{"id":16154442,"url":"https://github.com/giansalex/padlock-cloud-pg","last_synced_at":"2026-05-02T02:40:14.517Z","repository":{"id":90163430,"uuid":"195328174","full_name":"giansalex/padlock-cloud-pg","owner":"giansalex","description":"Web service for storing Padlock data in the cloud (Postgresql Database)","archived":false,"fork":false,"pushed_at":"2019-07-05T04:15:10.000Z","size":1404,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-13T05:43:53.589Z","etag":null,"topics":["docker","heroku","padlock"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/giansalex.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-07-05T02:49:19.000Z","updated_at":"2019-07-05T04:18:40.000Z","dependencies_parsed_at":"2023-07-12T09:32:00.107Z","dependency_job_id":null,"html_url":"https://github.com/giansalex/padlock-cloud-pg","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/giansalex%2Fpadlock-cloud-pg","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/giansalex%2Fpadlock-cloud-pg/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/giansalex%2Fpadlock-cloud-pg/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/giansalex%2Fpadlock-cloud-pg/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/giansalex","download_url":"https://codeload.github.com/giansalex/padlock-cloud-pg/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247569130,"owners_count":20959758,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","heroku","padlock"],"created_at":"2024-10-10T01:17:26.234Z","updated_at":"2026-05-02T02:40:14.470Z","avatar_url":"https://github.com/giansalex.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Padlock Cloud (Postgresql)\n\n## What is Padlock Cloud\n\nPadlock Cloud is a cloud storage service for the\n[Padlock app](https://github.com/padlock/padlock/) implemented in Go. It\nprovides a (mostly) RESTful api for storing and retrieving user data. Padlock\nCloud does NOT implement any kind of diffing algorithm, nor does it attempt to\nprovide any kind of cryptographic functionality. Any encryption, decryption and\ndata consolidation should happen on the client side. Padlock Cloud merely\nprovides a cloud-based storage for encrypted user data.\n\n## Usage\n\nThe `padlock-cloud` command provides commands for starting Padlock Cloud server\nand managing accounts. It can be configured through various flags and\nenvironment variables.\n\nNote that **global flags** have to be specified **before** the command and\n**command-specific** flags **after** the command but before any positional\narguments.\n\n```sh\npadlock-cloud [global options] command [command options] [arguments...]\n```\n\nFor a list of available commands and global options, run.\n\n```sh\npadlock-cloud --help\n```\n\nFor information about a specific command, including command-specific options,\nrun\n\n```sh\npadlock-cloud command --help\n```\n\n## Postgresql\n\nExecute `schema.sql` in your padlock database.\n\n## Commands\n\n### runserver\nStarts a Padlock Cloud server instance\n\n#### Environment Variables, Flags, Configuration File Variables\n| Environment Variable | Flag                   | Configuration File   | Description                                  |\n|----------------------|------------------------|----------------------|----------------------------------------------|\n| `PC_PORT`            | `--port` \u0026#124; `-p`   | `server.port`        | Port to listen on                            |\n| `PC_ASSETS_PATH`     | `--assets-path`        | `server.assets_path` | Path to assets directory                     |\n| `PC_TLS_CERT`        | `--tls-cert`           | `server.tls_cert`    | Path to TLS certification file               |\n| `PC_TLS_KEY`         | `--tls-key`            | `server.tls_key`     | Path to TLS key file                         |\n| `PC_BASE_URL`        | `--base-url`           | `server.base_url`    | Base url for constructing urls               |\n| `PC_CORS`            | `--cors`               | `server.cors`        | Enable Cross-Origin Resource Sharing         |\n| `PC_TEST`            | `--test`               |                      | Enable test mode                             |\n\n### accounts\nCommands for managing accounts.\n\n#### list\nList existing accounts.\n\n#### create\nCreate new account.\n\n#### display\nDisplay account.\n\n#### delete\nDelete account.\n\n### gensecret\nGenerate random 32 byte secret.\n\n## Configuration\nThis image provides multiple options to configure the application. \n\n### Precedence\nThe precedence for flag value sources is as follows (highest to lowest):\n\n1. Command line flag value from user\n2. Environment variable (if specified)\n3. Configuration file (if specified)\n4. Default defined on the flag\n\n### Environment Variables, Flags, Configuration File Variables\n\n| Environment Variable | Flag                   | Configuration File   | Description                                  |\n|----------------------|------------------------|----------------------|----------------------------------------------|\n| Global                                                                                                              |\n| `PC_CONFIG_PATH`     | `--config` \u0026#124; `-c` |                      | Path to configuration file.                  |\n| `PC_LOG_FILE`        | `--log-file`           | `log.log_file`       | Path to log file                             |\n| `PC_ERR_FILE`        | `--err-file`           | `log.err_file`       | Path to error log file                       |\n| `PC_NOTIFY_ERRORS`   | `--notify-errors`      | `log.notify_errors`  | Email address to send unexpected errors to   |\n| `PC_LEVELDB_PATH`    | `--db-path`            | `leveldb.path`       | Path to Postgresql database                     |\n| `PC_EMAIL_SERVER`    | `--email-server`       | `email.server`       | Mail server for sending emails               |\n| `PC_EMAIL_PORT`      | `--email-port`         | `email.port`         | Port to use with mail server                 |\n| `PC_EMAIL_USER`      | `--email-user`         | `email.user`         | Username for authentication with mail server |\n| `PC_EMAIL_PASSWORD`  | `--email-password`     | `email.password`     | Password for authentication with mail server |\n| Command: runserver                                                                                                  |\n| `PC_PORT`            | `--port` \u0026#124; `-p`   | `server.port`        | Port to listen on                            |\n| `PC_ASSETS_PATH`     | `--assets-path`        | `server.assets_path` | Path to assets directory                     |\n| `PC_TLS_CERT`        | `--tls-cert`           | `server.tls_cert`    | Path to TLS certification file               |\n| `PC_TLS_KEY`         | `--tls-key`            | `server.tls_key`     | Path to TLS key file                         |\n| `PC_BASE_URL`        | `--base-url`           | `server.base_url`    | Base url for constructing urls               |\n| `PC_CORS`            | `--cors`               | `server.cors`        | Enable Cross-Origin Resource Sharing         |\n| `PC_TEST`            | `--test`               |                      | Enable test mode                             |\n\n### Configuration File\n\nThe provided file should be in the\n[YAML format](http://yaml.org/). Here is an example configuration file:\n\n```yaml\nserver:\n  assets_path: assets\n  port: 5555\n  tls_cert: cert.crt\n  tls_key: cert.key\n  base_url: https://cloud.padlock.io\n  cors: false\nleveldb:\n  path: \"postgres://user:pass@localhost:5432/padlock?sslmode=require\u0026application_name=padlock_cloud\",\nemail:\n  server: smtp.gmail.com\n  port: \"587\"\n  user: mail_user\n  password: secret\n  from: mail@example.com\nlog:\n  log_file: LOG.txt\n  err_file: ERR.txt\n  notify_errors: admin@example.com\n```\n\n## Getting Started with Docker\n**NOTE**: As padlock is build upon chrome we need a valid certificate issued\nby a trusted source. For now let us assume we have a certificate named\n`cert.pem` and a key named `key.pem` in the directory `./ssl/`.\n\n**NOTE**: The email-settings can be found out by searching for \n`[email-provider] smtp login`.\n\n```sh\ndocker run -p 443:8443 -v ssl:/opt/padlock-cloud/ssl -e PC_PORT=8443 \\\n-e PC_BASE_URL=[base-url] -e PC_EMAIL_SERVER=smtp.googlemail.com \\\n-e PC_EMAIL_PORT=587 -e PC_EMAIL_USER=user@gmail.com \\\n-e PC_EMAIL_PASSWORD=userpassword1234 \\\n-e PC_TLS_CERT=/opt/padlock-cloud/ssl/cert.pem \\\n-e PC_TLS_KEY=/opt/padlock-cloud/ssl/key.pem padlock/padlock-cloud\n```\n\n### Usage with Docker\nThis image can be used like the cli. Just prepend `docker run`.\n\n### Volumes\n**NOTE**: This image uses a user `padlock-cloud` with uid `1000` and group \n`padlock-cloud` with gid `1000` to run padlock-cloud. You should check your \npermission before mounting a volume.  \n**NOTE**: This image will try to change the ownership of it's WORKDIR to \n`1000:1000`. This won't work when mounting a volume from Windows.  \n\nThis image contains 4 volumes.\n#### /opt/padlock-cloud/assets\nContains assets used by padlock-cloud to render the frontend and the emails.\n\n#### /opt/padlock-cloud/db\nContains the data stored in the cloud.\n\n#### /opt/padlock-cloud/logs\nContains the logs.\n\n#### /opt/padlock-cloud/ssl\nContains the certificate and key.\n\n### Bindings\nThis image exposes ports `8080` and `8443`, because this image uses a non-root\nuser. By default the padlock-cloud listens at port `8080`, because it doesn't\nuse SSL by default. It is highly suggested to provide a TLS-Certificate and\nKey to enable SSL and listen at `8443`. This could be done by setting `PC_PORT`\nto `8443`.\n\n### Security\nThis image uses a user `padlock-cloud` with uid `1000` and group \n`padlock-cloud` with gid `1000` to run padlock-cloud.  \n**It will try to change the ownership of your mounted volumes to \n`1000:1000`.**  \n\n## How to install/build\n\nFirst, you'll need to have [Go](https://golang.org/) installed on your system.\nThen simply run\n\n```sh\ngo get github.com/giansalex/padlock-cloud-pg\n```\n\nThis will download the source code into your `$GOPATH` and automatically build\nand install the `padlock-cloud` binary into `$GOPATH/bin`. Assuming you have\n`$GOPATH/bin` added to your path, you should be the be able to simply run the\n`padlock-cloud` command from anywhere.\n\n## Security Considerations\n\n### Running the server without TLS\n\nIt goes without saying that user data should **never** be transmitted over the\ninternet over a non-secure connection. If no `--tls-cert` and `--tls-key`\noptions are provided to the `runserver` command, the server will be addressable\nthrough plain http. You should make sure that in this case the server does\n**not** listen on a public port and that any reverse proxies that handle\noutgoing connections are protected via TLS.\n\n### Link spoofing and the --base-url option\n\nPadlock Cloud frequently uses confirmation links for things like activating\nauthentication tokens, confirmation for deleting an account etc. They usually\ncontain some sort of unique token. For example, the link for activating an\nauthentication token looks like this:\n\n```\nhttps://hostname:port/activate/?v=1\u0026t=cdB6iEdL4o5PfhLey30Rrg\n```\n\nThese links are sent out to a users email address and serve as a form of\nauthentication. Only users that actually have control over the email account\nassociated with their Padlock Cloud account may access the corresponding data.\n\nNow the `hostname` and `port` portion of the URL will obviously differ based on\nthe environment. By default, the app will simply use the value provided by the\n`Host` header of the incoming request. But the `Host` header can easily be\nfaked and unless the server is running behind a reverse proxy that sets it\nto the correct value, this opens the app up to a vulnerability we call 'link\nspoofing'. Let's say an attacker sends an authentication request to our server\nusing a targets email address, but changes the `Host` header to a server that\nhe or she controls. The email that is sent to the target will now contain a link that\npoints to the attacker's server instead of our own and once the user clicks the\nlink the attacker is in possession of the activation token which can in turn be\nused to activate the authentication token he or she already has.  There is a simple\nsolution for this: Explicitly provide a base URL to be used for constructing\nlinks when starting up the server. The `runserver` command provides the\n`--base-url` flag for this. It is recommended to use this option in production\nenvironments at all times!\n\n## Troubleshooting\n\n### Chrome app fails to connect to custom server\n\nWhen trying to connect to a custom server instance, the Chrome app fails with\nthe error message \"Failed to connect to Padlock Cloud. Please check your\ninternet and try again!\".  This is due to the same-origin policy in Chrome\npreventing requests to domains other than cloud.padlock.io that do not\nimplement [Cross-Origin Resource\nSharing](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS).\nWhile it's not enabled by default, Padlock Cloud does come with built-in CORS\nsupport. In order to enable it, simple use the `cors` option. E.g.:\n\n```sh\npadlock-cloud runserver --cors\n```\n\n**NOTE**: CORS is enabled by default when using the docker image.\n\n### Failed to load templates\n\n```sh\n2016/09/01 21:40:59 open some/path/activate-auth-token-email.txt: no such file or directory\n```\n\nThe Padlock Cloud server requires various assets like templates for rendering\nemails, web pages etc. These are included in this repository under the `assets`\nfolder. When you're running `padlock-cloud` you'll have to make sure that it\nknows where to find these assets. You can do this via the `--assets-path`\noption. By default, the server will look for the templates under\n`$GOPATH/src/github.com/giansalex/padlock-cloud-pg/assets/templates` which is\nwhere they will usually be if you installed `padlock-cloud` via `go get`.\n\n### Reference\n\n[Original Source](https://github.com/padlock/padlock-cloud/)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgiansalex%2Fpadlock-cloud-pg","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgiansalex%2Fpadlock-cloud-pg","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgiansalex%2Fpadlock-cloud-pg/lists"}