- Node.js/Express backend: upload, gallery, download, share links, OIDC PKCE auth, anonymous management tokens, expiry, cleanup
- Vanilla JS frontend: gallery, upload with progress, file preview (images/audio/video/PDF/text), OIDC login, owner actions
- SQLite metadata store (PVC with sqlite storage class)
- S3 storage (Bucket + Policy + S3User via s3.onyxia.sh CRDs)
- OIDCClient (codemowers.cloud/v1) with PKCE, no client secret, ingressRef
- Ingress with short hostname
filedrop(expanded by platform admission) - Skaffold config validated (v4beta11, Kaniko cluster builder)
anonymous— anyone browses and uploads; management token shown onceupload-authenticated(default) — anyone browses; signed-in users uploadenforced-auth— sign-in required for everything
- S3 endpoint:
http://minio.minio:9000— update ConfigMapfiledrop-configif incorrect - OIDCClient ingressRef requires
passmower.ingressDiscovery.enabled; if not available, add explicituri/redirectUriswith expanded hostname - Actual public URL: read admitted Ingress after deployment
src/index.js— Express app + all routessrc/db.js— SQLite setupsrc/s3.js— S3 client (AWS SDK v3)src/auth.js— OIDC discovery + JWT validation (jsonwebtoken + jwks-rsa)public/index.html+public/app.js— SPA frontendk8s/— Bucket, Policy, S3User, OIDCClient, PVC, ConfigMap, Deployment, Service, Ingressskaffold.yaml— Kaniko cluster build → zot registry