Author	SHA1	Message	Date
simon chrzanowski	0916eabe37	Fix leftover /api/packages references to the hosted endpoints ... Refs #133	2026-10-14 13:23:19 +02:00
simon chrzanowski	ea696a7abc	Add a hosted config block and a bearer token check for writes ... hosted.enabled turns on pushing packages to the proxy and is off by default, like mirror_api. A pushed version is served in place of the upstream version with the same number, so anyone who can write could swap a package for every client. Enabling it therefore requires hosted.token, which supports ${VAR_NAME} expansion and can be set with PROXY_HOSTED_TOKEN. hosted.max_upload_size caps one archive and defaults to 100MB. requireBearerToken compares SHA-256 digests of the presented and configured tokens in constant time and answers 401 with a WWW-Authenticate challenge otherwise. Refs #133	2026-10-14 13:23:19 +02:00