My Share Host Became a Data Layer: ACLs, Forms, Comments, Status Pages
TL;DR I built a self-hosted share host in early September because a Claude artifact link was private to me and I needed to hand a page to specific people who have no account on anything I run. Access control was the first feature, not an afterthought. Authentication and authorization are split on purpose. oauth2-proxy with Google proves who you are and authorizes nothing. A small FastAPI app reads a per-folder ACL object from the bucket and decides what you can open. Grants change in about 15 seconds with no deploy. Pages that take input don’t post to a database. Every checkbox and typed cell becomes a typed operation that lands as a merge commit on a JSON spec in GitLab, authored by the person who made it. Git is the config layer. Every page has a comment rail. Comments have changed real work: a gear list, and the status page for my blue-team security harness. Long-running jobs get a status page that rebuilds itself from the job’s own data. The security eval ran on one across three days. A restore job I was babysitting republished every three minutes from a systemd timer. Access control came first The problem was boring and specific. I make a lot of HTML with Claude: plans, reports, checklists. When I built this, an artifact link was mine alone. There was no way to say “this person can open it and nobody else.” Emailing HTML files around is how you end up with four versions of the same checklist. ...