J3vb/OwnCord
1
0
Fork 0
mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat: TOFU cert pinning, settings cache refactor, ban enforcement, and 80%+ test coverage

Browse Source 
- Implement TOFU certificate pinning in Rust WS proxy with accept_cert_fingerprint command
- Refactor settings cache from package-level globals to Hub methods (eliminates global state)
- Add runtime ban check on WS message handling (kicks banned users mid-session)
- Sanitize reaction error messages to prevent IDOR information leaks
- Add slog error logging to REST handlers (channel, invite, search)
- Handle channel_delete for active channel in client dispatcher
- Add certMismatchBlock to prevent auto-reconnect on TOFU mismatch
- Consolidate root-level spec docs into docs/brain/06-Specs/ vault
- Add 80%+ test coverage for ws (80.9%) and admin (81.7%) packages
- Delete completed TODOS.md (all items resolved)
This commit is contained in:
jevb
2026-03-17 11:05:52 +01:00
parent ce4326766a
commit 4d1a1676c7
40 changed files with 5392 additions and 1915 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/port-forwarding.md
-30
View File
@@ -1,30 +0,0 @@
# Port Forwarding Guide
## Why
Friends outside your LAN need a way to reach your server. Port forwarding tells your router to send incoming traffic on a specific port to your server machine.
## Steps
1. **Find your router's admin page** — usually `192.168.1.1` or `192.168.0.1`. Check your gateway IP with `ipconfig` (Windows) or `ip route` (Linux).
2. **Find the port forwarding section** — may be listed under "NAT", "Virtual Servers", or "Firewall" depending on your router.
3. **Add a rule for the server:**
- External port: `8443`
- Internal IP: your server machine's local IP
- Internal port: `8443`
- Protocol: TCP
4. **Add a rule for voice chat** (if using voice/video):
- External port: `3478`
- Internal IP: your server machine's local IP
- Internal port: `3478`
- Protocol: UDP
5. **Find your public IP** at a site like `whatismyip.com`.
6. **Share your public IP and port** with friends: `your.public.ip:8443`
## Troubleshooting
Windows Firewall may block incoming connections. `chatserver.exe` should prompt on first run to allow access. If not, manually add a firewall rule for port 8443 (TCP) and 3478 (UDP).
## Dynamic IP
If your public IP changes frequently, consider a Dynamic DNS service (e.g., No-IP, DuckDNS) so friends can use a stable hostname instead of a raw IP address.
docs/quick-start.md
-36
View File
@@ -1,36 +0,0 @@
# Quick Start Guide
## Step 1: Download
Get the latest release from GitHub Releases.
Download `chatserver.exe` and the `OwnCord`
installer.
## Step 2: Run the Server
Run `chatserver.exe`. On first run it generates
`config.yaml` and a self-signed TLS certificate.
The server starts on `https://0.0.0.0:8443`.
## Step 3: Admin Setup
Open `https://localhost:8443/admin` in a browser.
The first registered user with the Owner role can
manage the server.
## Step 4: Create Invites
In the admin panel, go to invite management and
generate invite codes for your friends.
## Step 5: Connect Clients
Friends install OwnCord, enter your server address
(IP or domain + port 8443), and redeem their invite
code to register.
## Networking
If friends are outside your local network, see the
[Port Forwarding Guide](port-forwarding.md) or use
[Tailscale](tailscale.md) for zero-config networking.
docs/tailscale.md
-21
View File
@@ -1,21 +0,0 @@
# Tailscale Guide (Zero-Config Alternative)
## What is Tailscale
Tailscale is a mesh VPN that creates encrypted tunnels between your devices using WireGuard. No port forwarding, no dynamic DNS, and it works behind CGNAT. Free for personal use.
## Setup
1. **Install Tailscale** on the server machine and each client machine: https://tailscale.com/download
2. **Sign in** with the same Tailscale account (or share the machine using Tailscale's sharing feature)
3. **Find the server's Tailscale IP** — shown in the Tailscale app, typically `100.x.y.z`
4. **Disable TLS in config** — set `tls.mode` to `"off"` in `config.yaml` since Tailscale already encrypts all traffic with WireGuard
5. **Connect clients** using the Tailscale IP: `100.x.y.z:8443`
## Benefits
- No port forwarding needed
- Works behind CGNAT and strict firewalls
- Encrypted by default (WireGuard)
- Stable IPs that don't change
- Easy to add/remove friends via the Tailscale admin console