Chris LuandClaude Opus 5.5 c2ca83c0bf filer: say jwt.filer_signing.key gates only the IAM gRPC service (#12353) ...

* filer: say jwt.filer_signing.key gates only the IAM gRPC service

The key never covered the rest of the filer gRPC port, which can read and
write the IAM store under /etc/iam. Point operators at [grpc.filer] mTLS for a
port reachable beyond a trusted network instead of the key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* filer: note the IAM gRPC OIDC provider and role RPCs are refused without the key

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-02 18:00:59 -08:00

..

scaffold

filer: say jwt.filer_signing.key gates only the IAM gRPC service (#12353)

2026-11-02 18:00:59 -08:00

admin.go

admin: configurable file browser upload size limit (#12348)

2026-11-02 11:32:03 -08:00

autocomplete.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

backends.go

storage: register tier backends at the binary composition root (#9989)

2026-06-16 11:47:32 -07:00

backup.go

backup: don't Close a volume after Destroy (#12225)

2026-10-29 19:00:15 -07:00

benchmark.go

operation: renew the write JWT when a fan-out rollback delete is rejected (#11970)

2026-10-22 21:32:53 -07:00

command.go

image: add an optional public image processing gateway (#11593)

2026-10-05 19:49:02 +08:00

compact.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

download.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

export.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

filer_backup_offset_test.go

filer.backup: add -s3.flattenVersions to mirror the current S3 view of versioned buckets (#12255)

2026-10-30 09:09:05 -07:00

filer_backup_test.go

filer.backup: add -s3.flattenVersions to mirror the current S3 view of versioned buckets (#12255)

2026-10-30 09:09:05 -07:00

filer_backup_versions_test.go

filer.backup: add -s3.flattenVersions to mirror the current S3 view of versioned buckets (#12255)

2026-10-30 09:09:05 -07:00

filer_backup_versions.go

filer.backup: add -s3.flattenVersions to mirror the current S3 view of versioned buckets (#12255)

2026-10-30 09:09:05 -07:00

filer_backup.go

filer.backup: add -s3.flattenVersions to mirror the current S3 view of versioned buckets (#12255)

2026-10-30 09:09:05 -07:00

filer_cat.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

filer_copy.go

filer: guard FoundationDB 100KB value limit and pack earlier (#11161)

2026-09-04 23:12:27 -07:00

filer_meta_backup.go

fix: handle meta backup offset errors safely (#9818)

2026-06-04 10:53:23 -07:00

filer_meta_scan_test.go

filer: add filer.meta.scan to audit one directory's change history (#10645)

2026-08-08 09:24:58 -07:00

filer_meta_scan.go

filer: add filer.meta.scan to audit one directory's change history (#10645)

2026-08-08 09:24:58 -07:00

filer_meta_tail_elastic.go

fix(filer.meta.tail): include extended metadata in Elasticsearch docs (#9200)

2026-04-23 11:54:08 -07:00

filer_meta_tail_non_elastic.go

fix(filer.meta.tail): fail fast when -es is used without elastic build tag (#9191)

2026-04-22 09:44:43 -07:00

filer_meta_tail.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

filer_remote_gateway_buckets_test.go

filer.remote.gateway: stop zero-byte uploads of remote-only entries (#12110)

2026-10-26 18:03:12 -07:00

filer_remote_gateway_buckets.go

filer.remote.gateway: stop zero-byte uploads of remote-only entries (#12110)

2026-10-26 18:03:12 -07:00

filer_remote_gateway.go

Add codespell support with configuration and typo fixes (#10393)

2026-07-22 14:38:06 -07:00

filer_remote_sync_dir_test.go

filer.remote.sync: upload a holed entry zero-filled instead of skipping it (#12178)

2026-10-28 19:39:31 -07:00

filer_remote_sync_dir.go

filer.remote.sync: upload a holed entry zero-filled instead of skipping it (#12178)

2026-10-28 19:39:31 -07:00

filer_remote_sync.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

filer_replication.go

Added loadSecurityConfigOnce (#5792)

2024-07-16 09:15:55 -07:00

filer_shutdown_test.go

fix(filer): end metadata subscriptions before gRPC GracefulStop on shutdown (#11663)

2026-10-10 10:59:00 +08:00

filer_sync_jobs_test.go

filer.backup: process metadata events through the concurrent processor (#11951)

2026-10-23 20:02:55 -07:00

filer_sync_jobs.go

filer,pb,mount: keep per-chunk cipher keys out of logs (#12085)

2026-10-26 11:52:56 -07:00

filer_sync_offset_test.go

filer.backup: process metadata events through the concurrent processor (#11951)

2026-10-23 20:02:55 -07:00

filer_sync_process_test.go

filer.backup: keep local sink writes inside the sink directory (#12310)

2026-11-01 18:33:07 -08:00

filer_sync_subscription_test.go

filer.sync: pipelined subscription with adaptive batching for faster catch-up (#8791)

2026-03-26 23:55:42 -07:00

filer_sync_verify_test.go

feat(filer.sync.verify): reclassify chunk-slice-order ETag diffs as CHUNK_REORDER (#10177)

2026-07-01 10:38:21 -07:00

filer_sync_verify.go

feat(filer.sync.verify): reclassify chunk-slice-order ETag diffs as CHUNK_REORDER (#10177)

2026-07-01 10:38:21 -07:00

filer_sync.go

filer.sync: skip superseded replays before fetching any chunks (#12212)

2026-10-29 13:37:27 -07:00

filer.go

filer: say jwt.filer_signing.key gates only the IAM gRPC service (#12353)

2026-11-02 18:00:59 -08:00

fix_ecx_test.go

ec: uniform shard block layout (#10932)

2026-08-28 20:46:59 -07:00

fix_test.go

fix(volume): stop flipping volumes read-only on a non-append-ordered .idx (#9726)

2026-05-28 18:04:31 -07:00

fix.go

ec: uniform shard block layout (#10932)

2026-08-28 20:46:59 -07:00

fuse_notsupported.go

go fix

2026-02-20 18:42:00 -08:00

fuse_std_test.go

mount: add -volumeName to name the disk explicitly (#11165)

2026-09-04 23:14:57 -07:00

fuse_std.go

mount: add -volumeName to name the disk explicitly (#11165)

2026-09-04 23:14:57 -07:00

fuse.go

Fix the issue where fuse command on a node cannot specify multiple configuration directory paths (#7874)

2025-12-25 11:36:38 -08:00

iam.go

filer,webdav,iam,sftp: add -idleTimeout flag for connection idle timeout (#12136)

2026-10-27 17:31:23 -07:00

image.go

image: add an optional public image processing gateway (#11593)

2026-10-05 19:49:02 +08:00

imports.go

migrate IAM policies to multi-file storage (#8114)

2026-01-26 11:28:23 -08:00

maintenance_capabilities.go

Refactor plugin system and migrate worker runtime (#8369)

2026-02-18 13:42:41 -08:00

master_follower.go

command: no extra localhost listener when -ip.bind is specified (#12055)

2026-10-25 06:52:16 -07:00

master_test.go

master: align default volume size with EC rows (#10761)

2026-08-15 21:37:20 -07:00

master.go

server: keep the first write on a fresh weed server from stalling (#12149)

2026-10-28 08:08:26 -07:00

metadata_event_scope_test.go

Adjust rename events metadata format (#8854)

2026-03-30 18:25:11 -07:00

metadata_event_scope.go

Adjust rename events metadata format (#8854)

2026-03-30 18:25:11 -07:00

mini_admin_auth_test.go

admin: default to port 12535, keep 23646 as a best-effort compat listener (#11816)

2026-10-18 21:21:05 -07:00

mini_bucket_test.go

mini: state the format of a -tableBucket, do not infer it (#10851)

2026-08-20 23:46:32 -07:00

mini_plugin_test.go

refactor(s3api): strip back-stamp from PutBucketLifecycleConfiguration (Phase 4) (#9367)

2026-05-08 11:03:03 -07:00

mini.go

admin: configurable file browser upload size limit (#12348)

2026-11-02 11:32:03 -08:00

mount_common_test.go

mount/shell: bucket allow-empty-folders toggle, mount keeps explicit false (#11370)

2026-09-17 20:30:53 -07:00

mount_common.go

mount/shell: bucket allow-empty-folders toggle, mount keeps explicit false (#11370)

2026-09-17 20:30:53 -07:00

mount_darwin.go

Make weed-fuse compatible with systemd-based mount (#6814)

2026-03-18 12:18:40 -07:00

mount_freebsd.go

Make weed-fuse compatible with systemd-based mount (#6814)

2026-03-18 12:18:40 -07:00

mount_linux.go

Make weed-fuse compatible with systemd-based mount (#6814)

2026-03-18 12:18:40 -07:00

mount_memory_test.go

fix(mount): bound reader cache memory across open files (#11220)

2026-09-08 10:51:28 -07:00

mount_notsupported.go

mount: support mounting on Windows through WinFsp (#10536)

2026-08-03 21:20:26 -07:00

mount_std_test.go

go fix

2026-02-20 18:42:00 -08:00

mount_std.go

fix(mount): bound reader cache memory across open files (#11220)

2026-09-08 10:51:28 -07:00

mount_windows.go

fix(mount): bound reader cache memory across open files (#11220)

2026-09-08 10:51:28 -07:00

mount.go

mount, s3: clarify allowOthers requirement and bucket name error (#12197)

2026-10-29 01:36:16 -07:00

mq_agent.go

command: no extra localhost listener when -ip.bind is specified (#12055)

2026-10-25 06:52:16 -07:00

mq_broker.go

command: no extra localhost listener when -ip.bind is specified (#12055)

2026-10-25 06:52:16 -07:00

mq_kafka_gateway.go

Add Kafka Gateway (#7231)

2025-10-13 18:05:17 -07:00

plugin_worker_test.go

refactor(worker): co-locate plugin handlers with their task packages (#9301)

2026-05-02 18:03:13 -07:00

s3_aux_listener_test.go

command: no extra localhost listener when -ip.bind is specified (#12055)

2026-10-25 06:52:16 -07:00

s3_iceberg_endpoint_test.go

s3: keep the gateway up when an auxiliary listener fails to bind (#11768)

2026-10-16 23:10:09 -07:00

s3_shutdown_test.go

fix(s3): drain in-flight requests on SIGTERM in standalone weed s3 (#11603)

2026-10-06 10:10:37 +08:00

s3_vector_discovery_test.go

vector: keep S3 Vectors requests off the master-discovery lock (#12291)

2026-10-31 15:35:52 -07:00

s3.go

s3vectors: encrypt the objects of a vector bucket declared AES256 (#12324)

2026-11-01 23:57:40 -08:00

scaffold_test.go

fix test

2019-11-28 18:44:27 -08:00

scaffold.go

admin: configure maintenance tasks via admin.toml (#9926)

2026-06-11 11:04:52 -07:00

server_test.go

filer,webdav,iam,sftp: add -idleTimeout flag for connection idle timeout (#12136)

2026-10-27 17:31:23 -07:00

server.go

server: keep the first write on a fresh weed server from stalling (#12149)

2026-10-28 08:08:26 -07:00

sftp.go

filer,webdav,iam,sftp: add -idleTimeout flag for connection idle timeout (#12136)

2026-10-27 17:31:23 -07:00

shell.go

shell: bound the initial master connection wait behind -connectTimeout (#11922)

2026-10-21 20:17:51 -07:00

shutdown_test.go

fix(s3): drain in-flight requests on SIGTERM in standalone weed s3 (#11603)

2026-10-06 10:10:37 +08:00

shutdown.go

fix(s3): drain in-flight requests on SIGTERM in standalone weed s3 (#11603)

2026-10-06 10:10:37 +08:00

update_full.go

go fix

2026-02-20 18:42:00 -08:00

update.go

refactor(command): expand "~" in all path-style CLI flags (#9306)

2026-05-03 21:46:21 -07:00

upload.go

upload: upload -dir files concurrently behind a new -c flag (#11918)

2026-10-21 20:08:57 -07:00

version.go

Refine enterprise edition feature blurb in version output and docs

2026-05-30 09:29:06 -07:00

volume_test.go

move to https://github.com/seaweedfs/seaweedfs

2022-07-29 00:17:28 -07:00

volume.go

filer,webdav,iam,sftp: add -idleTimeout flag for connection idle timeout (#12136)

2026-10-27 17:31:23 -07:00

webdav.go

filer,webdav,iam,sftp: add -idleTimeout flag for connection idle timeout (#12136)

2026-10-27 17:31:23 -07:00

worker_runtime.go

admin: default to port 12535, keep 23646 as a best-effort compat listener (#11816)

2026-10-18 21:21:05 -07:00

worker_test.go

fix(s3tests): wire lifecycle worker for expiration suite (#9374)

2026-05-08 17:29:47 -07:00

worker.go

admin: default to port 12535, keep 23646 as a best-effort compat listener (#11816)

2026-10-18 21:21:05 -07:00