`README.md`

54 lines
# dave-share

A read-only **drop-folder web server** for sharing pages and files with Dave across
**separate Tailscale tailnets** — without merging the two networks.

## The model (how this stays private)

- Steve's tailnet (`designerwallcoverings.com`) and Dave's tailnet stay fully separate.
- We expose **one machine** (this Mac Studio) and **one URL** to Dave via Tailscale's
  **node-sharing** feature. Dave sees only this node — not LeBron, Kobe, the phone, etc.
- That URL is published with **`tailscale serve`** (tailnet-only HTTPS, real cert, NOT
  `funnel` — so it's never on the public internet).
- This server is the only thing behind that URL. It serves the `shared/` folder, read-only.

## What's where

| Thing | Value |
|---|---|
| Local server | `http://127.0.0.1:9930` (loopback only) |
| Tailnet URL | `https://stevestudio2s-mac-studio.tail79cb8e.ts.net:8444` |
| Share folder | `shared/` — drop files / `.html` pages here |
| Keep-alive | launchd `com.steve.dave-share` (RunAtLoad + KeepAlive) |

## Sharing something

Just drop it into `shared/`:

```sh
cp ~/Desktop/some-page.html ~/Projects/dave-share/shared/
```

It appears in the index immediately. A folder with an `index.html` renders that page;
otherwise you get an auto directory listing.

## Security notes

- **GET/HEAD only.** No writes, no exec, no dynamic routes. Path traversal is blocked.
- `tailscale serve` proxies from `127.0.0.1`, so requests look local. That's exactly why
  this server trusts *nothing* about localhost — the only access control is the node-share
  (only Dave's node can resolve/reach the URL).
- Tailscale injects `Tailscale-User-Login` for shared-in peers; the page shows it so you
  can see who's connected. It is informational, not a gate.

## The one manual step (yours to do — it grants an external person access)

Generate the share invite for Dave in the Tailscale admin console:

1. https://login.tailscale.com/admin/machines
2. `stevestudio2s-mac-studio` → ⋯ → **Share…**
3. Send Dave the invite link. He accepts with his own Tailscale account.
4. Dave opens: `https://stevestudio2s-mac-studio.tail79cb8e.ts.net:8444`

To stop sharing later: same menu → **un-share**, or `tailscale serve --https=8444 off`.