# /srv/data.wafer.space — PUBLIC publish directory

**Everything in this directory is published to the public internet**, every 5
minutes, at:

    https://data.wafer.space/big-storage/

There is no authentication and directory listings are on, so anything dropped
here is world-readable and world-listable within ~5 minutes.

* **Do not put secrets here.** `/etc/data-upload/exclusions` filters obvious key
  material (private keys, VPN configs, `.env`, credentials) at any depth, but it
  matches on *names* — it is a safety net, not a guarantee.
* **Removing a file here does NOT unpublish it.** The sync never passes
  `--delete`, so a file removed locally stays on the server. To unpublish,
  delete it on the server as well:
  `ssh ansible@data-wafer-space.buddy.mithis.com sudo rm /srv/data/big-storage/<path>`
* Anyone in the `tim` group can write here (dir is `2775`).

Mechanism: `data-upload-wafer-space.timer` (every 5 min, `*:3/5`) runs
`/usr/local/sbin/data-upload-sync` as the unprivileged `data-upload` user, which
rsyncs into a write-only `rrsync` jail on the server. Full design:
`/home/tim/local/docs/2026-08-29-bigstorage-data-wafer-space-upload.md`.