Added a more user friendly legalese pages

Added avatars to make it a bit more friendly
Added panic mode protections to make the server more secure
2025-08-22 20:14:45 -04:00 · 2025-08-22 19:35:00 -04:00 · 2025-08-22 18:54:10 -04:00 · 2025-08-22 18:24:24 -04:00 · 2025-08-22 12:42:22 -04:00 · 2025-08-22 12:40:09 -04:00
23 changed files with 2368 additions and 1064 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,4 @@ data/
 # Env/config overrides
 shard.yaml
 .env
 testdata/*
--- a/2
+++ b/2
@@ -31,7 +31,7 @@ FROM gcr.io/distroless/base-debian12:nonroot
 WORKDIR /app
 COPY --from=build /out/greencoast-shard /app/greencoast-shard
 COPY configs/shard.sample.yaml /app/shard.yaml
-COPY client /app/client
+COPY client/ /opt/greencoast/client/
 VOLUME ["/var/lib/greencoast"]
 EXPOSE 8080 8081 8443 9443
 USER nonroot:nonroot
--- a/README.md
+++ b/README.md
@@ -1,24 +1,224 @@
-# GreenCoast — Privacy-First, Shardable Social (Dockerized)
+# GreenCoast
-**Goal:** A BlueSky-like experience with **shards**, **zero-trust**, **no data collection**, **E2EE**, and easy self-hosting — from x86_64 down to **Raspberry Pi Zero**.  
+A privacy-first, shardable social backend + minimalist client. **Zero PII**, **zero passwords**, optional **E2EE per post**, and **public-key accounts**. Includes **DPoP-style proof-of-possession**, **Discord SSO with PKCE**, and a tiny static client.
 License: **The Unlicense** (public-domain equivalent).
 This repo contains a minimal, working **shard**: an append-only object API with zero-data-collection defaults. It’s structured to evolve into full federation, E2EE, and client apps, while keeping Pi Zero as a supported host.
 ---
-## Quick Start (Laptop / Dev)
+## Features
-**Requirements:** Docker + Compose v2
+- **Zero-trust by design**: server stores no emails or passwords.
 - **Accounts = public keys** (Ed25519 or P-256). No usernames required.
 - **Proof-of-possession (PoP)** on every authenticated API call.
 - **Short-lived tokens** (HMAC “gc2”) bound to device keys.
 - **Shardable storage** (mTLS or signed shard requests).
 - **No fingerprinting**: no IP/UA logs; coarse timestamps optional.
 - **Static client** with strong CSP; optional E2EE per post.
 - **Discord SSO (PKCE)** as an *optional* convenience.
 - **Filesystem storage** supports both **flat** and **nested** object layouts.
 ---
 ## Architecture (brief)
 - **Shard**: stateless API + local FS object store + in-memory index.
 - **Client**: static files (HTML/JS/CSS) served by the shard or any static host.
 - **Identity**: device key (P-256/Ed25519) or passkey; server mints short-lived **gc2** tokens bound to the device key (`cnf` claim).
 - **Privacy**: objects can be plaintext (public) or client-encrypted (private).
 ---
 ## Security posture
 - **Zero-trust**: no passwords/emails; optional SSO is *linking*, not source-of-truth.
 - **DPoP-style PoP** on requests:
  - Client sends:
    - `Authorization: Bearer gc2.…`
    - `X-GC-Key: p256:<base64-raw>` (or `ed25519:…`)
    - `X-GC-TS: <unix seconds>`
    - `X-GC-Proof: sig( METHOD "\n" URL "\n" TS "\n" SHA256(body) )`
  - Server verifies `gc2` signature, key binding (`cnf`), timestamp window, and replay cache.
 - **Replay protection**: 10-minute proof cache.
 - **No fingerprinting/logging**: no IPs, no UAs.
 - **Strict CSP** for client: blocks XSS/token theft.
 - **Limits**: request body limits (default 10 MiB), simple per-account rate limiting.
 - **Shard↔shard**: mTLS or per-shard signatures with timestamp + replay cache.
 ---
 ## Requirements
 - Go 1.21+  
 - Docker (optional)  
 - A signing key for tokens: `GC_SIGNING_SECRET_HEX` (32+ bytes hex)  
 - (Optional) Discord OAuth app (Client ID/Secret + redirect URI)  
 - (Optional) Cloudflare Tunnel or other TLS reverse proxy
 ---
 ## Environment variables
    GC_HTTP_ADDR=:9080
    GC_HTTPS_ADDR=                    # optional
    GC_TLS_CERT=                      # optional
    GC_TLS_KEY=                       # optional
    GC_STATIC_ADDR=:9082
    GC_STATIC_DIR=/opt/greencoast/client
    GC_DATA_DIR=/var/lib/greencoast
    GC_ZERO_TRUST=true
    GC_COARSE_TS=false
    GC_SIGNING_SECRET_HEX=<64+ hex chars>    # required for gc2 tokens
    GC_REQUIRE_POP=true                      # default true; set false for first-run
    # Dev convenience (testing only; disable for production)
    GC_DEV_ALLOW_UNAUTH=false
    GC_DEV_BEARER=
    # Discord SSO (optional)
    GC_DISCORD_CLIENT_ID=
    GC_DISCORD_CLIENT_SECRET=
    GC_DISCORD_REDIRECT_URI=https://greencoast.example.com/auth-callback.html
 ---
 ## Quickstart (Docker)
 Minimal compose for local testing (PoP disabled + dev unauth allowed for first run):
    services:
      shard-test:
        build: .
        environment:
          - GC_HTTP_ADDR=:9080
          - GC_STATIC_ADDR=:9082
          - GC_STATIC_DIR=/opt/greencoast/client
          - GC_DATA_DIR=/var/lib/greencoast
          - GC_ZERO_TRUST=true
          - GC_SIGNING_SECRET_HEX=7f6e1a0f2b4d7e3a...   # replace with your secret
          - GC_REQUIRE_POP=false                      # easier first-run
          - GC_DEV_ALLOW_UNAUTH=true
        volumes:
          - ./testdata:/var/lib/greencoast
          - ./client:/opt/greencoast/client:ro
        ports:
          - "9080:9080"
          - "9082:9082"
 Open `http://localhost:9082` → set the Shard URL (`http://localhost:9080`) → publish a test post.
 When ready, **turn PoP on** by removing `GC_REQUIRE_POP=false` and disabling `GC_DEV_ALLOW_UNAUTH`.
 ---
 ## Cloudflare Tunnel example
    ingress:
      - hostname: greencoast.example.com
        service: http://shard-test:9082
      - hostname: api-gc.greencoast.example.com
        service: http://shard-test:9080
      - service: http_status:404
 Use “Full (strict)” TLS and ensure your cert covers both hosts.
 ---
 ## Client usage
 - **Shard URL**: set it in the top “Connect” section (or use `?api=` query or `<meta name="gc-api-base">`).
 - **Device key sign-in (no OAuth)**:
  1) Client generates/stores a P-256 device key in the browser.
  2) Client calls `/v1/auth/key/challenge` then `/v1/auth/key/verify` to obtain a **gc2** token bound to that key.
 - **Discord SSO (optional)**:
  - Requires `GC_DISCORD_CLIENT_*` env vars and a valid `GC_DISCORD_REDIRECT_URI`.
  - Uses PKCE (`S256`) and binds the minted **gc2** token to the device key presented at `/start`.
 ---
 ## API (overview)
 - `GET  /healthz` – liveness
 - `PUT  /v1/object` – upload blob (headers: optional `X-GC-Private: 1`, `X-GC-TZ`)
 - `GET  /v1/object/{hash}` – download blob
 - `DELETE /v1/object/{hash}` – delete blob
 - `GET  /v1/index` – list indexed entries (latest first)
 - `GET  /v1/index/stream` – SSE updates
 - `POST /v1/admin/reindex` – rebuild index from disk
 - **Auth**
  - `POST /v1/auth/key/challenge` → `{nonce, exp}`
  - `POST /v1/auth/key/verify` `{nonce, alg, pub, sig}` → `{bearer, sub, exp}`
  - `POST /v1/auth/discord/start` (requires `X-GC-3P-Assent: 1` and `X-GC-Key`)
  - `GET  /v1/auth/discord/callback` → redirects with `#bearer=…`
 - **GDPR**
  - `GET  /v1/gdpr/policy` – current data-handling posture
 > When `GC_REQUIRE_POP=true`, all authenticated endpoints require PoP headers.
 ### PoP header format (pseudocode)
    Authorization: Bearer gc2.<claims>.<sig>
    X-GC-Key: p256:<base64-raw>          # or ed25519:<base64-raw>
    X-GC-TS: <unix seconds>
    X-GC-Proof: base64(
        Sign_device_key(
          UPPER(METHOD) + "\n" + URL + "\n" + X-GC-TS + "\n" + SHA256(body)
        )
    )
 ---
 ## Storage layout & migration
 - **Writes** are flat: `objects/<hash>`
 - **Reads** (and reindex) also support:
  - `objects/<hash>/blob|data|content`
  - `objects/<hash>/<single file>`
  - `objects/<prefix>/<hash>` (two-level prefix)
 - To **restore** data into a fresh container:
  1) Mount your objects at `/var/lib/greencoast/objects`
  2) Call `POST /v1/admin/reindex` (with auth+PoP or enable dev unauth briefly)
 ---
 ## Reindex examples
 Unauth (dev only):
    curl -X POST https://api-gc.yourdomain/v1/admin/reindex
 With bearer + PoP (placeholders):
    curl -X POST https://api-gc.yourdomain/v1/admin/reindex ^
      -H "Authorization: Bearer <gc2_token>" ^
      -H "X-GC-Key: p256:<base64raw>" ^
      -H "X-GC-TS: <unix>" ^
      -H "X-GC-Proof: <base64sig>"
 ---
 ## Hardening checklist (prod)
 - Set `GC_REQUIRE_POP=true`, remove dev bypass.
 - Keep access token TTL ≤ 8h; rotate signing key periodically.
 - Static client served with strong CSP (already enabled).
 - Containers run non-root, read-only FS, `no-new-privileges`, `cap_drop: ["ALL"]`.
 - Edge WAF/rate limits; 10 MiB default request cap (tunable).
 - Commit `go.sum`; run `go mod verify` in CI.
 ---
 ## GDPR
 - Server stores **no PII** (no emails, no IP/UA logs).
 - Timestamps are UTC (or coarse UTC if enabled).
 - `/v1/gdpr/policy` exposes current posture.
 - Roadmap: `/v1/gdpr/export` and `/v1/gdpr/delete` to enumerate/remove blobs signed by a given key.
 ---
 ## License
 This project is licensed under **The Unlicense**. See `LICENSE` for details.
 ```bash
 git clone <your repo> greencoast
 cd greencoast
 cp .env.example .env
 docker compose -f docker-compose.dev.yml up --build
 # Health:
 curl -s http://localhost:8080/healthz
 # Put an object (dev mode allows unauthenticated PUT/GET):
 curl -s -X PUT --data-binary @README.md http://localhost:8080/v1/object
 # -> {"ok":true,"hash":"<sha256>",...}
 curl -s http://localhost:8080/v1/object/<sha256> | head
--- a/client/app.js
+++ b/client/app.js
@@ -1,111 +1,202 @@
 import { encryptString, decryptToString, toBlob } from "./crypto.js";
-const els = {
+const els = {};
-  shardUrl: document.getElementById("shardUrl"),
+function $(id){ return document.getElementById(id); }
-  bearer: document.getElementById("bearer"),
+
-  passphrase: document.getElementById("passphrase"),
+// ---- Trusted Types policy & safe HTML setter ----
-  saveConn: document.getElementById("saveConn"),
+const ttPolicy = (() => {
-  health: document.getElementById("health"),
+  try {
-  visibility: document.getElementById("visibility"),
+    if (window.trustedTypes) {
-  title: document.getElementById("title"),
+      // Allow only our sanitized HTML chunks (legal pages). Strip scripts & inline handlers.
-  body: document.getElementById("body"),
+      return window.trustedTypes.createPolicy("gc", {
-  publish: document.getElementById("publish"),
+        createHTML: (s) =>
-  publishStatus: document.getElementById("publishStatus"),
+          s
-  posts: document.getElementById("posts"),
+            .replace(/<script[\s\S]*?<\/script>/gi, "")
-  discordStart: document.getElementById("discordStart"),
+            .replace(/\son\w+=/gi, "") // remove inline event handlers
      });
    }
  } catch {}
  return null;
 })();
 function setHTML(el, html) {
  if (!el) return;
  if (ttPolicy) {
    el.innerHTML = ttPolicy.createHTML(html);
  } else {
    // Very defensive fallback if TT creation is blocked: render as plain text.
    el.textContent = html.replace(/<[^>]*>/g, "");
  }
 }
 // ---- Hash routes map (SPA) ----
 const routes = {
  "/": "feed",
  "/privacy": "privacy.html",
  "/gdpr": "gdpr.html",
  "/terms": "terms.html"
 };
-const LS_KEY = "gc_client_config_v1";
+window.addEventListener("DOMContentLoaded", () => {
-const POSTS_KEY = "gc_posts_index_v1";
+  Object.assign(els, {
    shardUrl: $("shardUrl"), bearer: $("bearer"), passphrase: $("passphrase"),
    saveConn: $("saveConn"), health: $("health"), visibility: $("visibility"),
    title: $("title"), body: $("body"), publish: $("publish"), publishStatus: $("publishStatus"),
    posts: $("posts"), discordStart: $("discordStart"), signIn: $("signIn"), panic: $("panic"),
    avatar: $("avatar"), fp: $("fp"), flash: $("flash"), banner: $("banner"),
    feed: $("feed"), page: $("page"), pageContent: $("pageContent"),
  });
-const cfg = loadConfig(); applyConfig(); checkHealth(); syncIndex(); sse();
+  // Buttons
  on(els.saveConn, "click", onSaveConn);
  on(els.publish, "click", publish);
  on(els.discordStart, "click", discordStart);
  on(els.signIn, "click", deviceKeySignIn);
  on(els.panic, "click", panicWipe);
-els.saveConn.onclick = async () => {
+  // Route navigation (hash-based)
-  const c = { url: norm(els.shardUrl.value), bearer: els.bearer.value.trim(), passphrase: els.passphrase.value };
+  document.querySelectorAll('a[data-route]').forEach(a=>{
-  saveConfig(c); await checkHealth(); await syncIndex(); sse(true);
+    a.addEventListener('click', (e)=>{
-};
+      if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return; // allow new tab etc.
      // hash change will trigger render
    });
  });
  window.addEventListener('hashchange', ()=>renderRoute(currentPath()));
-els.publish.onclick = publish;
+  applyConfig();
-els.discordStart.onclick = discordStart;
+  updateLimitedModeUI();
  init();
  renderRoute(currentPath());
  flash("GC client loaded");
 });
 // ---------- init ----------
 async function init(){
  await checkHealth(); await syncIndex(); sse(); await renderAvatar();
 }
 // ---------- helpers ----------
 function on(el, ev, fn){ if (el) el.addEventListener(ev, fn, false); }
 function flash(msg, ms=1800){ if(!els.flash) return; els.flash.textContent=msg; els.flash.style.display="block"; setTimeout(()=>els.flash.style.display="none", ms); }
 function norm(u){ return (u||"").replace(/\/+$/,""); }
 function currentPath(){
  const h = location.hash || "#/";
  const p = h.replace(/^#/, "");
  return p || "/";
 }
 function defaultApiBase() {
  try { const qs = new URLSearchParams(window.location.search); const qApi = qs.get("api"); if (qApi) return qApi.replace(/\/+$/,""); } catch {}
  const m = document.querySelector('meta[name="gc-api-base"]'); if (m && m.content) return m.content.replace(/\/+$/,"");
  try {
    const u = new URL(window.location.href); const proto = u.protocol; const host = u.hostname; const portStr = u.port; const bracketHost = host.includes(":") ? `[${host}]` : host;
    const port = portStr ? parseInt(portStr,10) : null; let apiPort = port;
    if (port === 8082) apiPort = 8080; else if (port === 9082) apiPort = 9080; else if (port) apiPort = Math.max(1, port-2);
    return apiPort ? `${proto}//${bracketHost}:${apiPort}` : `${proto}//${bracketHost}`;
  } catch { return window.location.origin.replace(/\/+$/,""); }
 }
 const LS_KEY = "gc_client_config_v6";
 const POSTS_KEY = "gc_posts_index_v6";
 const KEY_PKCS8 = "gc_key_pkcs8";
 const KEY_PUB_RAW = "gc_key_pub_raw";
 function loadConfig(){ try { return JSON.parse(localStorage.getItem(LS_KEY)) ?? {}; } catch { return {}; } }
-function saveConfig(c){ localStorage.setItem(LS_KEY, JSON.stringify(c)); Object.assign(cfg, c); }
+const cfg = loadConfig();
 function getPosts(){ try { return JSON.parse(localStorage.getItem(POSTS_KEY)) ?? []; } catch { return []; } }
 function setPosts(v){ localStorage.setItem(POSTS_KEY, JSON.stringify(v)); renderPosts(); }
 function norm(u){ return (u||"").replace(/\/+$/,""); }
 function applyConfig(){ els.shardUrl.value = cfg.url ?? location.origin; els.bearer.value = cfg.bearer ?? ""; els.passphrase.value = cfg.passphrase ?? ""; }
 function saveConfig(c){ localStorage.setItem(LS_KEY, JSON.stringify(Object.assign(cfg,c))); }
 function applyConfig(){
  if (!els.shardUrl) return;
  els.shardUrl.value = cfg.url ?? defaultApiBase();
  els.bearer.value = cfg.bearer ?? "";
  els.passphrase.value = cfg.passphrase ?? "";
 }
 function isAuthorized(){ return !!cfg.bearer; }
 function setActiveTab(path){
  const cur = path in routes ? path : "/";
  document.querySelectorAll(".tabs a").forEach(a=>{
    const href = new URL(a.href, location.origin).hash.replace(/^#/, "") || "/";
    a.classList.toggle("active", href===cur);
  });
 }
 function updateLimitedModeUI(){
  const limited = !isAuthorized();
  if (els.banner) els.banner.hidden = !limited;
  if (els.visibility){
    const priv = [...els.visibility.options].find(o => o.value === "private");
    if (priv) { priv.disabled = limited; if (limited && els.visibility.value === "private") els.visibility.value = "public"; }
  }
 }
 // ---------- router (hash-based) ----------
 async function renderRoute(path){
  setActiveTab(path);
  const target = routes[path] ?? "feed";
  if (target === "feed"){
    els.page.hidden = true;
    els.feed.hidden = false;
    return;
  }
  // Load static page into #pageContent (Trusted Types aware)
  els.feed.hidden = true;
  els.page.hidden = false;
  setHTML(els.pageContent, "Loading…");
  try{
    const res = await fetch("./"+target, { cache:"no-store" });
    const html = await res.text();
    const m = html.match(/<body[^>]*>([\s\S]*?)<\/body>/i);
    setHTML(els.pageContent, m ? m[1] : html);
  }catch{
    setHTML(els.pageContent, `<p class="muted">Failed to load page.</p>`);
  }
 }
 // ---------- health / posts / SSE ----------
 async function checkHealth(){
-  if (!cfg.url) return; els.health.textContent = "Checking…";
+  const base = cfg.url || defaultApiBase();
-  try { const r = await fetch(cfg.url + "/healthz"); els.health.textContent = r.ok ? "Connected ✔" : `Error: ${r.status}`; }
+  if (!base) { if (els.health) els.health.textContent="Set URL"; return; }
  els.health.textContent="Checking…";
  try { const r = await fetch(base + "/healthz"); els.health.textContent = r.ok ? "Connected ✔" : `Error: ${r.status}`; }
  catch { els.health.textContent = "Not reachable"; }
 }
-
+function getPosts(){ try { return JSON.parse(localStorage.getItem(POSTS_KEY)) ?? []; } catch { return []; } }
-async function publish() {
+function setPosts(v){ localStorage.setItem(POSTS_KEY, JSON.stringify(v)); renderPosts(); }
  if (!cfg.url) return msg("Set shard URL first.", true);
  const title = els.title.value.trim(); const body = els.body.value; const vis = els.visibility.value;
  try {
    let blob, enc=false;
    if (vis === "private") {
      if (!cfg.passphrase) return msg("Set a passphrase for private posts.", true);
      const payload = await encryptString(JSON.stringify({ title, body }), cfg.passphrase);
      blob = toBlob(payload); enc=true;
    } else { blob = toBlob(JSON.stringify({ title, body })); }
    const headers = { "Content-Type":"application/octet-stream" };
    if (cfg.bearer) headers["Authorization"] = "Bearer " + cfg.bearer;
    if (enc) headers["X-GC-Private"] = "1";
    const r = await fetch(cfg.url + "/v1/object", { method:"PUT", headers, body: blob });
    if (!r.ok) throw new Error(await r.text());
    const j = await r.json();
    const posts = getPosts();
    posts.unshift({ hash:j.hash, title: title || "(untitled)", bytes:j.bytes, ts:j.stored_at, enc });
    setPosts(posts);
    els.body.value = ""; msg(`Published ${enc?"private":"public"} post. Hash: ${j.hash}`);
  } catch(e){ msg("Publish failed: " + (e?.message||e), true); }
 }
 function msg(t, err=false){ els.publishStatus.textContent=t; els.publishStatus.style.color = err ? "#ff6b6b" : "#8b949e"; }
 async function syncIndex(){
-  if (!cfg.url) return;
+  const base = cfg.url || defaultApiBase();
  if (!base) return;
  try{
-    const headers = {}; if (cfg.bearer) headers["Authorization"] = "Bearer " + cfg.bearer;
+    const r = await fetch(base + "/v1/index");
    const r = await fetch(cfg.url + "/v1/index", { headers });
    if (!r.ok) throw new Error("index fetch failed");
    const entries = await r.json();
-    setPosts(entries.map(e => ({ hash:e.hash, title:"(title unknown — fetch)", bytes:e.bytes, ts:e.stored_at, enc:e.private })));
+    setPosts(entries.map(e=>({hash:e.hash, title:"(title unknown — fetch)", bytes:e.bytes, ts:e.stored_at, enc:e.private, author:e.author||null, tz:e.creator_tz||null})));
  }catch(e){ console.warn("index sync failed", e); }
 }
 let sseCtrl;
-function sse(){
+function sse(reset=false){
-  if (!cfg.url) return;
+  const base = cfg.url || defaultApiBase();
-  if (sseCtrl) { sseCtrl.abort(); sseCtrl = undefined; }
+  if (!base) return;
  if (sseCtrl){ sseCtrl.abort(); sseCtrl=undefined; if(!reset) return; }
  sseCtrl = new AbortController();
-  const url = cfg.url + "/v1/index/stream";
+  fetch(base + "/v1/index/stream", { signal:sseCtrl.signal }).then(async resp=>{
  const headers = {}; if (cfg.bearer) headers["Authorization"] = "Bearer " + cfg.bearer;
  fetch(url, { headers, signal: sseCtrl.signal }).then(async resp => {
    if (!resp.ok) return;
-    const reader = resp.body.getReader(); const decoder = new TextDecoder();
+    const reader = resp.body.getReader(); const dec = new TextDecoder(); let buf="";
-    let buf = "";
+    while(true){ const {value,done}=await reader.read(); if(done) break;
-    while (true) {
+      buf += dec.decode(value,{stream:true});
-      const { value, done } = await reader.read(); if (done) break;
+      let i; while((i=buf.indexOf("\n\n"))>=0){
-      buf += decoder.decode(value, { stream:true });
+        const chunk=buf.slice(0,i); buf=buf.slice(i+2);
      let idx;
      while ((idx = buf.indexOf("\n\n")) >= 0) {
        const chunk = buf.slice(0, idx); buf = buf.slice(idx+2);
        if (chunk.startsWith("data: ")){
          try{
            const ev = JSON.parse(chunk.slice(6));
            if (ev.event==="put"){
-              const e = ev.data;
+              const e=ev.data; const posts=getPosts();
              const posts = getPosts();
              if (!posts.find(p=>p.hash===e.hash)){
-                posts.unshift({ hash:e.hash, title:"(title unknown — fetch)", bytes:e.bytes, ts:e.stored_at, enc:e.private });
+                posts.unshift({hash:e.hash,title:"(title unknown — fetch)",bytes:e.bytes,ts:e.stored_at,enc:e.private,author:e.author||null,tz:e.creator_tz||null});
                setPosts(posts);
              }
            } else if (ev.event==="delete"){
-              const h = ev.data.hash; setPosts(getPosts().filter(p => p.hash !== h));
+              const h=ev.data.hash; setPosts(getPosts().filter(x=>x.hash!==h));
            }
          }catch{}
        }
@@ -114,62 +205,155 @@ function sse(){
  }).catch(()=>{});
 }
-async function viewPost(p, pre) {
+// ---------- avatar (canvas PNG) ----------
-  pre.textContent = "Loading…";
+function b64uEncode(buf){ const bin = Array.from(new Uint8Array(buf)).map(b=>String.fromCharCode(b)).join(""); return btoa(bin).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,""); }
-  try {
+function b64uDecodeToBytes(s){ s=s.replace(/-/g,"+").replace(/_/g,"/"); while(s.length%4) s+="="; const bin=atob(s); const out=new Uint8Array(bin.length); for(let i=0;i<bin.length;i++) out[i]=bin.charCodeAt(i); return out; }
-    const headers = {}; if (cfg.bearer) headers["Authorization"] = "Bearer " + cfg.bearer;
+function b64urlToJSON(b){ return JSON.parse(new TextDecoder().decode(b64uDecodeToBytes(b))); }
-    const r = await fetch(cfg.url + "/v1/object/" + p.hash, { headers });
+function parseGC2(tok){ try{ const p=tok.split("."); if(p.length!==3) return {}; const pl=b64urlToJSON(p[1]); return {sub:pl.sub||"", cnf:pl.cnf||""}; }catch{ return {}; } }
-    if (!r.ok) throw new Error("fetch failed " + r.status);
+async function sha256Hex(str){ const out = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(str)); return Array.from(new Uint8Array(out)).map(b=>b.toString(16).padStart(2,"0")).join(""); }
-    const buf = new Uint8Array(await r.arrayBuffer());
+function hexBytes(hex){ const u=new Uint8Array(hex.length/2); for(let i=0;i<u.length;i++) u[i]=parseInt(hex.substr(i*2,2),16); return u; }
-    let text;
+function identiconPNG(hex, size=64){
-    if (p.enc) {
+  const cells=5, cell=Math.floor(size/cells), pad=Math.floor((size-cell*cells)/2);
-      if (!cfg.passphrase) throw new Error("passphrase required");
+  const b=hexBytes(hex); const hue=b[0]/255*360; const bg=`hsl(${hue},35%,16%)`; const fg=`hsl(${(hue+180)%360},70%,60%)`;
-      text = await decryptToString(buf, cfg.passphrase);
+  const bits=[]; for(const x of b) for(let i=0;i<8;i++) bits.push((x>>i)&1);
-    } else { text = new TextDecoder().decode(buf); }
+  const c=document.createElement("canvas"); c.width=c.height=size; const g=c.getContext("2d");
-    try {
+  g.fillStyle=bg; g.fillRect(0,0,size,size);
-      const j = JSON.parse(text);
+  let k=0;
-      pre.textContent = (j.title ? `# ${j.title}\n\n` : "") + (j.body ?? text);
+  for(let y=0;y<cells;y++){
-    } catch { pre.textContent = text; }
+    for(let x=0;x<3;x++){
-  } catch (e) { pre.textContent = "Error: " + (e?.message || e); }
+      if(bits[k++]===1){
        const px=pad+x*cell, py=pad+y*cell;
        g.fillStyle=fg; g.fillRect(px,py,cell-1,cell-1);
        const mx=pad+(cells-1-x)*cell;
        if(cells-1-x!==x) g.fillRect(mx,py,cell-1,cell-1);
      }
    }
  }
  return c.toDataURL("image/png");
 }
 async function renderAvatar(){
  if (!els.avatar) return;
  let seed=null, label="(pseudonymous)";
  if (cfg.bearer){ const p=parseGC2(cfg.bearer); seed=p.cnf||p.sub||null; if(p.sub) label=p.sub; }
  if (!seed){ els.avatar.removeAttribute("src"); if (els.fp) els.fp.textContent="(pseudonymous)"; return; }
  const hex=await sha256Hex(seed);
  els.avatar.onerror = ()=>{ els.avatar.removeAttribute("src"); if (els.fp) els.fp.textContent="(pseudonymous)"; };
  els.avatar.src=identiconPNG(hex, 64);
  if (els.fp) els.fp.textContent=label+" (pseudonymous)";
 }
-async function saveBlob(p) {
+// ---------- security / PoP ----------
-  const headers = {}; if (cfg.bearer) headers["Authorization"] = "Bearer " + cfg.bearer;
+async function onSaveConn(){
-  const r = await fetch(cfg.url + "/v1/object/" + p.hash, { headers });
+  const c = { url: norm(els.shardUrl.value || defaultApiBase()), bearer: els.bearer.value.trim(), passphrase: els.passphrase.value };
-  if (!r.ok) return alert("download failed " + r.status);
+  saveConfig(c); flash("Saved");
-  const b = await r.blob();
+  updateLimitedModeUI(); await checkHealth(); await syncIndex(); sse(true); await renderAvatar();
  const a = document.createElement("a"); a.href = URL.createObjectURL(b);
  a.download = p.hash + (p.enc ? ".gcenc" : ".json"); a.click(); URL.revokeObjectURL(a.href);
 }
-
+async function panicWipe(){
-async function delServer(p) {
+  flash("Wiping local state…");
-  const headers = {}; if (cfg.bearer) headers["Authorization"] = "Bearer " + cfg.bearer;
+  try { const base = cfg.url || defaultApiBase(); if (base) await fetch(base + "/v1/session/clear", { method:"POST" }); } catch {}
-  if (!confirm("Delete blob from server by hash?")) return;
+  localStorage.clear(); sessionStorage.clear(); caches?.keys?.().then(keys => keys.forEach(k => caches.delete(k)));
-  const r = await fetch(cfg.url + "/v1/object/" + p.hash, { method:"DELETE", headers });
+  flash("Cleared — reloading"); setTimeout(()=>location.reload(), 300);
  if (!r.ok) return alert("delete failed " + r.status);
  setPosts(getPosts().filter(x=>x.hash!==p.hash));
 }
 async function discordStart(){
-  if (!cfg.url) { alert("Set shard URL first."); return; }
+  const base = cfg.url || defaultApiBase(); if (!base){ alert("Set shard URL first."); return; }
-  const r = await fetch(cfg.url + "/v1/auth/discord/start", { headers: { "X-GC-3P-Assent":"1" }});
+  const r = await fetch(base + "/v1/auth/discord/start", { headers: { "X-GC-3P-Assent":"1" }});
  if (!r.ok){ alert("Discord SSO not available"); return; }
-  const j = await r.json();
+  const j = await r.json(); location.href = j.url;
-  location.href = j.url;
+}
 async function getOrCreateKeyPair(){
  const pkcs8 = sessionStorage.getItem(KEY_PKCS8); const pubRaw = sessionStorage.getItem(KEY_PUB_RAW);
  if (pkcs8 && pubRaw){
    try{
      const priv = await crypto.subtle.importKey("pkcs8", b64uDecodeToBytes(pkcs8), {name:"ECDSA", namedCurve:"P-256"}, true, ["sign"]);
      const pub = await crypto.subtle.importKey("raw", b64uDecodeToBytes(pubRaw), {name:"ECDSA", namedCurve:"P-256"}, true, ["verify"]);
      return { priv, pub, pubRawB64u: pubRaw };
    }catch{}
  }
  const kp = await crypto.subtle.generateKey({name:"ECDSA", namedCurve:"P-256"}, true, ["sign","verify"]);
  const pkcs8New = await crypto.subtle.exportKey("pkcs8", kp.privateKey);
  const pubRawBytes = await crypto.subtle.exportKey("raw", kp.publicKey);
  const pkcs8B64 = b64uEncode(pkcs8New); const pubRawB64 = b64uEncode(pubRawBytes);
  sessionStorage.setItem(KEY_PKCS8, pkcs8B64); sessionStorage.setItem(KEY_PUB_RAW, pubRawB64);
  return { priv: kp.privateKey, pub: kp.publicKey, pubRawB64u: pubRawB64 };
 }
 async function deviceKeySignIn(){
  const base = cfg.url || defaultApiBase(); if (!base){ alert("Set shard URL first."); return; }
  flash("Signing in…");
  try{
    const { priv, pubRawB64u } = await getOrCreateKeyPair();
    const rc = await fetch(base + "/v1/auth/key/challenge", { method:"POST" });
    if (!rc.ok) throw new Error("challenge "+rc.status);
    const cj = await rc.json();
    const msg = new TextEncoder().encode("key-verify\n"+cj.nonce);
    const sig = await crypto.subtle.sign({name:"ECDSA", hash:"SHA-256"}, priv, msg);
    const body = JSON.stringify({ nonce:cj.nonce, alg:"p256", pub:pubRawB64u, sig:b64uEncode(sig) });
    const rv = await fetch(base + "/v1/auth/key/verify", { method:"POST", headers:{"Content-Type":"application/json"}, body });
    if (!rv.ok) throw new Error("verify "+rv.status);
    const vj = await rv.json();
    saveConfig({ bearer: vj.bearer }); applyConfig(); updateLimitedModeUI();
    await renderAvatar(); await checkHealth(); await syncIndex(); sse(true); flash("Signed in");
  }catch(e){ console.error(e); alert("Sign-in error: "+(e?.message||e)); }
 }
 async function signPoPHeaders(method, pathOnly, bodyBytes){
  const pubRaw = sessionStorage.getItem(KEY_PUB_RAW); const pkcs8 = sessionStorage.getItem(KEY_PKCS8);
  if (!pubRaw || !pkcs8) return {};
  const priv = await crypto.subtle.importKey("pkcs8", b64uDecodeToBytes(pkcs8), {name:"ECDSA", namedCurve:"P-256"}, false, ["sign"]);
  const bodyHash = await crypto.subtle.digest("SHA-256", bodyBytes || new Uint8Array());
  const hex = Array.from(new Uint8Array(bodyHash)).map(b=>b.toString(16).padStart(2,"0")).join("");
  const ts = Math.floor(Date.now()/1000).toString();
  const msg = new TextEncoder().encode(method.toUpperCase()+"\n"+pathOnly+"\n"+ts+"\n"+hex);
  const sig = await crypto.subtle.sign({name:"ECDSA", hash:"SHA-256"}, priv, msg);
  return { "X-GC-Key":"p256:"+pubRaw, "X-GC-TS":ts, "X-GC-Proof":b64uEncode(sig) };
 }
 async function fetchWithPoP(url, opts){
  const u = new URL(url); const path = u.pathname; const method = (opts?.method||"GET").toUpperCase();
  const bodyBuf = opts?.body instanceof Blob ? new Uint8Array(await opts.body.arrayBuffer())
                 : (opts?.body instanceof ArrayBuffer ? new Uint8Array(opts.body) : new Uint8Array());
  const pop = await signPoPHeaders(method, path, bodyBuf);
  const headers = new Headers(opts?.headers||{});
  if (cfg.bearer) headers.set("Authorization", "Bearer "+cfg.bearer);
  for (const [k,v] of Object.entries(pop)) headers.set(k,v);
  return fetch(url, { ...(opts||{}), headers });
 }
 // ---------- compose / posts ----------
 function msg(t, err=false){ els.publishStatus.textContent=t; els.publishStatus.style.color = err ? "#ff6b6b" : "#8b949e"; }
 async function publish(){
  const base = cfg.url || defaultApiBase(); if (!base) return msg("Set shard URL first.", true);
  const title = els.title.value.trim(); const body = els.body.value; const vis = els.visibility.value;
  if (!isAuthorized() && vis === "private"){ msg("Private posts require authorizing this device. Publishing as public.", true); els.visibility.value = "public"; }
  try{
    let blob, enc=false;
    if (els.visibility.value==="private"){
      if (!els.passphrase.value) return msg("Set a passphrase for private posts.", true);
      const payload = await encryptString(JSON.stringify({title,body}), els.passphrase.value);
      blob = toBlob(payload); enc=true;
    } else { blob = toBlob(JSON.stringify({title,body})); }
    const headers = {"Content-Type":"application/octet-stream"};
    if (enc) headers["X-GC-Private"]="1";
    const tz = Intl.DateTimeFormat().resolvedOptions().timeZone; if (tz) headers["X-GC-TZ"]=tz;
    const r = await fetchWithPoP(base + "/v1/object", { method:"PUT", headers, body: blob });
    if (!r.ok) throw new Error(await r.text());
    const j = await r.json();
    const posts = getPosts();
    posts.unshift({ hash:j.hash, title: title || "(untitled)", bytes:j.bytes, ts:j.stored_at, enc, author:j.author||null, tz:j.creator_tz||null });
    setPosts(posts);
    els.body.value=""; msg(`Published ${enc?"private":"public"} post. Hash: ${j.hash}`);
  }catch(e){ msg("Publish failed: "+(e?.message||e), true); }
 }
 function renderPosts(){
-  const posts = getPosts(); els.posts.innerHTML = "";
+  const posts = getPosts(); if (!els.posts) return; els.posts.innerHTML="";
  for (const p of posts){
    const div = document.createElement("div"); div.className="post";
    const badge = p.enc?`<span class="badge">private</span>`:`<span class="badge">public</span>`;
    const tz = p.tz?` · tz:${p.tz}`:""; const who = p.author?` · by ${p.author.slice(0,8)}…`:"";
    div.innerHTML = `
-      <div class="meta"><code>${p.hash.slice(0,10)}…</code> · ${p.bytes} bytes · ${p.ts} ${badge}</div>
+      <div class="meta"><code>${p.hash.slice(0,10)}…</code> · ${p.bytes} bytes · ${p.ts}${tz}${who} ${badge}</div>
      <div class="actions">
-        <button data-act="view">View</button>
+        <button data-act="view" type="button">View</button>
-        <button data-act="save">Save blob</button>
+        <button data-act="save" type="button">Save blob</button>
-        <button data-act="delete">Delete (server)</button>
+        <button data-act="delete" type="button">Delete (server)</button>
-        <button data-act="remove">Remove (local)</button>
+        <button data-act="remove" type="button">Remove (local)</button>
      </div>
      <pre class="content" style="white-space:pre-wrap;margin-top:.5rem;"></pre>`;
    const pre = div.querySelector(".content");
@@ -180,3 +364,29 @@ function renderPosts() {
    els.posts.appendChild(div);
  }
 }
 async function viewPost(p, pre){
  const base = cfg.url || defaultApiBase(); pre.textContent="Loading…";
  try{
    const r = await fetch(base + "/v1/object/"+p.hash);
    if (!r.ok) throw new Error("fetch failed "+r.status);
    const buf = new Uint8Array(await r.arrayBuffer());
    let text;
    if (p.enc){ if (!els.passphrase.value) throw new Error("passphrase required"); text = await decryptToString(buf, els.passphrase.value); }
    else { text = new TextDecoder().decode(buf); }
    try{ const j=JSON.parse(text); pre.textContent=(j.title?`# ${j.title}\n\n`:"")+(j.body??text); } catch{ pre.textContent=text; }
  }catch(e){ pre.textContent="Error: "+(e?.message||e); }
 }
 async function saveBlob(p){
  const base = cfg.url || defaultApiBase();
  const r = await fetch(base + "/v1/object/"+p.hash);
  if (!r.ok) return alert("download failed "+r.status);
  const b = await r.blob(); const a=document.createElement("a"); a.href=URL.createObjectURL(b);
  a.download=p.hash+(p.enc?".gcenc":".json"); a.click(); URL.revokeObjectURL(a.href);
 }
 async function delServer(p){
  const base = cfg.url || defaultApiBase();
  if (!confirm("Delete blob from server by hash?")) return;
  const r = await fetchWithPoP(base + "/v1/object/"+p.hash, { method:"DELETE" });
  if (!r.ok) return alert("delete failed "+r.status);
  setPosts(getPosts().filter(x=>x.hash!==p.hash));
 }
--- a/client/auth_callback.html
+++ b/client/auth_callback.html
@@ -1,43 +1,20 @@
 <!doctype html>
-<html>
+<meta charset="utf-8">
-<head>
+<title>Signing you in…</title>
-  <meta charset="utf-8"/>
+<script>
-  <title>GreenCoast — Auth Callback</title>
+(function(){
-  <meta name="viewport" content="width=device-width, initial-scale=1"/>
+  const hash = new URLSearchParams(location.hash.slice(1));
-  <style>
+  const bearer = hash.get("bearer");
-    body { font-family: system-ui, -apple-system, Segoe UI, Roboto, Arial; background:#0b1117; color:#e6edf3; display:flex; align-items:center; justify-content:center; height:100vh; }
+  const next = hash.get("next") || "/";
    .card { background:#0f1621; padding:1rem 1.2rem; border-radius:14px; max-width:560px; }
    .muted{ color:#8b949e; }
  </style>
 </head>
 <body>
  <div class="card">
    <h3>Signing you in…</h3>
    <div id="msg" class="muted">Please wait.</div>
  </div>
 <script type="module">
  const params = new URLSearchParams(location.search);
  const code = params.get("code");
  const origin = location.origin; // shard and client served together
  const msg = (t)=>document.getElementById("msg").textContent = t;
  async function run() {
    if (!code) { msg("Missing 'code' parameter."); return; }
  try {
-      const r = await fetch(origin + "/v1/auth/discord/callback?assent=1&code=" + encodeURIComponent(code));
+    // Prefer sessionStorage; keep localStorage for backward compatibility
-      if (!r.ok) { msg("Exchange failed: " + r.status); return; }
+    if (bearer) sessionStorage.setItem("gc_bearer", bearer);
-      const j = await r.json();
+    const k = "gc_client_config_v1";
-      const key = "gc_client_config_v1";
+    const cfg = JSON.parse(localStorage.getItem(k) || "{}");
-      const cfg = JSON.parse(localStorage.getItem(key) || "{}");
+    if (bearer) cfg.bearer = bearer;
-      cfg.bearer = j.token;
+    localStorage.setItem(k, JSON.stringify(cfg));
-      localStorage.setItem(key, JSON.stringify(cfg));
+  } catch {}
-      msg("Success. Redirecting…");
+  history.replaceState(null, "", next);
-      setTimeout(()=>location.href="/", 800);
+  location.href = next;
-    } catch(e) {
+})();
      msg("Error: " + (e?.message || e));
    }
  }
  run();
 </script>
 </body>
 </html>
--- a/client/avatar.js
+++ b/client/avatar.js
@@ -0,0 +1,44 @@
 // Deterministic, local-only avatars. No network calls.
 export function avatarDataURL(seed, size = 40) {
  // Hash seed → bytes
  const h = sha256(seed);
  // Colors from bytes
  const hue = h[0] % 360;
  const bg = `hsl(${(h[1]*3)%360} 25% 14%)`;
  const fg = `hsl(${hue} 70% 60%)`;
  // 5x5 grid mirrored; draw squares where bits set
  const cells = 5, scale = Math.floor(size / cells);
  let rects = "";
  for (let y = 0; y < cells; y++) {
    for (let x = 0; x < Math.ceil(cells/2); x++) {
      const bit = (h[(y*3 + x) % h.length] >> (y % 5)) & 1;
      if (bit) {
        const xL = x*scale, xR = (cells-1-x)*scale, yP = y*scale;
        rects += `<rect x="${xL}" y="${yP}" width="${scale}" height="${scale}" rx="2" ry="2" fill="${fg}"/>`;
        if (x !== cells-1-x) {
          rects += `<rect x="${xR}" y="${yP}" width="${scale}" height="${scale}" rx="2" ry="2" fill="${fg}"/>`;
        }
      }
    }
  }
  const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${cells*scale} ${cells*scale}">
    <rect width="100%" height="100%" fill="${bg}"/>${rects}
  </svg>`;
  return "data:image/svg+xml;base64," + btoa(unescape(encodeURIComponent(svg)));
 }
 function sha256(s) {
  // Simple synchronous hash-ish bytes from string (non-cryptographic; fine for visuals)
  let h1 = 0x6a09e667, h2 = 0xbb67ae85;
  for (let i=0;i<s.length;i++) {
    const c = s.charCodeAt(i);
    h1 = (h1 ^ c) * 0x45d9f3b + ((h1<<7) | (h1>>>25));
    h2 = (h2 ^ (c<<1)) * 0x27d4eb2d + ((h2<<9) | (h2>>>23));
  }
  const out = new Uint8Array(32);
  for (let i=0;i<32;i++){
    out[i] = (h1 >> (i%24)) ^ (h2 >> ((i*3)%24)) ^ (i*31);
  }
  return out;
 }
--- a/client/gdpr.html
+++ b/client/gdpr.html
@@ -0,0 +1,38 @@
 <!doctype html>
 <html lang="en">
 <head>
  <meta charset="utf-8"/>
  <title>GDPR Notice — GreenCoast</title>
  <meta name="viewport" content="width=device-width,initial-scale=1"/>
  <link rel="stylesheet" href="./styles.css"/>
 </head>
 <body class="container">
  <h1>GDPR Notice</h1>
  <p class="muted">Effective: 2025-08-22</p>
  <h2>Controller</h2>
  <p>The operator of this shard acts as data controller. Contact: <em>dsapelli@yahoo.com</em>.</p>
  <h2>Lawful bases</h2>
  <ul>
    <li><strong>Public posts:</strong> performance of service you request.</li>
    <li><strong>Private posts:</strong> performance of service; encryption keys never leave your device.</li>
    <li><strong>SSO (optional):</strong> your consent with the chosen provider.</li>
  </ul>
  <h2>Minimization & storage</h2>
  <p>No user profile, no behavioral analytics. Objects are stored by content hash; server logs are minimized and scrubbed of IPs/UA where feasible.</p>
  <h2>International transfers</h2>
  <p>Content may be hosted where you deploy the shard. Using third-party SSO may transfer data to those providers’ regions.</p>
  <h2>Data subject rights</h2>
  <p>Access/erasure/rectification: We do not keep a server-side identity. Uploaders can delete objects by hash if they still possess authorization. Encrypted content cannot be decrypted server-side.</p>
  <h2>Complaints</h2>
  <p>You may lodge a complaint with your local supervisory authority.</p>
  <p class="muted small">This document is informational and not legal advice.</p>
  <p><a href="./index.html">Back</a></p>
 </body>
 </html>
--- a/client/index.html
+++ b/client/index.html
@@ -5,35 +5,83 @@
  <title>GreenCoast — Client</title>
  <meta name="viewport" content="width=device-width,initial-scale=1"/>
  <link rel="stylesheet" href="./styles.css"/>
  <!-- Optional: pin API base -->
  <!-- <meta name="gc-api-base" content="https://api-gc.fullmooncyberworks.com"> -->
  <style>
    #flash{position:fixed;right:12px;bottom:12px;background:#0b1222;border:1px solid #1f2937;color:#e5e7eb;
           padding:.55rem .7rem;border-radius:.5rem;box-shadow:0 6px 18px rgba(0,0,0,.35);display:none;z-index:9999}
  </style>
 </head>
 <body>
-  <div class="container">
+  <header class="topbar">
-    <h1>GreenCoast (Client)</h1>
+    <div class="brand">GreenCoast</div>
    <nav class="tabs">
      <a data-route href="#/">Feed</a>
      <a data-route href="#/privacy">Privacy</a>
      <a data-route href="#/gdpr">GDPR</a>
      <a data-route href="#/terms">Terms</a>
    </nav>
    <div class="actions">
      <button id="signIn" type="button">Sign in (device key)</button>
      <button id="discordStart" type="button">Discord</button>
      <button id="panic" type="button">Panic wipe</button>
    </div>
  </header>
  <div id="banner" class="banner" hidden>
    You are in <strong>anonymous (limited) mode</strong>. Only public text posts are available until you authorize this device.
  </div>
  <!-- Three-column shell -->
  <div class="shell">
    <aside id="left" class="col">
      <section class="card">
        <h3>Profile</h3>
        <div class="profile">
          <img id="avatar" alt="avatar" width="56" height="56"/>
          <div class="profile-meta">
            <div><code id="fp">(pseudonymous)</code></div>
            <div class="muted small">Avatar is derived locally.</div>
          </div>
        </div>
      </section>
      <section class="card">
-      <h2>Connect</h2>
+        <h3>Quick links</h3>
        <ul class="links">
          <li><a data-route href="#/">Feed</a></li>
          <li><a data-route href="#/privacy">Privacy Policy</a></li>
          <li><a data-route href="#/gdpr">GDPR</a></li>
          <li><a data-route href="#/terms">Terms</a></li>
        </ul>
      </section>
    </aside>
    <main id="feed" class="col">
      <section class="card">
        <h2>Connection</h2>
        <div class="row">
          <label>Shard URL</label>
-        <input id="shardUrl" placeholder="http://localhost:8080" />
+          <input id="shardUrl" placeholder="https://api-gc.fullmooncyberworks.com"/>
        </div>
        <details id="adv" class="advanced">
          <summary>Advanced (security)</summary>
          <div class="row">
            <label>Bearer (hidden)</label>
            <input id="bearer" type="password" placeholder="gc2 token" autocomplete="off"/>
          </div>
          <div class="row">
-        <label>Bearer (optional)</label>
+            <label>Passphrase</label>
-        <input id="bearer" placeholder="dev-local-token" />
+            <input id="passphrase" type="password" placeholder="••••••••" autocomplete="off"/>
          </div>
-      <div class="row">
+          <p class="muted small">
-        <label>Passphrase (private posts)</label>
+            Security fields are local to your browser. We do not store PII or logs.
-        <input id="passphrase" type="password" placeholder="••••••••" />
+            Third-party SSO is optional and not endorsed for security.
-      </div>
+          </p>
-      <div class="row">
+        </details>
-        <label>3rd-party SSO</label>
+
-        <div>
+        <button id="saveConn" type="button">Save</button>
          <button id="discordStart">Sign in with Discord</button>
          <div class="muted" style="margin-top:.4rem;">
            We use external providers only if you choose to. We cannot vouch for their security.
          </div>
        </div>
      </div>
      <button id="saveConn">Save</button>
        <div id="health" class="muted"></div>
      </section>
@@ -54,7 +102,7 @@
          <label>Body</label>
          <textarea id="body" rows="6" placeholder="Write your post..."></textarea>
        </div>
-      <button id="publish">Publish</button>
+        <button id="publish" type="button">Publish</button>
        <div id="publishStatus" class="muted"></div>
      </section>
@@ -62,8 +110,39 @@
        <h2>Posts (live index)</h2>
        <div id="posts"></div>
      </section>
    </main>
    <!-- Legal/other pages render here (SPA routing) -->
    <main id="page" class="col" hidden>
      <section class="card">
        <div id="pageContent">Loading…</div>
      </section>
    </main>
    <aside id="right" class="col">
      <section class="card">
        <h3>About</h3>
        <p class="muted small">Zero-trust, E2EE optional, no analytics, no PII.</p>
      </section>
      <section class="card">
        <h3>Legal</h3>
        <ul class="links">
          <li><a data-route href="#/privacy">Privacy</a></li>
          <li><a data-route href="#/gdpr">GDPR</a></li>
          <li><a data-route href="#/terms">Terms</a></li>
        </ul>
      </section>
    </aside>
  </div>
  <footer class="footer">
    <a data-route href="#/privacy">Privacy</a> ·
    <a data-route href="#/gdpr">GDPR</a> ·
    <a data-route href="#/terms">Terms</a>
  </footer>
  <div id="flash"></div>
  <script type="module" src="./app.js"></script>
 </body>
 </html>
--- a/client/privacy.html
+++ b/client/privacy.html
@@ -0,0 +1,41 @@
 <!doctype html>
 <html lang="en">
 <head>
  <meta charset="utf-8"/>
  <title>Privacy Policy — GreenCoast</title>
  <meta name="viewport" content="width=device-width,initial-scale=1"/>
  <link rel="stylesheet" href="./styles.css"/>
 </head>
 <body class="container">
  <h1>Privacy Policy</h1>
  <p class="muted">Effective: 2025-08-22</p>
  <h2>What we are</h2>
  <p>GreenCoast is a zero-trust, end-to-end encrypted (E2EE) social platform. By default, we do not collect analytics, do not store personal data, and do not maintain server logs that identify users.</p>
  <h2>Data we process</h2>
  <ul>
    <li><strong>Public posts:</strong> Stored as plaintext objects keyed by content hash. No account profile is required.</li>
    <li><strong>Private posts:</strong> Encrypted <em>client-side</em> with a passphrase only you know. The server sees ciphertext only.</li>
    <li><strong>Authorization:</strong> Device-key and/or third-party SSO (if you choose) issue a short-lived bearer. We do not persist profile data.</li>
  </ul>
  <h2>Third-party SSO</h2>
  <p>If you use Discord/Google/etc., those providers may process your data under their own terms. We cannot vouch for their security.</p>
  <h2>Cookies & local storage</h2>
  <p>We use browser storage on your device to keep connection settings and, if you choose, session tokens. You can wipe them with “Panic wipe”.</p>
  <h2>Security</h2>
  <p>E2EE for private content, proof-of-possession on mutations, rate-limits, CSP/COOP/COEP, and optional hardware keys via WebAuthn (if enabled on your shard).</p>
  <h2>Your rights</h2>
  <p>Because we do not maintain user identities or server-side profiles, requests to access/correct/erase personal data typically do not apply. For encrypted content, we cannot decrypt it for you.</p>
  <h2>Contact</h2>
  <p>Email: <em>dsapelli@yahoo.com</em></p>
  <p class="muted small">This page describes our reference shard. Self-hosted deployments may differ.</p>
  <p><a href="./index.html">Back</a></p>
 </body>
 </html>
--- a/client/styles.css
+++ b/client/styles.css
@@ -1,18 +1,48 @@
-:root { --bg:#0b1117; --card:#0f1621; --fg:#e6edf3; --muted:#8b949e; --accent:#2ea043; }
+:root{
-* { box-sizing: border-box; }
+  --bg:#0f172a;--surface:#111827;--muted:#8b949e;--text:#e5e7eb;--accent:#22c55e;
-body { margin:0; font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Arial; background:var(--bg); color:var(--fg); }
+  --card:#0b1222;--border:#1f2937;--tab:#0b1222;--tab-active:#1f2937
-.container { max-width: 900px; margin: 2rem auto; padding: 0 1rem; }
+}
-h1 { font-size: 1.5rem; margin-bottom: 1rem; }
+*{box-sizing:border-box}
-.card { background: var(--card); border-radius: 14px; padding: 1rem; margin-bottom: 1rem; box-shadow: 0 8px 24px rgba(0,0,0,.3); }
+html,body{margin:0;padding:0;background:var(--bg);color:var(--text);
-h2 { margin-top: 0; font-size: 1.1rem; }
+  font-family:ui-sans-serif,system-ui,Segoe UI,Roboto,Ubuntu,"Helvetica Neue","Noto Sans",Arial}
-.row { display: grid; grid-template-columns: 160px 1fr; gap: .75rem; align-items: center; margin: .5rem 0; }
+a{color:#93c5fd;text-decoration:none}
-label { color: var(--muted); }
+a:hover{text-decoration:underline}
-input, select, textarea { width: 100%; padding: .6rem .7rem; border-radius: 10px; border: 1px solid #233; background: #0b1520; color: var(--fg); }
+
-button { background: var(--accent); color: #08130b; border: none; padding: .6rem .9rem; border-radius: 10px; cursor: pointer; font-weight: 700; }
+.topbar{display:flex;align-items:center;justify-content:space-between;padding:.6rem 1rem;
-button:hover { filter: brightness(1.05); }
+  border-bottom:1px solid var(--border);background:#0b1222;position:sticky;top:0;z-index:10}
-.muted { color: var(--muted); margin-top: .5rem; font-size: .9rem; }
+.brand{font-weight:700}
-.post { border: 1px solid #1d2734; border-radius: 12px; padding: .75rem; margin: .5rem 0; background: #0c1824; }
+.actions button{margin-left:.5rem}
-.post .meta { font-size: .85rem; color: var(--muted); margin-bottom: .4rem; }
+button{background:#134e4a;border:1px solid #0f766e;color:white;border-radius:.6rem;padding:.45rem .7rem;cursor:pointer}
-.post .actions { margin-top: .5rem; display:flex; gap:.5rem; }
+button:hover{filter:brightness(1.05)}
-code { background:#0a1320; padding:.15rem .35rem; border-radius:6px; }
+
-.badge { font-size:.75rem; padding:.1rem .4rem; border-radius: 999px; background:#132235; color:#9fb7d0; margin-left:.5rem; }
+.tabs{display:flex;gap:.25rem;margin:0 .75rem}
 .tabs a{padding:.35rem .6rem;border:1px solid var(--border);border-radius:.5rem;background:var(--tab)}
 .tabs a.active{background:var(--tab-active);border-color:#334155}
 .banner{background:#1f2937;color:#e5e7eb;border-bottom:1px solid var(--border);padding:.6rem 1rem}
 .shell{max-width:1100px;margin:1rem auto;display:grid;grid-template-columns:280px 1fr 300px;gap:1rem;padding:0 1rem}
 .col{min-width:0}
 .card{background:var(--card);border:1px solid var(--border);border-radius:.75rem;padding:1rem;margin-bottom:1rem}
 .row{display:flex;gap:.75rem;align-items:center;margin:.5rem 0}
 .row label{min-width:140px;color:#cbd5e1}
 .row input,.row select,textarea{flex:1;background:#0f172a;border:1px solid var(--border);border-radius:.5rem;padding:.55rem .65rem;color:var(--text)}
 .muted{color:var(--muted)} .small{font-size:.9rem}
 .profile{display:flex;align-items:center;gap:1rem}
 #avatar{border-radius:50%;border:1px solid var(--border);background:#0f172a;image-rendering:pixelated}
 .post{border:1px dashed var(--border);border-radius:.5rem;padding:.6rem .7rem;margin-bottom:.6rem}
 .post .meta{color:var(--muted);font-size:.9rem;margin-bottom:.25rem}
 .badge{background:var(--surface);border:1px solid var(--border);border-radius:999px;padding:.05rem .5rem;font-size:.75rem;margin-left:.5rem}
 .advanced summary{cursor:pointer;color:#cbd5e1;margin:.25rem 0}
 .links{list-style:none;padding:0;margin:0}
 .links li{margin:.25rem 0}
 .footer{max-width:1100px;margin:1rem auto 2rem auto;padding:0 1rem;color:#94a3b8}
@media (max-width: 980px){
  .shell{grid-template-columns:1fr;gap:.75rem}
  #left,#right{order:2}
  #feed,#page{order:1}
 }
--- a/client/terms.html
+++ b/client/terms.html
@@ -0,0 +1,33 @@
 <!doctype html>
 <html lang="en">
 <head>
  <meta charset="utf-8"/>
  <title>Terms of Service — GreenCoast</title>
  <meta name="viewport" content="width=device-width,initial-scale=1"/>
  <link rel="stylesheet" href="./styles.css"/>
 </head>
 <body class="container">
  <h1>Terms of Service</h1>
  <p class="muted">Effective: 2025-08-22</p>
  <h2>Service</h2>
  <p>GreenCoast is provided “as-is”, with no warranties. You may self-host under the Unlicense. This reference shard has no paid plans.</p>
  <h2>User content</h2>
  <p>You are responsible for content you publish. Do not post illegal content or abuse others. We reserve the right to remove content that violates applicable law.</p>
  <h2>Accounts & authorization</h2>
  <p>Device-key and optional SSO are used to prove control of a device. We do not maintain user profiles.</p>
  <h2>Third-party services</h2>
  <p>If you connect SSO providers, your use of those services is governed by their terms and privacy policies.</p>
  <h2>Limitation of liability</h2>
  <p>To the fullest extent permitted by law, the operator is not liable for indirect or consequential damages.</p>
  <h2>Changes</h2>
  <p>We may update these Terms by posting a new version on this page.</p>
  <p><a href="./index.html">Back</a></p>
 </body>
 </html>
--- a/cmd/shard/main.go
+++ b/cmd/shard/main.go
@@ -1,89 +1,163 @@
 package main
 import (
 	"flag"
 	"log"
-	"path/filepath"
+	"net/http"
 	"os"
 	"strconv"
 	"time"
 	"greencoast/internal/api"
 	"greencoast/internal/config"
 	"greencoast/internal/federation"
 	"greencoast/internal/index"
 	"greencoast/internal/storage"
 )
-func main() {
+func getenvBool(key string, def bool) bool {
-	cfgPath := flag.String("config", "shard.yaml", "path to config")
+	v := os.Getenv(key)
-	flag.Parse()
+	if v == "" {
-
+		return def
-	cfg, err := config.Load(*cfgPath)
+	}
 	b, err := strconv.ParseBool(v)
 	if err != nil {
-		log.Fatalf("config error: %v", err)
+		return def
 	}
 	return b
 }
-	store, err := storage.NewFSStore(cfg.Storage.Path, cfg.Storage.MaxObjectKB)
+func staticHeaders(next http.Handler) http.Handler {
-	if err != nil {
+	onion := os.Getenv("GC_ONION_LOCATION") // optional: e.g., http://xxxxxxxx.onion/
-		log.Fatalf("storage error: %v", err)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		// Security headers + strict CSP (no inline) + COEP
 		w.Header().Set("Referrer-Policy", "no-referrer")
 		w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
 		w.Header().Set("Cross-Origin-Resource-Policy", "same-site")
 		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), interest-cohort=(), browsing-topics=()")
 		w.Header().Set("X-Frame-Options", "DENY")
 		w.Header().Set("X-Content-Type-Options", "nosniff")
 		w.Header().Set("Strict-Transport-Security", "max-age=15552000; includeSubDomains; preload")
 		w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp")
 		// Allow only self + HTTPS for fetch/SSE; no inline styles/scripts
 		w.Header().Set("Content-Security-Policy",
 			"default-src 'self'; "+
 				"script-src 'self'; "+
 				"style-src 'self'; "+
 				"img-src 'self' data:; "+
 				"connect-src 'self' https:; "+
 				"frame-ancestors 'none'; object-src 'none'; base-uri 'none'; form-action 'self'; "+
 				"require-trusted-types-for 'script'")
 		if onion != "" {
 			w.Header().Set("Onion-Location", onion)
 		}
-	dataRoot := filepath.Dir(cfg.Storage.Path)
+		// Basic CORS for static (GET only effectively)
-	idx := index.New(dataRoot)
+		w.Header().Set("Access-Control-Allow-Origin", "*")
-
+		if r.Method == http.MethodOptions {
-	srv := api.New(
+			w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
-		store, idx,
+			w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
-		cfg.Privacy.RetainTimestamps == "coarse",
+			w.WriteHeader(http.StatusNoContent)
 		cfg.Security.ZeroTrust,
 		api.AuthProviders{
 			SigningSecretHex: cfg.Auth.SigningSecret,
 			Discord: api.DiscordProvider{
 				Enabled:      cfg.Auth.SSO.Discord.Enabled,
 				ClientID:     cfg.Auth.SSO.Discord.ClientID,
 				ClientSecret: cfg.Auth.SSO.Discord.ClientSecret,
 				RedirectURI:  cfg.Auth.SSO.Discord.RedirectURI,
 			},
 			GoogleEnabled:   cfg.Auth.SSO.Google.Enabled,
 			FacebookEnabled: cfg.Auth.SSO.Facebook.Enabled,
 			WebAuthnEnabled: cfg.Auth.TwoFactor.WebAuthnEnabled,
 			TOTPEnabled:     cfg.Auth.TwoFactor.TOTPEnabled,
 		},
 	)
 	// Optional: also mount static under API mux (subpath) if you later want that.
 	// srv.MountStatic(cfg.UI.Path, "/app")
 	// Start federation mTLS (if enabled)
 	if cfg.Federation.MTLSEnable {
 		tlsCfg, err := federation.ServerTLSConfig(
 			cfg.Federation.CertFile,
 			cfg.Federation.KeyFile,
 			cfg.Federation.ClientCAFile,
 		)
 		if err != nil {
 			log.Fatalf("federation tls config error: %v", err)
 		}
 		go func() {
 			if err := srv.ListenMTLS(cfg.Federation.Listen, tlsCfg); err != nil {
 				log.Fatalf("federation mTLS listener error: %v", err)
 			}
 		}()
 	}
 	// Start FRONTEND listener (separate port) if enabled
 	if cfg.UI.Enable && cfg.UI.FrontendHTTP != "" {
 		go func() {
 			if err := srv.ListenFrontendHTTP(cfg.UI.FrontendHTTP, cfg.UI.Path, cfg.UI.BaseURL); err != nil {
 				log.Fatalf("frontend listener error: %v", err)
 			}
 		}()
 	}
 	// Choose ONE foreground listener for API: HTTPS if enabled, else HTTP.
 	if cfg.TLS.Enable && cfg.Listen.HTTPS != "" {
 		log.Fatal(srv.ListenHTTPS(cfg.Listen.HTTPS, cfg.TLS.CertFile, cfg.TLS.KeyFile))
 			return
 		}
-	if cfg.Listen.HTTP == "" {
+		next.ServeHTTP(w, r)
-		log.Fatal("no API listeners configured (set listen.http or listen.https)")
+	})
 }
 func main() {
 	// ---- Config ----
 	httpAddr := os.Getenv("GC_HTTP_ADDR")
 	if httpAddr == "" {
 		httpAddr = ":9080"
 	}
 	httpsAddr := os.Getenv("GC_HTTPS_ADDR")
 	certFile := os.Getenv("GC_TLS_CERT")
 	keyFile := os.Getenv("GC_TLS_KEY")
 	staticAddr := os.Getenv("GC_STATIC_ADDR")
 	if staticAddr == "" {
 		staticAddr = ":9082"
 	}
 	staticDir := os.Getenv("GC_STATIC_DIR")
 	if staticDir == "" {
 		staticDir = "/opt/greencoast/client"
 	}
 	dataDir := os.Getenv("GC_DATA_DIR")
 	if dataDir == "" {
 		dataDir = "/var/lib/greencoast"
 	}
 	coarseTS := getenvBool("GC_COARSE_TS", true) // safer default (less precise metadata)
 	zeroTrust := getenvBool("GC_ZERO_TRUST", true)
 	encRequired := getenvBool("GC_ENCRYPTION_REQUIRED", true) // operator-blind by default
 	requirePOP := getenvBool("GC_REQUIRE_POP", true)          // logged only here
 	signingSecretHex := os.Getenv("GC_SIGNING_SECRET_HEX")
 	if len(signingSecretHex) < 64 {
 		log.Printf("WARN: GC_SIGNING_SECRET_HEX length=%d (need >=64 hex chars)", len(signingSecretHex))
 	} else {
 		log.Printf("GC_SIGNING_SECRET_HEX OK (len=%d)", len(signingSecretHex))
 	}
 	discID := os.Getenv("GC_DISCORD_CLIENT_ID")
 	discSecret := os.Getenv("GC_DISCORD_CLIENT_SECRET")
 	discRedirect := os.Getenv("GC_DISCORD_REDIRECT_URI")
 	// ---- Storage & Index ----
 	store, err := storage.NewFS(dataDir)
 	if err != nil {
 		log.Fatalf("storage init: %v", err)
 	}
 	ix := index.New()
 	// Reindex on boot from existing files (coarse time if enabled)
 	if err := store.Walk(func(hash string, size int64, mod time.Time) error {
 		when := mod.UTC()
 		if coarseTS {
 			when = when.Truncate(time.Minute)
 		}
 		return ix.Put(index.Entry{
 			Hash:     hash,
 			Bytes:    size,
 			StoredAt: when.Format(time.RFC3339Nano),
 			Private:  false, // unknown here
 		})
 	}); err != nil {
 		log.Printf("reindex on boot: %v", err)
 	}
 	// ---- Auth providers ----
 	providers := api.AuthProviders{
 		SigningSecretHex: signingSecretHex,
 		Discord: api.DiscordProvider{
 			Enabled:      discID != "" && discSecret != "" && discRedirect != "",
 			ClientID:     discID,
 			ClientSecret: discSecret,
 			RedirectURI:  discRedirect,
 		},
 	}
 	// ---- API server ----
 	srv := api.New(store, ix, coarseTS, zeroTrust, providers, encRequired)
 	// ---- Static file server (separate listener) ----
 	go func() {
 		fs := http.FileServer(http.Dir(staticDir))
 		h := staticHeaders(fs)
 		log.Printf("static listening on %s (dir=%s)", staticAddr, staticDir)
 		if err := http.ListenAndServe(staticAddr, h); err != nil {
 			log.Fatalf("static server: %v", err)
 		}
 	}()
 	// ---- Start API (HTTP or HTTPS) ----
 	if httpsAddr != "" && certFile != "" && keyFile != "" {
 		log.Printf("API HTTPS %s  POP:%v ENC_REQUIRED:%v", httpsAddr, requirePOP, encRequired)
 		if err := srv.ListenHTTPS(httpsAddr, certFile, keyFile); err != nil {
 			log.Fatal(err)
 		}
 		return
 	}
 	log.Printf("API HTTP %s  POP:%v ENC_REQUIRED:%v", httpAddr, requirePOP, encRequired)
 	if err := srv.ListenHTTP(httpAddr); err != nil {
 		log.Fatal(err)
 	}
 	log.Fatal(srv.ListenHTTP(cfg.Listen.HTTP))
 }
--- a/configs/shard.test.yaml
+++ b/configs/shard.test.yaml
@@ -0,0 +1,69 @@
 shard_id: "gc-test-001"
 listen:
  http: "0.0.0.0:9080"      # API for testers
  https: ""                 # if you terminate TLS at a proxy, leave empty
  ws:   "0.0.0.0:9081"      # reserved
 tls:
  enable: false             # set true only if serving HTTPS directly here
  cert_file: "/etc/greencoast/tls/cert.pem"
  key_file: "/etc/greencoast/tls/key.pem"
 federation:
  mtls_enable: false
  listen: "0.0.0.0:9443"
  cert_file: "/etc/greencoast/fed/cert.pem"
  key_file: "/etc/greencoast/fed/key.pem"
  client_ca_file: "/etc/greencoast/fed/clients_ca.pem"
 ui:
  enable: true
  path: "./client"
  base_url: "/"
  frontend_http: "0.0.0.0:9082"   # static client for testers
 storage:
  backend: "fs"
  path: "/var/lib/greencoast/objects"
  max_object_kb: 128              # lower if you want to constrain uploads
 security:
  zero_trust: true
  require_mtls_for_federation: true
  accept_client_signed_tokens: true
  log_level: "warn"
 privacy:
  retain_ip: "no"
  retain_user_agent: "no"
  retain_timestamps: "coarse"
 auth:
  # IMPORTANT: rotate this per environment (use `openssl rand -hex 32`)
  signing_secret: "D941C4F91D0046D28CDBC3F425DE0B4EA26BD2A80434E0F160D1B7C813EB43F8"
  sso:
    discord:
      enabled: true
      client_id: "1408292766319906946"
      client_secret: "zJ6GnUUykHbMFbWsPPneNxNK-PtOXYg1"
      # must exactly match your Discord app's allowed redirect
      redirect_uri: "https://greencoast.fullmooncyberworks.com/auth-callback.html"
    google:
      enabled: false
      client_id: ""
      client_secret: ""
      redirect_uri: ""
    facebook:
      enabled: false
      client_id: ""
      client_secret: ""
      redirect_uri: ""
  two_factor:
    webauthn_enabled: false
    totp_enabled: false
 limits:
  rate:
    burst: 20
    per_minute: 60            # slightly tighter for external testing
--- a/docker-compose.test.yml
+++ b/docker-compose.test.yml
@@ -0,0 +1,26 @@
 version: "3.9"
 services:
  shard-test:
    build: .
    container_name: greencoast-shard-test
    restart: unless-stopped
    user: "0:0"
    # These ports are optional (useful for local debug). Tunnel doesn't need them.
    ports:
      - "9080:9080"   # API
      - "9082:9082"   # Frontend
    environment:
      - GC_DEV_ALLOW_UNAUTH=true
      - GC_SIGNING_SECRET_HEX=92650f92d67d55368c852713a5007b90d933bff507bc77c980de7bf5442844ca
    volumes:
      - ./testdata:/var/lib/greencoast
      - ./configs/shard.test.yaml:/app/shard.yaml:ro
      - ./client:/app/client:ro
  cloudflared:
    image: cloudflare/cloudflared:latest
    command: tunnel --no-autoupdate run --token ${CF_TUNNEL_TOKEN}
    restart: unless-stopped
    depends_on:
      - shard-test
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -11,6 +11,7 @@ services:
      - "8081:8081"
    environment:
      - GC_DEV_ALLOW_UNAUTH=false
      - GC_SIGNING_SECRET_HEX=92650f92d67d55368c852713a5007b90d933bff507bc77c980de7bf5442844ca
    volumes:
      - gc_data:/var/lib/greencoast
      - ./configs/shard.sample.yaml:/app/shard.yaml:ro
--- a/internal/api/http.go
+++ b/internal/api/http.go
--- a/internal/api/ratelimit.go
+++ b/internal/api/ratelimit.go
@@ -0,0 +1,72 @@
 package api
 import (
 	"sync"
 	"time"
 )
 // Simple token-bucket rate limiter used by Server.cors middleware.
 type tokenBucket struct {
 	tokens   float64
 	lastFill time.Time
 }
 type rateLimiter struct {
 	rate     float64 // tokens per second
 	burst    float64
 	mu       sync.Mutex
 	bk       map[string]*tokenBucket
 	evictDur time.Duration
 	lastGC   time.Time
 }
 func newRateLimiter(rate float64, burst int, evict time.Duration) *rateLimiter {
 	return &rateLimiter{
 		rate:     rate,
 		burst:    float64(burst),
 		bk:       make(map[string]*tokenBucket),
 		evictDur: evict,
 		lastGC:   time.Now(),
 	}
 }
 func (rl *rateLimiter) allow(key string) bool {
 	now := time.Now()
 	rl.mu.Lock()
 	defer rl.mu.Unlock()
 	// GC old buckets occasionally
 	if now.Sub(rl.lastGC) > rl.evictDur {
 		for k, b := range rl.bk {
 			if now.Sub(b.lastFill) > rl.evictDur {
 				delete(rl.bk, k)
 			}
 		}
 		rl.lastGC = now
 	}
 	b, ok := rl.bk[key]
 	if !ok {
 		b = &tokenBucket{tokens: rl.burst, lastFill: now}
 		rl.bk[key] = b
 	}
 	// Refill
 	elapsed := now.Sub(b.lastFill).Seconds()
 	b.tokens = minf(rl.burst, b.tokens+elapsed*rl.rate)
 	b.lastFill = now
 	if b.tokens >= 1.0 {
 		b.tokens -= 1.0
 		return true
 	}
 	return false
 }
 func minf(a, b float64) float64 {
 	if a < b {
 		return a
 	}
 	return b
 }
--- a/internal/api/static.go
+++ b/internal/api/static.go
@@ -1,71 +1,29 @@
 package api
 import (
 	"log"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 )
-// Mount static on the API mux (kept for compatibility; still serves under API port if you want)
+// secureHeaders adds strict, privacy-preserving headers to static responses.
-func (s *Server) MountStatic(dir string, baseURL string) {
+func (s *Server) secureHeaders(next http.Handler) http.Handler {
 	if dir == "" {
 		return
 	}
 	if baseURL == "" {
 		baseURL = "/"
 	}
 	s.mux.Handle(baseURL, s.staticHandler(dir, baseURL))
 	if !strings.HasSuffix(baseURL, "/") {
 		s.mux.Handle(baseURL+"/", s.staticHandler(dir, baseURL))
 	}
 }
 // NEW: serve the same static handler on its own port (frontend).
 func (s *Server) ListenFrontendHTTP(addr, dir, baseURL string) error {
 	if dir == "" || addr == "" {
 		return nil
 	}
 	log.Printf("frontend listening on %s (dir=%s base=%s)", addr, dir, baseURL)
 	mx := http.NewServeMux()
 	mx.Handle(baseURL, s.staticHandler(dir, baseURL))
 	if !strings.HasSuffix(baseURL, "/") {
 		mx.Handle(baseURL+"/", s.staticHandler(dir, baseURL))
 	}
 	server := &http.Server{
 		Addr:              addr,
 		Handler:           mx,
 		ReadHeaderTimeout: 5 * time.Second,
 	}
 	return server.ListenAndServe()
 }
 func (s *Server) staticHandler(dir, baseURL string) http.Handler {
 	if baseURL == "" {
 		baseURL = "/"
 	}
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		s.secureHeaders(w)
+		w.Header().Set("Referrer-Policy", "no-referrer")
-		up := strings.TrimPrefix(r.URL.Path, baseURL)
+		w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
-		if up == "" || strings.HasSuffix(r.URL.Path, "/") {
+		w.Header().Set("Cross-Origin-Resource-Policy", "same-site")
-			up = "index.html"
+		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), interest-cohort=(), browsing-topics=()")
-		}
+		w.Header().Set("X-Frame-Options", "DENY")
-		full := filepath.Join(dir, filepath.FromSlash(up))
+		w.Header().Set("X-Content-Type-Options", "nosniff")
-		if !strings.HasPrefix(filepath.Clean(full), filepath.Clean(dir)) {
+		w.Header().Set("Strict-Transport-Security", "max-age=15552000; includeSubDomains; preload")
-			http.NotFound(w, r)
+		next.ServeHTTP(w, r)
 			return
 		}
 		if st, err := os.Stat(full); err == nil && !st.IsDir() {
 			http.ServeFile(w, r, full)
 			return
 		}
 		fallback := filepath.Join(dir, "index.html")
 		if _, err := os.Stat(fallback); err == nil {
 			http.ServeFile(w, r, fallback)
 			return
 		}
 		http.NotFound(w, r)
 	})
 }
 // MountStatic mounts a static file server under a prefix onto the provided mux.
 // Usage (from main): s.MountStatic(mux, "/", http.Dir(staticDir))
 func (s *Server) MountStatic(mux *http.ServeMux, prefix string, fs http.FileSystem) {
 	if prefix == "" {
 		prefix = "/"
 	}
 	h := http.StripPrefix(prefix, http.FileServer(fs))
 	mux.Handle(prefix, s.secureHeaders(h))
 }
--- a/internal/auth/gc2.go
+++ b/internal/auth/gc2.go
@@ -0,0 +1,78 @@
 package auth
 import (
 	"crypto/hmac"
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"strings"
 	"time"
 )
 type Claims struct {
 	Sub string `json:"sub"`           // account ID (acc_…)
 	Exp int64  `json:"exp"`           // unix seconds
 	Nbf int64  `json:"nbf,omitempty"` // not before
 	Iss string `json:"iss,omitempty"` // greencoast
 	Aud string `json:"aud,omitempty"` // api
 	Jti string `json:"jti,omitempty"` // token id (optional)
 	CNF string `json:"cnf,omitempty"` // key binding: "p256:<b64raw>" or "ed25519:<b64raw>"
 }
 func MintGC2(signKey []byte, c Claims) (string, error) {
 	if len(signKey) == 0 {
 		return "", errors.New("sign key missing")
 	}
 	if c.Sub == "" || c.Exp == 0 {
 		return "", errors.New("claims incomplete")
 	}
 	body, _ := json.Marshal(c)
 	mac := hmac.New(sha256.New, signKey)
 	mac.Write(body)
 	sig := mac.Sum(nil)
 	return "gc2." + base64.RawURLEncoding.EncodeToString(body) + "." + base64.RawURLEncoding.EncodeToString(sig), nil
 }
 func VerifyGC2(signKey []byte, tok string, now time.Time) (Claims, error) {
 	var zero Claims
 	if !strings.HasPrefix(tok, "gc2.") {
 		return zero, errors.New("bad prefix")
 	}
 	parts := strings.Split(tok, ".")
 	if len(parts) != 3 {
 		return zero, errors.New("bad parts")
 	}
 	body, err := base64.RawURLEncoding.DecodeString(parts[1])
 	if err != nil {
 		return zero, err
 	}
 	want, err := base64.RawURLEncoding.DecodeString(parts[2])
 	if err != nil {
 		return zero, err
 	}
 	mac := hmac.New(sha256.New, signKey)
 	mac.Write(body)
 	if !hmac.Equal(want, mac.Sum(nil)) {
 		return zero, errors.New("bad sig")
 	}
 	var c Claims
 	if err := json.Unmarshal(body, &c); err != nil {
 		return zero, err
 	}
 	t := now.Unix()
 	if c.Nbf != 0 && t < c.Nbf {
 		return zero, errors.New("nbf")
 	}
 	if t > c.Exp {
 		return zero, errors.New("expired")
 	}
 	return c, nil
 }
 func AccountIDFromPub(raw []byte) string {
 	// acc_<first32 hex of sha256(pub)>
 	sum := sha256.Sum256(raw)
 	return "acc_" + hex.EncodeToString(sum[:16])
 }
--- a/internal/index/index.go
+++ b/internal/index/index.go
@@ -1,123 +1,49 @@
 package index
 import (
 	"bufio"
 	"encoding/json"
 	"os"
 	"path/filepath"
 	"sort"
 	"sync"
 	"time"
 )
-type opType string
+// Entry is the index record returned to clients.
-
+// Keep metadata minimal to protect users.
 const (
 	OpPut opType = "put"
 	OpDel opType = "del"
 )
 type record struct {
 	Op       opType    `json:"op"`
 	Hash     string    `json:"hash"`
 	Bytes    int64     `json:"bytes,omitempty"`
 	StoredAt time.Time `json:"stored_at,omitempty"`
 	Private  bool      `json:"private,omitempty"`
 }
 type Entry struct {
 	Hash      string `json:"hash"`
 	Bytes     int64  `json:"bytes"`
-	StoredAt time.Time `json:"stored_at"`
+	StoredAt  string `json:"stored_at"` // RFC3339Nano string
 	Private   bool   `json:"private"`
 	CreatorTZ string `json:"creator_tz,omitempty"`
 	Author    string `json:"author,omitempty"` // pseudonymous (thumbprint), optional
 }
 type Index struct {
-	path string
+	mu   sync.RWMutex
-	mu   sync.Mutex
+	data map[string]Entry
 }
-func New(baseDir string) *Index {
+func New() *Index {
-	return &Index{path: filepath.Join(baseDir, "index.jsonl")}
+	return &Index{data: make(map[string]Entry)}
 }
-func (i *Index) AppendPut(e Entry) error {
+func (ix *Index) Put(e Entry) error {
-	i.mu.Lock()
+	ix.mu.Lock()
-	defer i.mu.Unlock()
+	ix.data[e.Hash] = e
-	return appendRec(i.path, record{
+	ix.mu.Unlock()
-		Op:       OpPut,
+	return nil
 		Hash:     e.Hash,
 		Bytes:    e.Bytes,
 		StoredAt: e.StoredAt,
 		Private:  e.Private,
 	})
 }
-func (i *Index) AppendDelete(hash string) error {
+func (ix *Index) Delete(hash string) error {
-	i.mu.Lock()
+	ix.mu.Lock()
-	defer i.mu.Unlock()
+	delete(ix.data, hash)
-	return appendRec(i.path, record{Op: OpDel, Hash: hash})
+	ix.mu.Unlock()
 	return nil
 }
-func appendRec(path string, r record) error {
+func (ix *Index) All() []Entry {
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	ix.mu.RLock()
-		return err
+	out := make([]Entry, 0, len(ix.data))
 	for _, e := range ix.data {
 		out = append(out, e)
 	}
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
+	ix.mu.RUnlock()
-	if err != nil {
+	return out
 		return err
 	}
 	defer f.Close()
 	enc := json.NewEncoder(f)
 	return enc.Encode(r)
 }
 func (i *Index) Snapshot() ([]Entry, error) {
 	i.mu.Lock()
 	defer i.mu.Unlock()
 	f, err := os.Open(i.path)
 	if os.IsNotExist(err) {
 		return nil, nil
 	}
 	if err != nil {
 		return nil, err
 	}
 	defer f.Close()
 	sc := bufio.NewScanner(f)
 	sc.Buffer(make([]byte, 0, 64*1024), 4*1024*1024)
 	type state struct {
 		Entry   Entry
 		Deleted bool
 	}
 	m := make(map[string]state)
 	for sc.Scan() {
 		var rec record
 		if err := json.Unmarshal(sc.Bytes(), &rec); err != nil {
 			continue
 		}
 		switch rec.Op {
 		case OpPut:
 			m[rec.Hash] = state{Entry: Entry{
 				Hash: rec.Hash, Bytes: rec.Bytes, StoredAt: rec.StoredAt, Private: rec.Private,
 			}}
 		case OpDel:
 			s := m[rec.Hash]
 			s.Deleted = true
 			m[rec.Hash] = s
 		}
 	}
 	if err := sc.Err(); err != nil {
 		return nil, err
 	}
 	var out []Entry
 	for _, s := range m {
 		if !s.Deleted && s.Entry.Hash != "" {
 			out = append(out, s.Entry)
 		}
 	}
 	sort.Slice(out, func(i, j int) bool { return out[i].StoredAt.After(out[j].StoredAt) })
 	return out, nil
 }
--- a/internal/storage/fs.go
+++ b/internal/storage/fs.go
@@ -0,0 +1,240 @@
 package storage
 import (
 	"errors"
 	"io"
 	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 )
 type FSStore struct {
 	root    string
 	objects string
 }
 func NewFS(dir string) (*FSStore, error) {
 	if dir == "" {
 		return nil, errors.New("empty storage dir")
 	}
 	o := filepath.Join(dir, "objects")
 	if err := os.MkdirAll(o, 0o755); err != nil {
 		return nil, err
 	}
 	return &FSStore{root: dir, objects: o}, nil
 }
 func (s *FSStore) pathFlat(hash string) (string, error) {
 	if hash == "" {
 		return "", errors.New("empty hash")
 	}
 	return filepath.Join(s.objects, hash), nil
 }
 func isHexHash(name string) bool {
 	if len(name) != 64 {
 		return false
 	}
 	for i := 0; i < 64; i++ {
 		c := name[i]
 		if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')) {
 			return false
 		}
 	}
 	return true
 }
 func (s *FSStore) findBlobPath(hash string) (string, error) {
 	if hash == "" {
 		return "", errors.New("empty hash")
 	}
 	// 1) flat
 	if p, _ := s.pathFlat(hash); fileExists(p) {
 		return p, nil
 	}
 	// 2) objects/<hash>/{blob,data,content}
 	dir := filepath.Join(s.objects, hash)
 	for _, cand := range []string{"blob", "data", "content"} {
 		p := filepath.Join(dir, cand)
 		if fileExists(p) {
 			return p, nil
 		}
 	}
 	// 3) objects/<hash>/<single file>
 	if st, err := os.Stat(dir); err == nil && st.IsDir() {
 		ents, _ := os.ReadDir(dir)
 		var picked string
 		var pickedMod time.Time
 		for _, de := range ents {
 			if de.IsDir() {
 				continue
 			}
 			p := filepath.Join(dir, de.Name())
 			fi, err := os.Stat(p)
 			if err == nil && fi.Mode().IsRegular() {
 				if picked == "" || fi.ModTime().After(pickedMod) {
 					picked, pickedMod = p, fi.ModTime()
 				}
 			}
 		}
 		if picked != "" {
 			return picked, nil
 		}
 	}
 	// 4) two-level prefix objects/aa/<hash>
 	if len(hash) >= 2 {
 		p := filepath.Join(s.objects, hash[:2], hash)
 		if fileExists(p) {
 			return p, nil
 		}
 	}
 	// 5) recursive search
 	var best string
 	var bestMod time.Time
 	_ = filepath.WalkDir(s.objects, func(p string, d fs.DirEntry, err error) error {
 		if err != nil || d.IsDir() {
 			return nil
 		}
 		base := filepath.Base(p)
 		if base == hash {
 			best = p
 			return fs.SkipDir
 		}
 		parent := filepath.Base(filepath.Dir(p))
 		if parent == hash {
 			if fi, err := os.Stat(p); err == nil && fi.Mode().IsRegular() {
 				if best == "" || fi.ModTime().After(bestMod) {
 					best, bestMod = p, fi.ModTime()
 				}
 			}
 		}
 		return nil
 	})
 	if best != "" {
 		return best, nil
 	}
 	return "", os.ErrNotExist
 }
 func fileExists(p string) bool {
 	fi, err := os.Stat(p)
 	return err == nil && fi.Mode().IsRegular()
 }
 func (s *FSStore) Put(hash string, r io.Reader) error {
 	p, err := s.pathFlat(hash)
 	if err != nil {
 		return err
 	}
 	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
 		return err
 	}
 	tmp := p + ".tmp"
 	f, err := os.Create(tmp)
 	if err != nil {
 		return err
 	}
 	_, werr := io.Copy(f, r)
 	cerr := f.Close()
 	if werr != nil {
 		_ = os.Remove(tmp)
 		return werr
 	}
 	if cerr != nil {
 		_ = os.Remove(tmp)
 		return cerr
 	}
 	return os.Rename(tmp, p)
 }
 func (s *FSStore) Get(hash string) (io.ReadCloser, int64, error) {
 	p, err := s.findBlobPath(hash)
 	if err != nil {
 		return nil, 0, err
 	}
 	f, err := os.Open(p)
 	if err != nil {
 		return nil, 0, err
 	}
 	st, err := f.Stat()
 	if err != nil {
 		return f, 0, nil
 	}
 	return f, st.Size(), nil
 }
 func (s *FSStore) Delete(hash string) error {
 	if p, _ := s.pathFlat(hash); fileExists(p) {
 		if err := os.Remove(p); err == nil || errors.Is(err, os.ErrNotExist) {
 			return nil
 		}
 	}
 	dir := filepath.Join(s.objects, hash)
 	for _, cand := range []string{"blob", "data", "content"} {
 		p := filepath.Join(dir, cand)
 		if fileExists(p) {
 			if err := os.Remove(p); err == nil || errors.Is(err, os.ErrNotExist) {
 				return nil
 			}
 		}
 	}
 	if len(hash) >= 2 {
 		p := filepath.Join(s.objects, hash[:2], hash)
 		if fileExists(p) {
 			if err := os.Remove(p); err == nil || errors.Is(err, os.ErrNotExist) {
 				return nil
 			}
 		}
 	}
 	if p, err := s.findBlobPath(hash); err == nil {
 		if err := os.Remove(p); err == nil || errors.Is(err, os.ErrNotExist) {
 			return nil
 		}
 	}
 	return nil
 }
 func (s *FSStore) Walk(fn func(hash string, size int64, mod time.Time) error) error {
 	type rec struct {
 		size int64
 		mod  time.Time
 	}
 	agg := make(map[string]rec)
 	_ = filepath.WalkDir(s.objects, func(p string, d fs.DirEntry, err error) error {
 		if err != nil || d.IsDir() {
 			return nil
 		}
 		fi, err := os.Stat(p)
 		if err != nil || !fi.Mode().IsRegular() {
 			return nil
 		}
 		base := filepath.Base(p)
 		if isHexHash(base) {
 			if r, ok := agg[base]; !ok || fi.ModTime().After(r.mod) {
 				agg[base] = rec{fi.Size(), fi.ModTime()}
 			}
 			return nil
 		}
 		parent := filepath.Base(filepath.Dir(p))
 		if isHexHash(parent) {
 			if r, ok := agg[parent]; !ok || fi.ModTime().After(r.mod) {
 				agg[parent] = rec{fi.Size(), fi.ModTime()}
 			}
 			return nil
 		}
 		if len(base) == 64 && isHexHash(strings.ToLower(base)) {
 			if r, ok := agg[base]; !ok || fi.ModTime().After(r.mod) {
 				agg[base] = rec{fi.Size(), fi.ModTime()}
 			}
 		}
 		return nil
 	})
 	for h, r := range agg {
 		if err := fn(h, r.size, r.mod); err != nil {
 			return err
 		}
 	}
 	return nil
 }
--- a/internal/storage/fsstore.go
+++ b/internal/storage/fsstore.go
@@ -1,95 +0,0 @@
 package storage
 import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
 	"io"
 	"os"
 	"path/filepath"
 )
 type FSStore struct {
 	root       string
 	maxObjectB int64
 }
 func NewFSStore(root string, maxKB int) (*FSStore, error) {
 	if root == "" {
 		root = "./data/objects"
 	}
 	if err := os.MkdirAll(root, 0o755); err != nil {
 		return nil, err
 	}
 	return &FSStore{root: root, maxObjectB: int64(maxKB) * 1024}, nil
 }
 func (s *FSStore) Put(r io.Reader) (string, int64, error) {
 	h := sha256.New()
 	tmp := filepath.Join(s.root, ".tmp")
 	_ = os.MkdirAll(tmp, 0o755)
 	f, err := os.CreateTemp(tmp, "obj-*")
 	if err != nil {
 		return "", 0, err
 	}
 	defer f.Close()
 	var n int64
 	buf := make([]byte, 32*1024)
 	for {
 		m, er := r.Read(buf)
 		if m > 0 {
 			n += int64(m)
 			if s.maxObjectB > 0 && n > s.maxObjectB {
 				return "", 0, errors.New("object too large")
 			}
 			_, _ = h.Write(buf[:m])
 			if _, werr := f.Write(buf[:m]); werr != nil {
 				return "", 0, werr
 			}
 		}
 		if er == io.EOF {
 			break
 		}
 		if er != nil {
 			return "", 0, er
 		}
 	}
 	sum := hex.EncodeToString(h.Sum(nil))
 	dst := filepath.Join(s.root, sum[:2], sum[2:4], sum)
 	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
 		return "", 0, err
 	}
 	if err := os.Rename(f.Name(), dst); err != nil {
 		return "", 0, err
 	}
 	return sum, n, nil
 }
 func (s *FSStore) pathFor(hash string) string {
 	return filepath.Join(s.root, hash[:2], hash[2:4], hash)
 }
 func (s *FSStore) Get(hash string) (string, error) {
 	if len(hash) < 4 {
 		return "", os.ErrNotExist
 	}
 	p := s.pathFor(hash)
 	if _, err := os.Stat(p); err != nil {
 		return "", err
 	}
 	return p, nil
 }
 func (s *FSStore) Delete(hash string) error {
 	if len(hash) < 4 {
 		return os.ErrNotExist
 	}
 	p := s.pathFor(hash)
 	if err := os.Remove(p); err != nil {
 		return err
 	}
 	_ = os.Remove(filepath.Dir(p))
 	_ = os.Remove(filepath.Dir(filepath.Dir(p)))
 	return nil
 }
--- a/testdata/index.jsonl
+++ b/testdata/index.jsonl
@@ -0,0 +1,4 @@
 {"op":"put","hash":"a008a13ade86edbd77f5c0fcfcf35bd295c93069be42fdbd46bc65b392ddf5fb","bytes":110,"stored_at":"2025-08-22T03:00:00Z"}
 {"op":"put","hash":"9628e2adcd7a5e820fbdbe075027ac0ad78ef1a7a501971c2048bc5e5436b891","bytes":105,"stored_at":"2025-08-22T03:00:00Z","private":true}
 {"op":"put","hash":"6a166437b9988bd11e911375f3ca1b4cd10b7db9a32812409c6d79a0753dd973","bytes":98,"stored_at":"2025-08-22T03:00:00Z"}
 {"op":"put","hash":"f452402fadb6608bd6f9b613a1d58234e2135f045ea29262574e3e4b1e5f7292","bytes":46,"stored_at":"2025-08-22T03:00:00Z"}
Author	SHA1	Message	Date
Dani	fec7535c40	Added a more user friendly legalese pages	2025-08-22 20:14:45 -04:00
Dani	0bf00e3f00	Added avatars to make it a bit more friendly	2025-08-22 19:35:00 -04:00
Dani	5dfc710ae9	Added panic mode protections to make the server more secure	2025-08-22 18:54:10 -04:00
Dani	5067913c21	Fixed the device sign	2025-08-22 18:24:24 -04:00
Dani	b9fad16fa2	Removed Test Data from the git	2025-08-22 12:42:22 -04:00
Dani	0ff358552c	Finished updating the readme	2025-08-22 12:40:09 -04:00
Dani	720c7e0b52	Updated the README Added new security layers	2025-08-22 12:39:51 -04:00
Dani	fb7428064f	Fixed the Discord SSO somewhat Fixed FS system Added TZ options	2025-08-22 12:00:58 -04:00
Dani	7ff3f43c93	Troubleshooting the cloudflare and the api not communicating	2025-08-21 22:57:48 -04:00
Dani	82eed71d7e	Doing some testing to make sure that Cloudflare works with the app	2025-08-21 22:24:50 -04:00