Mysteryshack is a lightweight, yet self-contained remoteStorage-server.
This project is still in active development. Do not use with sensitive data, or without backup.
demo and password
demo on my
server to try it out. Don't use that account
for actual data though: It is reset daily.
You need OpenSSL installed.
- Install Rust and Cargo.
- Clone this repository.
./target/release/mysteryshackinto your PATH.
config.exampleand save it as
mysteryshack user create footo create a new user called
mysteryshack serveto run the server as configured in
For advanced usage, see
mysteryshack --help and
mysteryshack user --help.
git pull and
OS X and OpenSSL
As of OS X 10.11, OpenSSL isn't installed anymore. You'll need to install it manually:
brew install openssl brew link --force openssl
Mysteryshack mostly implements
it sends two kinds of webfinger responses to stay compatible with
client_idis ignored, Origin of
redirect_uriis used for app identification.
Mysteryshack is set up to be tested against the official api test suite automatically (in Travis).
Mysteryshack's approach to concurrency is very simplistic. Only storage operations are safe to perform concurrently. User creation and deletion, app authorization and de-authorization are not, because it is assumed that the user performing those operations is a single human with only two hands and one keyboard.
Web admin sessions are stored inside signed cookies. The key is generated at server startup. To log everybody out, restart the server.
OAuth tokens are JSON signed with a per-user key. The server stores a list of
client_ids the user has authorized, and checks if the token's
client_idclaim is found in that list.
Mysteryshack violates the WebFinger RFC by returning bogus information for nonexistent accounts. This is done to prevent account enumeration.