From cb019afecf46bad03dac47487689be30a94f63de Mon Sep 17 00:00:00 2001 From: ed Date: Mon, 28 Jul 2025 20:29:40 +0000 Subject: [PATCH] standardize on /dev/shm/party.sock; closes #229 --- README.md | 2 +- copyparty/__main__.py | 13 +++++++------ 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index f106ef80..eee9ec9c 100644 --- a/README.md +++ b/README.md @@ -2027,7 +2027,7 @@ some reverse proxies (such as [Caddy](https://caddyserver.com/)) can automatical * **warning:** nginx-QUIC (HTTP/3) is still experimental and can make uploads much slower, so HTTP/1.1 is recommended for now * depending on server/client, HTTP/1.1 can also be 5x faster than HTTP/2 -for improved security (and a 10% performance boost) consider listening on a unix-socket with `-i unix:770:www:/tmp/party.sock` (permission `770` means only members of group `www` can access it) +for improved security (and a 10% performance boost) consider listening on a unix-socket with `-i unix:770:www:/dev/shm/party.sock` (permission `770` means only members of group `www` can access it) example webserver / reverse-proxy configs: diff --git a/copyparty/__main__.py b/copyparty/__main__.py index 8aef06df..03e01883 100644 --- a/copyparty/__main__.py +++ b/copyparty/__main__.py @@ -547,14 +547,15 @@ def get_sects(): when running behind a reverse-proxy, it's recommended to use unix-sockets for improved performance and security; - \033[32m-i unix:770:www:\033[33m/tmp/a.sock\033[0m listens on \033[33m/tmp/a.sock\033[0m with - permissions \033[33m0770\033[0m; only accessible to members of the \033[33mwww\033[0m - group. This is the best approach. Alternatively, + \033[32m-i unix:770:www:\033[33m/dev/shm/party.sock\033[0m listens on + \033[33m/dev/shm/party.sock\033[0m with permissions \033[33m0770\033[0m; + only accessible to members of the \033[33mwww\033[0m group. + This is the best approach. Alternatively, - \033[32m-i unix:777:\033[33m/tmp/a.sock\033[0m sets perms \033[33m0777\033[0m so anyone can - access it; bad unless it's inside a restricted folder + \033[32m-i unix:777:\033[33m/dev/shm/party.sock\033[0m sets perms \033[33m0777\033[0m so anyone + can access it; bad unless it's inside a restricted folder - \033[32m-i unix:\033[33m/tmp/a.sock\033[0m keeps umask-defined permissions + \033[32m-i unix:\033[33m/dev/shm/party.sock\033[0m keeps umask-defined permission (usually \033[33m0600\033[0m) and the same user/group as copyparty \033[33m-p\033[0m (tcp ports) is ignored for unix sockets