Cobbled Maven Worker

A forked version of Xander's Maven Worker with cozy styling and discord integration via discord-hono.

Features

maven-metadata.xml fixing: Automatically generates and fixes maven-metadata.xml files when clients race to upload differing versions of the same artifact
- Waits 5 seconds after the last upload per-artifact and then regenerates the maven-metadata.xml file
- Uses Durable Objects
Web UI for browsing uploaded artifacts, at /web/
- Uses HTMX, extremely minimal and fast web UI with caching
Optionally enforceable immutability
Uses Cloudflare Workers Cache:
- Immutable data: public, max-age=3600, immutable, stale-while-revalidate=31536000
- Mutable data: public, max-age=300, stale-while-revalidate=1800
- Purges cached data on successful upload
Autogenerates checksums for uploaded artifacts
Ignores uploaded checksums in favor of the generated ones
Supports Range requests and conditional requests
Supports Basic Authentication
- Stored credentials in D1 database, hashed with SHA-256 and peppered
- Fast, lower-security hashing algorithm (SHA-256) used as passwords are expected to be high entropy and randomised, not memorable
- No permissions system; a credential has full read/write access to all repositories
- Credentials are managed via discord bot sha256(password + pepper)
Multiple repositories; each repository is a separate Cloudflare R2 bucket

Most configuration is done via environment variables found in "vars": in the wrangler.jsonc file.

SERVER_NAME: The name of the server, displayed in the UI
REPOSITORIES: A comma-separated list of repository names to use, should match the binding of the R2 bucket
CHECKSUM_VALIDATION: (true/false) Whether to validate uploaded checksums if auto-generation is disabled
CHECKSUM_AUTOGENERATION: (true/false) Whether to automatically generate checksums for uploaded artifacts
ALLOW_OVERWRITES: (true/false) Whether to allow overwriting of existing artifacts
VALIDATE_PATHS: (true/false) Applies loose path validation to requests, rejecting paths that do not match the expected Maven object path format

You also need to set the PEPPER environment secret.