readme update
MREADME.md
@@ -5,14 +5,14 @@ A `Containerfile` and `compose.yml` is provided in this repo, just run `docker-c
## Configuration
ZBin is configured through environment variables (all optional):
| Variable | Default | Description |
| --- | --- | --- |
| `MAX_UPLOAD_BYTES` | `104857600` (100 MiB) | Hard cap on a single upload. |
| `MAX_TOTAL_BYTES` | unlimited | Cap on total stored content across all files. When set, an upload that would push the total over the cap is rejected (`507`). |
| `MAX_AGE_MINUTES` | unlimited | Maximum retention. When set, every upload is deleted after at most this many minutes (a longer requested `delete_in_minutes` is clamped down). |
| `UPLOAD_COOLDOWN_SECONDS` | `0` (off) | Minimum seconds between uploads from the same client IP. |
| `DECRYPT_COOLDOWN_SECONDS` | `0` (off) | Minimum seconds between server-side decryption attempts from the same client IP. Bounds the PBKDF2 CPU cost an attacker who knows a file's URL can force by repeatedly requesting it with password cookies. |
| `BEHIND_PROXY` | `false` | Set to `true` (or `1`) when running behind a trusted TLS-terminating reverse proxy (the usual production setup). Reads `X-Forwarded-For` / `X-Real-IP` for the client IP **and** adds the `Secure` flag to the password cookie. Leave off for direct/local HTTP. |
| Variable | Default | Description |
|----------------------------|-----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `MAX_UPLOAD_BYTES` | `104857600` (100 MiB) | Hard cap on a single upload. |
| `MAX_TOTAL_BYTES` | unlimited | Cap on total stored content across all files. When set, an upload that would push the total over the cap is rejected (`507`). |
| `MAX_AGE_MINUTES` | unlimited | Maximum retention. When set, every upload is deleted after at most this many minutes (a longer requested `delete_in_minutes` is clamped down). |
| `UPLOAD_COOLDOWN_SECONDS` | `0` (off) | Minimum seconds between uploads from the same client IP. |
| `DECRYPT_COOLDOWN_SECONDS` | `0` (off) | Minimum seconds between server-side decryption attempts from the same client IP. Bounds the PBKDF2 CPU cost an attacker who knows a file's URL can force by repeatedly requesting it with password cookies. |
| `BEHIND_PROXY` | `false` | Set to `true` (or `1`) when running behind a trusted TLS-terminating reverse proxy (the usual production setup). Reads `X-Forwarded-For` / `X-Real-IP` for the client IP **and** adds the `Secure` flag to the password cookie. Leave off for direct/local HTTP. |
> Passwords for server-side decryption travel in a cookie, so ZBin should always be
> served over HTTPS behind a reverse proxy (with `BEHIND_PROXY=true`) in any real deployment.
