $props()
+	import { onMount } from 'svelte'
+	import '../app.css'
 
 	onMount(() => {
 		initStores()
@@ -20,18 +19,15 @@
 </script>
 
 <svelte:head>
-	<title>{$status?.theme_page_title || 'cryptgeon'}</title>
-	<link rel="icon" href={$status?.theme_favicon || '/favicon.png'} />
+	<title>cryptgeon</title>
 </svelte:head>
 
 {#await waitLocale() then _}
 	<main>
 		<Header />
-		{@render children?.()}
+		<slot />
 	</main>
 
-	<SvelteToast />
-
 	<Footer />
 {/await}
 

frontend/src/routes/about.svelte

@@ -1,6 +1,10 @@
-<script lang="ts">
+<script context="module">
+	import { browser, dev } from '$app/env'
 	import { status } from '$lib/stores/status'
 	import AboutParagraph from '$lib/ui/AboutParagraph.svelte'
+
+	export const hydrate = dev
+	export const router = browser
 </script>
 
 <svelte:head>
@@ -39,13 +43,21 @@
 			the backend is written in rust and the frontend is svelte and typescript.
 			<br />
 			you are welcomed to check & audit the
-			<a href="https://github.com/cupcakearmy/cryptgeon" target="_blank" rel="noopener noreferrer">
-				source code</a
-			>.
+			<a href="https://github.com/cupcakearmy/cryptgeon" target="_blank" rel="noopener">
+				source code
+			</a>.
 		</span>
 	</AboutParagraph>
 
-<AboutParagraph title="attribution">
+	<AboutParagraph title="translations">
+		<span
+			>translations are managed on <a href="https://lokalise.com/" target="_blank">Lokalise</a>,
+			which granted an open source license to use the paid version. If you are interested in helping
+			translating don't hesitate to contact me!
+		</span>
+	</AboutParagraph>
+
+	<AboutParagraph title="attribution">
 		<span>
 			icons made by <a href="https://www.freepik.com" title="Freepik">freepik</a> from
 			<a href="https://www.flaticon.com/" title="Flaticon">www.flaticon.com</a>
@@ -64,9 +76,6 @@
 <style>
 	section {
 		width: 100%;
-		display: flex;
-		flex-direction: column;
-		gap: 2rem;
 	}
 
 	ul {

frontend/src/routes/note/[id].svelte

@@ -0,0 +1,83 @@
+<script context="module" lang="ts">
+	import type { Load } from '@sveltejs/kit'
+
+	export const load: Load = async ({ params }) => {
+		return {
+			props: params,
+		}
+	}
+</script>
+
+<script lang="ts">
+	import { onMount } from 'svelte'
+	import { t } from 'svelte-intl-precompile'
+
+	import type { NotePublic } from '$lib/api'
+	import { get, info } from '$lib/api'
+	import { decrypt, getKeyFromString } from '$lib/crypto'
+	import Button from '$lib/ui/Button.svelte'
+	import ShowNote from '$lib/ui/ShowNote.svelte'
+
+	export let id: string
+
+	let password: string
+	let note: NotePublic | null = null
+	let exists = false
+
+	let loading = true
+	let error = false
+
+	onMount(async () => {
+		try {
+			loading = true
+			error = false
+			password = window.location.hash.slice(1)
+			await info(id)
+			exists = true
+		} catch {
+			exists = false
+		} finally {
+			loading = false
+		}
+	})
+
+	async function show() {
+		try {
+			error = false
+			loading = true
+			const data = note || (await get(id)) // Don't get the content twice on wrong password.
+			const key = await getKeyFromString(password)
+			data.contents = await decrypt(data.contents, key)
+			note = data
+		} catch {
+			error = true
+		} finally {
+			loading = false
+		}
+	}
+</script>
+
+{#if !loading}
+	{#if !exists}
+		<p class="error-text">{$t('show.errors.not_found')}</p>
+	{:else if note && !error}
+		<ShowNote {note} />
+	{:else}
+		<form on:submit|preventDefault={show}>
+			<fieldset>
+				<p>{$t('show.explanation')}</p>
+				<Button type="submit">{$t('show.show_note')}</Button>
+				{#if error}
+					<br />
+					<p class="error-text">
+						{$t('show.errors.decryption_failed')}
+						<br />
+					</p>
+				{/if}
+			</fieldset>
+		</form>
+	{/if}
+{/if}
+{#if loading}
+	<p>{$t('common.loading')}</p>
+{/if}

frontend/svelte.config.js

@@ -0,0 +1,12 @@
+import adapter from '@sveltejs/adapter-static'
+import preprocess from 'svelte-preprocess'
+
+export default {
+	preprocess: preprocess(),
+
+	kit: {
+		adapter: adapter({
+			fallback: 'index.html',
+		}),
+	},
+}

frontend/tsconfig.json

@@ -2,7 +2,6 @@
 	"extends": "./.svelte-kit/tsconfig.json",
 	"compilerOptions": {
 		"strict": true,
-		"allowSyntheticDefaultImports": true,
-		"skipLibCheck": true,
-	},
+		"allowSyntheticDefaultImports": true
+	}
 }

frontend/vite.config.js

@@ -0,0 +1,12 @@
+import { sveltekit } from '@sveltejs/kit/vite'
+import precompileIntl from 'svelte-intl-precompile/sveltekit-plugin'
+
+/** @type {import('vite').UserConfig} */
+const config = {
+	server: {
+		port: 3000,
+	},
+	plugins: [sveltekit(), precompileIntl('locales')],
+}
+
+export default config

mise.toml

@@ -1,11 +0,0 @@
-[tools]
-pnpm = "11.5.0"
-rust = "1.95"
-watchexec = "latest"
-# Node loaded below from .nvmrc
-
-[settings]
-idiomatic_version_file_enable_tools = ["node"]
-
-[env]
-SIZE_LIMIT = "100mb"

package.json

@@ -1,23 +1,13 @@
 {
   "scripts": {
-    "dev:docker": "docker compose -f docker-compose.dev.yaml up cache",
-    "dev:packages": "pnpm --parallel run dev",
-    "dev": "pnpm --parallel run /dev/",
-    "docker:up": "docker compose -f docker-compose.dev.yaml up",
-    "docker:build": "docker compose -f docker-compose.dev.yaml build",
-    "test": "playwright test --project=chrome --project=firefox --project=safari",
-    "test:local": "playwright test --project=chrome",
-    "test:server": "docker compose -f docker-compose.dev.yaml up",
-    "test:dl-browsers": "playwright install",
-    "test:prepare": "pnpm run build && pnpm run docker:build",
-    "build": "pnpm run --recursive --filter=!@cryptgeon/backend build"
+    "dev:docker": "docker-compose up redis",
+    "dev:backend": "cd backend && cargo watch -x 'run --bin cryptgeon'",
+    "dev:front": "pnpm --prefix frontend run dev",
+    "dev:proxy": "node proxy.mjs",
+    "dev": "run-p dev:*"
   },
   "devDependencies": {
-    "@playwright/test": "^1.62.1",
-    "@types/node": "^24.13.3"
-  },
-  "packageManager": "pnpm@11.5.0",
-  "engines": {
-    "node": ">=22"
+    "http-proxy": "^1.18.1",
+    "npm-run-all": "^4.1.5"
   }
 }

packages/backend/Cargo.toml

@@ -1,28 +0,0 @@
-[package]
-name = "cryptgeon"
-version = "3.0.0-rc.3"
-authors = ["cupcakearmy <hi@nicco.io>"]
-edition = "2024"
-rust-version = "1.95"
-
-[[bin]]
-name = "cryptgeon"
-path = "src/main.rs"
-
-[dependencies]
-# Core
-axum = "0.8"
-serde = { version = "1", features = ["derive"] }
-tokio = { version = "1", features = ["full"] }
-tower = "0.5"
-tower-http = { version = "0.6", features = ["full"] }
-redis = { version = "1", features = ["tls-native-tls"] }
-
-# Utility
-serde_json = "1"
-rmp-serde = "1"
-lazy_static = "1"
-ring = "0.17"
-bs62 = "0.1"
-byte-unit = "4"
-dotenv = "0.15"

packages/backend/package.json

@@ -1,10 +0,0 @@
-{
-  "private": true,
-  "name": "@cryptgeon/backend",
-  "scripts": {
-    "dev": "watchexec -r -e rs cargo run",
-    "build": "cargo build --release",
-    "test:server": "SIZE_LIMIT=10MiB LISTEN_ADDR=0.0.0.0:3000 cargo run",
-    "test:prepare": "cargo build"
-  }
-}

packages/backend/src/config.rs

@@ -1,85 +0,0 @@
-use byte_unit::Byte;
-
-// Internal
-lazy_static! {
-    pub static ref VERSION: String = option_env!("CARGO_PKG_VERSION")
-        .unwrap_or("Unknown")
-        .to_string();
-    pub static ref FRONTEND_PATH: String =
-        std::env::var("FRONTEND_PATH").unwrap_or("../frontend/build".to_string());
-    pub static ref LISTEN_ADDR: String =
-        std::env::var("LISTEN_ADDR").unwrap_or("0.0.0.0:8000".to_string());
-    pub static ref VERBOSITY: String = std::env::var("VERBOSITY").unwrap_or("warn".to_string());
-}
-
-// CONFIG
-lazy_static! {
-pub static ref LIMIT: usize =
-  Byte::from_str(std::env::var("SIZE_LIMIT").unwrap_or("1 KiB".to_string()))
-    .unwrap()
-    .get_bytes() as usize;
-pub static ref MAX_VIEWS: u32 = std::env::var("MAX_VIEWS")
-  .unwrap_or("100".to_string())
-  .parse()
-  .unwrap();
-pub static ref MAX_EXPIRATION: u32 = std::env::var("MAX_EXPIRATION")
-  .unwrap_or("360".to_string()) // 6 hours in minutes
-  .parse()
-  .unwrap();
-pub static ref ALLOW_ADVANCED: bool = std::env::var("ALLOW_ADVANCED")
-  .unwrap_or("true".to_string())
-  .parse()
-  .unwrap();
-pub static ref ID_LENGTH: u32 = std::env::var("ID_LENGTH")
-  .unwrap_or("32".to_string())
-  .parse()
-  .unwrap();
-pub static ref CACHE_PREFIX: String = std::env::var("CACHE_PREFIX")
-  .unwrap_or("".to_string())
-  .parse()
-  .unwrap();
-pub static ref ALLOW_FILES: bool = std::env::var("ALLOW_FILES")
-  .unwrap_or("true".to_string())
-  .parse()
-  .unwrap();
-pub static ref IMPRINT_URL: String = std::env::var("IMPRINT_URL")
-  .unwrap_or("".to_string())
-  .parse()
-  .unwrap();
-pub static ref IMPRINT_HTML: String = std::env::var("IMPRINT_HTML")
-  .unwrap_or("".to_string())
-  .parse()
-  .unwrap();
-pub static ref EXTRA_SIZE_LIMIT: usize = std::env::var("EXTRA_SIZE_LIMIT")
-  .unwrap_or("512".to_string())
-  .parse()
-  .unwrap();
-}
-
-// THEME
-lazy_static! {
-    pub static ref THEME_IMAGE: String = std::env::var("THEME_IMAGE")
-        .unwrap_or("".to_string())
-        .parse()
-        .unwrap();
-    pub static ref THEME_TEXT: String = std::env::var("THEME_TEXT")
-        .unwrap_or("".to_string())
-        .parse()
-        .unwrap();
-    pub static ref THEME_PAGE_TITLE: String = std::env::var("THEME_PAGE_TITLE")
-        .unwrap_or("".to_string())
-        .parse()
-        .unwrap();
-    pub static ref THEME_FAVICON: String = std::env::var("THEME_FAVICON")
-        .unwrap_or("".to_string())
-        .parse()
-        .unwrap();
-    pub static ref THEME_NEW_NOTE_NOTICE: bool = std::env::var("THEME_NEW_NOTE_NOTICE")
-        .unwrap_or("true".to_string())
-        .parse()
-        .unwrap();
-    pub static ref THEME_HOME_LINK: bool = std::env::var("THEME_HOME_LINK")
-        .unwrap_or("true".to_string())
-        .parse()
-        .unwrap();
-}

packages/backend/src/health/mod.rs

@@ -1,10 +0,0 @@
-use crate::store;
-use axum::http::StatusCode;
-
-pub async fn report_health() -> (StatusCode,) {
-    if store::can_reach_cache() {
-        return (StatusCode::OK,);
-    } else {
-        return (StatusCode::SERVICE_UNAVAILABLE,);
-    }
-}

packages/backend/src/main.rs

@@ -1,69 +0,0 @@
-use axum::{
-    Router, ServiceExt,
-    extract::{DefaultBodyLimit, Request},
-    routing::{delete, get, post},
-};
-use dotenv::dotenv;
-use tower::Layer;
-use tower_http::{
-    compression::CompressionLayer,
-    normalize_path::NormalizePathLayer,
-    services::{ServeDir, ServeFile},
-};
-
-#[macro_use]
-extern crate lazy_static;
-
-mod config;
-mod health;
-mod note;
-mod status;
-mod store;
-
-#[tokio::main]
-async fn main() {
-    dotenv().ok();
-
-    if !store::can_reach_cache() {
-        println!("cannot reach cache");
-        panic!("cannot reach cache");
-    }
-
-    let notes_routes = Router::new()
-        .route("/", post(note::create))
-        .route("/{id}", delete(note::view))
-        .route("/{id}", get(note::preview));
-    let health_routes = Router::new().route("/healthz", get(health::report_health));
-    let status_routes = Router::new().route("/status", get(status::get_status));
-    let v3_routes = Router::new()
-        .nest("/notes", notes_routes)
-        .merge(status_routes);
-
-    let api_routes = Router::new().nest("/v3", v3_routes);
-
-    let index = format!("{}{}", config::FRONTEND_PATH.to_string(), "/index.html");
-    let serve_dir =
-        ServeDir::new(config::FRONTEND_PATH.to_string()).not_found_service(ServeFile::new(index));
-    let app = Router::new()
-        .nest("/api", api_routes)
-        .merge(health_routes)
-        .fallback_service(serve_dir)
-        .layer(DefaultBodyLimit::max(*config::LIMIT))
-        .layer(
-            CompressionLayer::new()
-                .br(true)
-                .deflate(true)
-                .gzip(true)
-                .zstd(true),
-        );
-
-    let app = NormalizePathLayer::trim_trailing_slash().layer(app);
-
-    let listener = tokio::net::TcpListener::bind(config::LISTEN_ADDR.to_string())
-        .await
-        .unwrap();
-    println!("listening on {}", listener.local_addr().unwrap());
-    axum::serve(listener, ServiceExt::<Request>::into_make_service(app))
-        .await
-        .unwrap();
-}

packages/backend/src/note/model.rs

@@ -1,49 +0,0 @@
-use bs62;
-use ring::rand::SecureRandom;
-use serde::{Deserialize, Serialize};
-
-use crate::config;
-
-#[derive(Serialize, Deserialize, Clone)]
-pub struct NoteMeta {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub views: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub expiration: Option<u32>,
-    #[serde(default)]
-    pub extra: Vec<u8>,
-}
-
-#[derive(Serialize, Deserialize, Clone)]
-pub struct CreateRequest {
-    pub meta: NoteMeta,
-    pub data: Vec<u8>,
-}
-
-#[derive(Serialize, Deserialize)]
-pub struct CreateResponse {
-    pub id: String,
-}
-
-#[derive(Serialize, Deserialize)]
-pub struct MetaResponse {
-    pub meta: NoteMeta,
-}
-
-#[derive(Serialize, Deserialize)]
-pub struct NoteResponse {
-    pub meta: NoteMeta,
-    pub data: Vec<u8>,
-}
-
-pub fn generate_id() -> String {
-    let mut result = "".to_owned();
-    let mut id: [u8; 1] = [0; 1];
-    let sr = ring::rand::SystemRandom::new();
-
-    for _ in 0..*config::ID_LENGTH {
-        let _ = sr.fill(&mut id);
-        result.push_str(&bs62::encode_data(&id));
-    }
-    result
-}