git-remote-aws

use libsodium directly, like this[1]. 1. https://github.com/nathants/git-remote-aws

this is very cool! i prototyped a similar serverless git product recently using a different technique. i used aws lambda holding leases in dynamo backed by s3. i zipped git binaries into the lambda and invoked them directly. i used shallow clone style repos stored in chunks in s3, that could be merged as needed in lambda /tmp. lambda was nice because for cpu heavy ops like merging many shallow clones, i could do that in a larger cpu lambda, and cache the result. other constraints were similar to what is described here. mainly that an individual push/pull cannot exceed the api gateway max payload size, a few MB. i looked at isomorphic, but did not try emscripten libgit2. using cloudflare is nice because of free egress, which opens up many new use cases that don’t make sense on $0.10/GB egress. i ended up shelving this while i build a diffe

if you don’t need a web ui: https://github.com/nathants/git-remote-aws

you want to minimize trust. you have to trust linux and kind of trust aws, you don’t have to trust github at all. not your keys, not your coins. it’s really such a good catchphrase. for anything non-public, git data goes here: https://github.com/nathants/git-remote-aws

ff-only is the real git superpower. a linear, immutable, series of commits in the only branch that is suffered to exist. git, the good parts. it also pairs well with a simplified remote[1]. 1. https://github.com/nathants/git-remote-aws

this is the play. in the past have used git-remote-gcrypt[1] with rclone. currently using git-remote-aws[2]. both work great. 1. https://github.com/spwhitton/git-remote-gcrypt 2. https://github.com/nathants/git-remote-aws

use a network snitch[1] on desktop and mobile. the original slogan says it all: makes the invisible visible. i’d love to use a filesystem snitch too, but none exist yet afaik. it’s interesting to observe firefox or any other legitimate app i’m using make many unsolicited requests to weird domains. it feels good to interactively deny those connections. make sure that cloud[2], which includes git hosts[3], are untrusted. unencrypted data should never hit remote. keys should never leave local. consider the tradeoffs with online interactions. engaging with other humans in public on github and hackernews is likely worth. engaging in impassioned op-ed debate with bots on engagement monetization platforms like twitter or youtube is likely not. pay for things like kagi search. trading money for a product or service that improves your life is a go

I like it, a nice simple approach! Fun reading through the code, heres the bit that does the encryption (I think): https://github.com/nathants/git-remote-aws/blob/c8012c5a6b80...