Harden Stork for public demo and family durability

Read-only demo boards, per-IP rate limits, opaque voter sessions, session leave, upload sniffing, path containment, and retire /v1.
2026-08-07 20:55:21 -04:00
parent da0419d9d3
commit 480e5b6ce6
10 changed files with 414 additions and 105 deletions
@@ -5,3 +5,9 @@ STORK_ADMIN_TOKEN=change-me-admin-random
 STORK_COOKIE_SECURE=false
 STORK_DATA=./data
 # STORK_PUBLIC_URL=https://stork.levkin.ca
+# Comma-separated board ids that reject member mutations (public demo).
+# STORK_READONLY_BOARD_IDS=b_gS0LlZHm-lk
+# Optional rate-limit overrides (per IP / hour):
+# STORK_RL_BOARDS_PER_HOUR=5
+# STORK_RL_SESSIONS_PER_HOUR=60
+# STORK_RL_UPLOADS_PER_HOUR=30