diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 15 | ||||
| -rw-r--r-- | docs/MESHBAY_NODE_PROTOCOL.md | 6 |
2 files changed, 14 insertions, 7 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 03ae77e..dcfc77b 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1326,9 +1326,15 @@ Five protections, and they are the substance: and `stat()` is itself case-insensitive on NTFS and exFAT, so this already holds there; - **strict chunk ordering**; -- a **size cap** — 4 GB per file. There is deliberately no aggregate quota yet, and - that gap is named in §15.3 rather than left to be discovered: a member can still - fill the operator's disk one capped file at a time; +- a **size cap** — 8 GB per file by default, and **the operator's to set** + (`max_upload_gb` in node.toml, on the Node page, or `meshbay-node transfers + max-size`), because the disk that fills is theirs and a Pi and a film server + are not the same machine. It is read from the transport context on every + chunk, so a change applies to an upload already running. A file past the + ceiling is refused at the chunk that crosses it and its `.part` is deleted. + There is deliberately no aggregate quota yet, and that gap is named in §15.3 + rather than left to be discovered: a member can still fill the operator's + disk one capped file at a time; - the target root must be **writable and available**, enforced by the node. **There is no quarantine subdirectory.** A folder appearing beside the operator's @@ -3062,7 +3068,8 @@ process runs it — `systemctl --user` on Linux, Task Scheduler on Windows. | **C4** for browser-using accounts | Open until the signed bundle opt-out ships (O3) | | **T3** for browser users | **Accepted permanently.** Removed for native clients, and that removal's value depends on reproducible builds | | **Hub identity pinning** (O13) | Nothing pins the hub's key. Bounded, because a substituted hub can neither read content nor ship code to a native client | -| **Aggregate upload quota** | Per-file caps exist; a per-user or per-group total does not | +| **Aggregate upload quota** | Per-file caps exist and the operator sets theirs (§6.4); a per-user or per-group total does not | +| **`max_concurrent_downloads` / `max_concurrent_uploads` are lost at startup** | The daemon builds the `defaults` dict it hands `roster.node_settings` without those two keys, so a node that has never had them set from the panel resolves both to `None`, assigns that back onto the config, and builds the transport with it — the pools then come up at `transfers.py`'s defaults and **what node.toml says about them is read and ignored**. The Node page and the CLI still work, because writing the setting is what creates the roster row the startup path then finds. Found while adding the per-file ceiling beside them, which is in that dict | | **A signed upload transcript** | Ownership is recorded by the node and verifiable by nobody else (§5.4). Making it provable is a transcript the uploader signs, stored with the entry — designed in outline, not built | | Forward secrecy in group chat | **Given up deliberately and on the record** (§4.5). If it becomes a requirement it belongs in 1:1 DM | | Metadata at the hub | Membership, and who posted in which group and when. A known leak, not a solved problem (§7.1) | diff --git a/docs/MESHBAY_NODE_PROTOCOL.md b/docs/MESHBAY_NODE_PROTOCOL.md index 51feacd..b2508c1 100644 --- a/docs/MESHBAY_NODE_PROTOCOL.md +++ b/docs/MESHBAY_NODE_PROTOCOL.md @@ -106,7 +106,7 @@ Identical on every transport: | File chunk (plaintext) | 1 MiB | `CHUNK_SIZE` | | Video segment (plaintext, before encryption) | 256 KiB | `STREAM_SEGMENT_SIZE` | | Upload chunk sent by the browser | 48 KiB | fits the aiortc SCTP limit after msgpack overhead | -| Upload total per file | 4 GiB | `MAX_UPLOAD_BYTES` | +| Upload total per file | 8 GiB, operator-settable | `MAX_UPLOAD_BYTES`, `max_upload_gb` | | Files one session may read at once **without a transfer lease** | 12 | `MAX_LEASELESS_IN_FLIGHT` (§11.2) | The two-tier frame limit is not tidiness. A flat 64 MiB budget applied before @@ -1483,7 +1483,7 @@ ct = AES-256-GCM(chunk_key).encrypt(nonce, plaintext) no AAD | | root writable and available | | destination resolves in-group | | chunk_index == next expected - | | running total <= 4 GiB + | | running total <= max_upload_gb | | append to <stored_name>.part |<- file_upload_ack {v, upload_id, chunk_index, | | nonce, ct} ------------------------------------| @@ -2227,7 +2227,7 @@ LP(x) = uint32be(len(x)) || x every field, no exceptions | `PRE_HANDSHAKE_MAX_MSG` / `MAX_MSG` | 64 KiB / 64 MiB | `webrtc_server.py` | | `CHUNK_SIZE` | 1 MiB | ” | | `DOWNLOAD_BUFFER_HIGH` | 2 MiB | ” | -| `MAX_UPLOAD_BYTES` | 4 GiB | ” | +| `MAX_UPLOAD_BYTES` | 8 GiB, default only — `max_upload_gb` overrides it per node | ” | | Download pipeline / chunk retry (client) | 8 in flight; 6 attempts, 1.5 s apart | `file-utils.js` | | Upload chunk / window / send-buffer high water (client) | 48 KiB / 32 / 1 MiB | `transport.js` | | `UPLOAD_ID_LEN` | 16 bytes, hex on the wire | `protocol.py` | |