# PURPOSE & MANAGEMENT — `public` Copyparty share  (READ THIS, AI)

## What this folder is
This is the **`public`** volume of the Copyparty file server on **tools-server (LXC 800, 192.168.1.33)**.
It is a **public, anonymous, READ-ONLY** share used by the owner (Shugan) to hand files to friends quickly
without accounts — e.g. Minecraft modpacks. Anyone who can reach the site can browse & download; **nobody can
upload, and nobody can see any other user's folders.**

- Public URL:      `https://cloud.shugan.dev/public/`
- On-disk path:    `/opt/copyparty/data/public/`  (owner uid/gid = 0:0, matching other data dirs)
- Config block:    `[/public]` in `/opt/copyparty/copyparty.conf`  → `accs: A: shugan` (admin) + `r: *` (anon read)
- Quota:           `vmaxb: 20g`

## Security model (verified 2026-07-03 — keep it this way)
- `r: *` grants **read/list/download to everyone including anonymous**. There is **no `w`/`rw`** → uploads are
  blocked for anon (returns 401). Only the `shugan` admin account can write here.
- Isolation is proven: anon GET `/public` = 200; anon GET of every OTHER volume (papa, Ocirne, chochiavelli,
  spacefox93, tyty, …) = **403**; the anon root listing shows **ONLY `public/`** (no other volume leaks).
- **DO NOT** add `w`/`rw`/`m`/`d` for `*` here, and DO NOT point any other volume at `r: *`. That would break the
  isolation guarantee.

## Contents / layout
- `public/README-AI.md`         ← this file (AI-only; friends ignore it)
- `public/minecraft/`           ← Minecraft distribution
    - `shugan-server-modpack-neoforge-1.21.1.zip`  ← client `mods/` + `shaderpacks/` (the play-ready pack)
    - `MODLIST.txt`                                ← human-readable mod list + install steps for friends

## How to MANAGE this folder (for a future AI session)
**Add a file for friends:** copy it into `/opt/copyparty/data/public/<subfolder>/` on tools-server, then
`chown 0:0`. It appears immediately at `cloud.shugan.dev/public/<subfolder>/` — no restart needed.
```
scp -i ~/.ssh/id_ed25519 <local-file> root@192.168.1.33:/opt/copyparty/data/public/minecraft/
ssh -i ~/.ssh/id_ed25519 root@192.168.1.33 'chown 0:0 /opt/copyparty/data/public/minecraft/<file>'
```

**Refresh the Minecraft modpack** after server mod changes: re-zip the client instance's `mods` + `shaderpacks`
from `C:\Users\shugan\AppData\Roaming\ModrinthApp\profiles\Forge 1.21.1` (the client instance — note it is
NeoForge despite the folder name), regenerate `MODLIST.txt`, and replace both files here. The authoritative
server mod list lives at `H:\Infrastructure\docs\services\minecraft-servers-comparison.md`.

**Change access / add a volume:** edit `/opt/copyparty/copyparty.conf` (a `.bak-<ts>` copy is made on edits),
then `docker restart copyparty`. Passwords for named users are plaintext in the `[accounts]` block — **never
print them to a transcript.**

## Related docs (in H:\Infrastructure)
- `docs/services/tools-server.md`  — Copyparty deployment, all volumes, how to edit.
- `docs/reference/credentials-map.md` — where secrets live.
- `docs/services/minecraft-servers-comparison.md` / `minecraft-config-reference.md` — the MC server + configs.