Merge pull request 'fix reflected xss when returning errors on web endpoint' (#1472 ) from escape-errors-v1 into main-v1

Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/1472
fix reflected xss when returning errors on web endpoint
2026-11-10 08:09:16 -05:00 · 2026-06-11 06:51:01 +00:00 · 2026-06-10 19:43:51 +02:00 · 2026-04-16 08:47:02 +00:00 · 2026-04-15 09:56:24 +00:00 · 2026-02-21 07:21:24 +00:00
221 changed files with 10461 additions and 11951 deletions
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@ -1,3 +0,0 @@
 [target.x86_64-unknown-linux-gnu]
 linker = "clang"
 rustflags = ["-C", "link-arg=-fuse-ld=mold"]
--- a/.woodpecker/debug.yaml
+++ b/.woodpecker/debug.yaml
@ -1,3 +1,6 @@
 labels:
  nix: "enabled"
 when:
  event:
  - push
@ -9,37 +12,33 @@ when:
 steps:
  - name: check formatting
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    commands:
-      - nix-shell --attr devShell --run "cargo fmt -- --check"
+      - nix-build -j4 --attr flakePackages.fmt
  - name: build
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    commands:
-      - nix-build --no-build-output --attr clippy.amd64 --argstr git_version ${CI_COMMIT_TAG:-$CI_COMMIT_SHA}
+      - nix-build -j4 --attr flakePackages.dev
-  - name: unit + func tests
+  - name: unit + func tests (lmdb)
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    environment:
      GARAGE_TEST_INTEGRATION_EXE: result-bin/bin/garage
      GARAGE_TEST_INTEGRATION_PATH: tmp-garage-integration
    commands:
-      - nix-build --no-build-output --attr clippy.amd64 --argstr git_version ${CI_COMMIT_TAG:-$CI_COMMIT_SHA}
+      - nix-build -j4 --attr flakePackages.tests-lmdb
-      - nix-build --no-build-output --attr test.amd64
+
-      - ./result/bin/garage_db-*
+  - name: unit + func tests (sqlite)
-      - ./result/bin/garage_api-*
+    image: nixpkgs/nix:nixos-24.05
-      - ./result/bin/garage_model-*
+    commands:
-      - ./result/bin/garage_rpc-*
+      - nix-build -j4 --attr flakePackages.tests-sqlite
-      - ./result/bin/garage_table-*
+
-      - ./result/bin/garage_util-*
+  - name: unit + func tests (fjall)
-      - ./result/bin/garage_web-*
+    image: nixpkgs/nix:nixos-24.05
-      - ./result/bin/garage-*
+    commands:
-      - ./result/bin/integration-* || (cat tmp-garage-integration/stderr.log; false)
+      - nix-build -j4 --attr flakePackages.tests-fjall
      - rm result
      - rm -rv tmp-garage-integration
  - name: integration tests
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    commands:
-      - nix-build --no-build-output --attr clippy.amd64 --argstr git_version ${CI_COMMIT_TAG:-$CI_COMMIT_SHA}
+      - nix-build -j4 --attr flakePackages.dev
      - nix-shell --attr ci --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
    depends_on: [ build ]
--- a/.woodpecker/publish.yaml
+++ b/.woodpecker/publish.yaml
@ -1,3 +1,6 @@
 labels:
  nix: "enabled"
 when:
  event:
  - deployment
@ -8,20 +11,21 @@ depends_on:
 steps:
  - name: refresh-index
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
-    secrets:
+    environment:
-      - source: garagehq_aws_access_key_id
+      AWS_ACCESS_KEY_ID:
-        target: AWS_ACCESS_KEY_ID
+        from_secret: garagehq_aws_access_key_id
-      - source: garagehq_aws_secret_access_key
+      AWS_SECRET_ACCESS_KEY:
-        target: AWS_SECRET_ACCESS_KEY
+        from_secret: garagehq_aws_secret_access_key
    commands:
      - mkdir -p /etc/nix && cp nix/nix.conf /etc/nix/nix.conf
      - nix-shell --attr ci --run "refresh_index"
  - name: multiarch-docker
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
-    secrets:
+    environment:
-      - docker_auth
+      DOCKER_AUTH:
        from_secret: docker_auth
    commands:
      - mkdir -p /root/.docker
      - echo $DOCKER_AUTH > /root/.docker/config.json
--- a/.woodpecker/release.yaml
+++ b/.woodpecker/release.yaml
@ -1,3 +1,6 @@
 labels:
  nix: "enabled"
 when:
  event:
  - deployment
@ -16,18 +19,17 @@ matrix:
 steps:
  - name: build
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    commands:
-      - nix-build --no-build-output --attr pkgs.${ARCH}.release --argstr git_version ${CI_COMMIT_TAG:-$CI_COMMIT_SHA}
+      - nix-build --attr releasePackages.${ARCH} --argstr git_version ${CI_COMMIT_TAG:-$CI_COMMIT_SHA}
  - name: check is static binary
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    commands:
-      - nix-build --no-build-output --attr pkgs.${ARCH}.release --argstr git_version ${CI_COMMIT_TAG:-$CI_COMMIT_SHA}
+      - nix-shell --attr ci --run "./script/not-dynamic.sh result/bin/garage"
      - nix-shell --attr ci --run "./script/not-dynamic.sh result-bin/bin/garage"
  - name: integration tests
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    commands:
      - nix-shell --attr ci --run ./script/test-smoke.sh || (cat /tmp/garage.log; false)
    when:
@ -37,7 +39,7 @@ steps:
          ARCH: i386
  - name: upgrade tests
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    commands:
      - nix-shell --attr ci --run "./script/test-upgrade.sh v0.8.4 x86_64-unknown-linux-musl" || (cat /tmp/garage.log; false)
    when:
@ -45,24 +47,23 @@ steps:
          ARCH: amd64
  - name: push static binary
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    environment:
      TARGET: "${TARGET}"
-    secrets:
+      AWS_ACCESS_KEY_ID:
-      - source: garagehq_aws_access_key_id
+        from_secret: garagehq_aws_access_key_id
-        target: AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
-      - source: garagehq_aws_secret_access_key
+        from_secret: garagehq_aws_secret_access_key
        target: AWS_SECRET_ACCESS_KEY
    commands:
      - nix-shell --attr ci --run "to_s3"
  - name: docker build and publish
-    image: nixpkgs/nix:nixos-22.05
+    image: nixpkgs/nix:nixos-24.05
    environment:
      DOCKER_PLATFORM: "linux/${ARCH}"
      CONTAINER_NAME: "dxflrs/${ARCH}_garage"
-    secrets:
+      DOCKER_AUTH:
-      - docker_auth
+        from_secret: docker_auth
    commands:
      - mkdir -p /root/.docker
      - echo $DOCKER_AUTH > /root/.docker/config.json
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.nix
+++ b/Cargo.nix
--- a/Cargo.toml
+++ b/Cargo.toml
@ -8,7 +8,10 @@ members = [
 	"src/table",
 	"src/block",
 	"src/model",
-	"src/api",
+	"src/api/common",
 	"src/api/s3",
 	"src/api/k2v",
 	"src/api/admin",
 	"src/web",
 	"src/garage",
 	"src/k2v-client",
@ -21,15 +24,18 @@ default-members = ["src/garage"]
 # Internal Garage crates
 format_table = { version = "0.1.1", path = "src/format-table" }
-garage_api = { version = "0.10.0", path = "src/api" }
+garage_api_common = { version = "1.3.1", path = "src/api/common" }
-garage_block = { version = "0.10.0", path = "src/block" }
+garage_api_admin = { version = "1.3.1", path = "src/api/admin" }
-garage_db = { version = "0.10.0", path = "src/db", default-features = false }
+garage_api_s3 = { version = "1.3.1", path = "src/api/s3" }
-garage_model = { version = "0.10.0", path = "src/model", default-features = false }
+garage_api_k2v = { version = "1.3.1", path = "src/api/k2v" }
-garage_net = { version = "0.10.0", path = "src/net" }
+garage_block = { version = "1.3.1", path = "src/block" }
-garage_rpc = { version = "0.10.0", path = "src/rpc" }
+garage_db = { version = "1.3.1", path = "src/db", default-features = false }
-garage_table = { version = "0.10.0", path = "src/table" }
+garage_model = { version = "1.3.1", path = "src/model", default-features = false }
-garage_util = { version = "0.10.0", path = "src/util" }
+garage_net = { version = "1.3.1", path = "src/net" }
-garage_web = { version = "0.10.0", path = "src/web" }
+garage_rpc = { version = "1.3.1", path = "src/rpc" }
 garage_table = { version = "1.3.1", path = "src/table" }
 garage_util = { version = "1.3.1", path = "src/util" }
 garage_web = { version = "1.3.1", path = "src/web" }
 k2v-client = { version = "0.0.4", path = "src/k2v-client" }
 # External crates from crates.io
@ -43,25 +49,28 @@ bytes = "1.0"
 bytesize = "1.1"
 cfg-if = "1.0"
 chrono = "0.4"
 crc32fast = "1.4"
 crc32c = "0.6"
 crypto-common = "0.1"
 digest = "0.10"
 err-derive = "0.3"
 gethostname = "0.4"
 git-version = "0.3.4"
 hex = "0.4"
 hexdump = "0.1"
 html-escape = "0.2.13"
 hmac = "0.12"
 idna = "0.5"
 itertools = "0.12"
 ipnet = "2.9.0"
 lazy_static = "1.4"
 md-5 = "0.10"
 mktemp = "0.5"
-nix = { version = "0.27", default-features = false, features = ["fs"] }
+nix = { version = "0.29", default-features = false, features = ["fs"] }
 nom = "7.1"
 parking_lot = "0.12"
 parse_duration = "2.1"
 pin-project = "1.0.12"
 pnet_datalink = "0.34"
 rand = "0.8"
 sha1 = "0.10"
 sha2 = "0.10"
 timeago = { version = "0.4", default-features = false }
 xxhash-rust = { version = "0.8", default-features = false, features = ["xxh3"] }
@ -73,11 +82,16 @@ kuska-handshake = { version = "0.2.0", features = ["default", "async_std"] }
 clap = { version = "4.1", features = ["derive", "env"] }
 pretty_env_logger = "0.5"
 structopt = { version = "0.3", default-features = false }
 syslog-tracing = "0.3"
 tracing = "0.1"
 tracing-journald = "0.3.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 heed = { version = "0.11", default-features = false, features = ["lmdb"] }
-rusqlite = "0.30.0"
+rusqlite = "0.37"
 r2d2 = "0.8"
 r2d2_sqlite = "0.31"
 fjall = "2.4"
 async-compression = { version = "0.4", features = ["tokio", "zstd"] }
 zstd = { version = "0.13", default-features = false }
@ -120,26 +134,21 @@ opentelemetry-contrib = "0.9"
 prometheus = "0.13"
 # used by the k2v-client crate only
-aws-sigv4 = { version = "1.1" }
+aws-sigv4 = { version = "1.1", default-features = false }
-hyper-rustls = { version = "0.26", features = ["http2"] }
+hyper-rustls = { version = "0.26", default-features = false, features = ["http1", "http2", "ring", "rustls-native-certs"] }
 log = "0.4"
-thiserror = "1.0"
+thiserror = "2.0"
 # ---- used only as build / dev dependencies ----
 assert-json-diff = "2.0"
 rustc_version = "0.4.0"
 static_init = "1.0"
-
+aws-smithy-runtime = { version = "1.8", default-features = false, features = ["tls-rustls"] }
-aws-config = "1.1.4"
+aws-sdk-config = { version = "1.62", default-features = false }
-aws-sdk-config = "1.13"
+aws-sdk-s3 = { version = "1.79", default-features = false, features = ["rt-tokio"] }
 aws-sdk-s3 = "1.14"
 [profile.dev]
 #lto = "thin"	# disabled for now, adds 2-4 min to each CI build
 lto = "off"
 [profile.release]
-lto = true
+lto = "thin"
-codegen-units = 1
+codegen-units = 16
-opt-level = "s"
+opt-level = 3
-strip = true
+strip = "debuginfo"
--- a/2
+++ b/2
@ -3,5 +3,5 @@ FROM scratch
 ENV RUST_BACKTRACE=1
 ENV RUST_LOG=garage=info
-COPY result-bin/bin/garage /
+COPY result/bin/garage /
 CMD [ "/garage", "server"]
--- a/11
+++ b/11
@ -1,13 +1,8 @@
-.PHONY: doc all release shell run1 run2 run3
+.PHONY: doc all run1 run2 run3
 all:
-	clear; cargo build
+	clear
-
+	cargo build
 release:
 	nix-build --attr pkgs.amd64.release --no-build-output
 shell:
 	nix-shell
 # ----
--- a/default.nix
+++ b/default.nix
@ -3,53 +3,22 @@
 with import ./nix/common.nix;
 let
-  pkgs = import pkgsSrc { };
+  pkgs = import nixpkgs { };
  compile = import ./nix/compile.nix;
-  build_debug_and_release = (target: {
+  build_release = target: (compile {
-    debug = (compile {
+    inherit target system git_version nixpkgs;
-      inherit system target git_version pkgsSrc cargo2nixOverlay;
+    crane = flake.inputs.crane;
-      release = false;
+    rust-overlay = flake.inputs.rust-overlay;
-    }).workspace.garage { compileMode = "build"; };
+    release = true;
-
+  }).garage;
    release = (compile {
      inherit system target git_version pkgsSrc cargo2nixOverlay;
      release = true;
    }).workspace.garage { compileMode = "build"; };
  });
  test = (rustPkgs:
    pkgs.symlinkJoin {
      name = "garage-tests";
      paths =
        builtins.map (key: rustPkgs.workspace.${key} { compileMode = "test"; })
        (builtins.attrNames rustPkgs.workspace);
    });
 in {
-  pkgs = {
+  releasePackages = {
-    amd64 = build_debug_and_release "x86_64-unknown-linux-musl";
+    amd64 = build_release "x86_64-unknown-linux-musl";
-    i386 = build_debug_and_release "i686-unknown-linux-musl";
+    i386 = build_release "i686-unknown-linux-musl";
-    arm64 = build_debug_and_release "aarch64-unknown-linux-musl";
+    arm64 = build_release "aarch64-unknown-linux-musl";
-    arm = build_debug_and_release "armv6l-unknown-linux-musleabihf";
+    arm = build_release "armv6l-unknown-linux-musleabihf";
  };
  test = {
    amd64 = test (compile {
      inherit system git_version pkgsSrc cargo2nixOverlay;
      target = "x86_64-unknown-linux-musl";
      features = [
        "garage/bundled-libs"
        "garage/k2v"
        "garage/lmdb"
        "garage/sqlite"
      ];
    });
  };
  clippy = {
    amd64 = (compile {
      inherit system git_version pkgsSrc cargo2nixOverlay;
      target = "x86_64-unknown-linux-musl";
      compiler = "clippy";
    }).workspace.garage { compileMode = "build"; };
  };
  flakePackages = flake.packages.${system};
 }
--- a/doc/api/garage-admin-v1.yml
+++ b/doc/api/garage-admin-v1.yml
@ -687,7 +687,7 @@ paths:
      operationId: "GetBucketInfo"
      summary: "Get a bucket"
      description: |
-        Given a bucket identifier (`id`) or a global alias (`alias`), get its information.
+        Given a bucket identifier (`id`) or a global alias (`globalAlias`), get its information.
        It includes its aliases, its web configuration, keys that have some permissions
        on it, some statistics (number of objects, size), number of dangling multipart uploads,
        and its quotas (if any).
@ -701,7 +701,7 @@ paths:
          example: "b4018dc61b27ccb5c64ec1b24f53454bbbd180697c758c4d47a22a8921864a87"
          schema:
            type: string
-        - name: alias
+        - name: globalAlias
          in: query
          description: |
            The exact global alias of one of the existing buckets.
--- a/doc/book/build/python.md
+++ b/doc/book/build/python.md
@ -23,7 +23,7 @@ client = minio.Minio(
  "GKyourapikey",
  "abcd[...]1234",
  # Force the region, this is specific to garage
-  region="region",
+  region="garage",
 )
 ```
--- a/doc/book/connect/apps/index.md
+++ b/doc/book/connect/apps/index.md
@ -12,7 +12,7 @@ In this section, we cover the following web applications:
 | [Mastodon](#mastodon)     | ✅       | Natively supported    |
 | [Matrix](#matrix)     | ✅       |  Tested with `synapse-s3-storage-provider`    |
 | [ejabberd](#ejabberd)     | ✅       |  `mod_s3_upload`    |
-| [Pixelfed](#pixelfed)     | ❓       |  Not yet tested    |
+| [Pixelfed](#pixelfed)     | ✅       |  Natively supported    |
 | [Pleroma](#pleroma)     | ❓       |  Not yet tested    |
 | [Lemmy](#lemmy)     | ✅        |  Supported with pict-rs    |
 | [Funkwhale](#funkwhale)     | ❓       | Not yet tested     |
@ -69,7 +69,7 @@ $CONFIG = array(
        'hostname' => '127.0.0.1', // Can also be a domain name, eg. garage.example.com
        'port' => 3900,            // Put your reverse proxy port or your S3 API port
        'use_ssl' => false,        // Set it to true if you have a TLS enabled reverse proxy
-        'region' => 'garage',      // Garage has only one region named "garage"
+        'region' => 'garage',      // Garage default region is named "garage", edit according to your cluster config
        'use_path_style' => true   // Garage supports only path style, must be set to true
    ],
 ],
@ -135,7 +135,7 @@ bucket but doesn't also know the secret encryption key.
 *Click on the picture to zoom*
 Add a new external storage. Put what you want in "folder name" (eg. "shared"). Select "Amazon S3". Keep "Access Key" for the Authentication field.
-In Configuration, put your bucket name (eg. nextcloud), the host (eg. 127.0.0.1), the port (eg. 3900 or 443), the region (garage). Tick the SSL box if you have put an HTTPS proxy in front of garage. You must tick the "Path access" box and you must leave the "Legacy authentication (v2)" box empty. Put your Key ID (eg. GK...) and your Secret Key in the last two input boxes. Finally click on the tick symbol on the right of your screen.
+In Configuration, put your bucket name (eg. nextcloud), the host (eg. 127.0.0.1), the port (eg. 3900 or 443), the region ("garage" if you use the default, or the one your configured in your `garage.toml`). Tick the SSL box if you have put an HTTPS proxy in front of garage. You must tick the "Path access" box and you must leave the "Legacy authentication (v2)" box empty. Put your Key ID (eg. GK...) and your Secret Key in the last two input boxes. Finally click on the tick symbol on the right of your screen.
 Now go to your "Files" app and a new "linked folder" has appeared with the name you chose earlier (eg. "shared").
@ -191,10 +191,10 @@ garage key create peertube-key
 Keep the Key ID and the Secret key in a pad, they will be needed later.  
-We need two buckets, one for normal videos (named peertube-video) and one for webtorrent videos (named peertube-playlist).
+We need two buckets, one for normal videos (named peertube-videos) and one for webtorrent videos (named peertube-playlists).
 ```bash
 garage bucket create peertube-videos
-garage bucket create peertube-playlist
+garage bucket create peertube-playlists
 ```
 Now we allow our key to read and write on these buckets:
@ -238,7 +238,7 @@ object_storage:
  # Put localhost only if you have a garage instance running on that node
  endpoint: 'http://localhost:3900' # or "garage.example.com" if you have TLS on port 443
-  # Garage supports only one region for now, named garage
+  # Garage default region is named "garage", edit according to your config
  region: 'garage'
  credentials:
@ -253,7 +253,7 @@ object_storage:
    proxify_private_files: false
  streaming_playlists:
-    bucket_name: 'peertube-playlist'
+    bucket_name: 'peertube-playlists'
    # Keep it empty for our example
    prefix: ''
@ -335,6 +335,7 @@ From the [official Mastodon documentation](https://docs.joinmastodon.org/admin/t
 ```bash
 $ RAILS_ENV=production bin/tootctl media remove --days 3
 $ RAILS_ENV=production bin/tootctl media remove --days 15 --prune-profiles
 $ RAILS_ENV=production bin/tootctl media remove-orphans
 $ RAILS_ENV=production bin/tootctl preview_cards remove --days 15
 ```
@ -353,8 +354,6 @@ Imports:	1.7 KB
 Settings:	0 Bytes
 ```
 Unfortunately, [old avatars and headers cannot currently be cleaned up](https://github.com/mastodon/mastodon/issues/9567).
 ### Migrating your data
 Data migration should be done with an efficient S3 client.
@ -442,7 +441,7 @@ media_storage_providers:
  store_synchronous: True  # do we want to wait that the file has been written before returning?
  config:
    bucket: matrix       # the name of our bucket, we chose matrix earlier
-    region_name: garage  # only "garage" is supported for the region field
+    region_name: garage  # "garage" by default, edit according to your cluster config
    endpoint_url: http://localhost:3900 # the path to the S3 endpoint
    access_key_id: "GKxxx" # your Key ID
    secret_access_key: "xxxx" # your Secret Key
--- a/doc/book/connect/backup.md
+++ b/doc/book/connect/backup.md
@ -161,3 +161,49 @@ kopia repository validate-provider
 You can then run all the standard kopia commands: `kopia snapshot create`, `kopia mount`...
 Everything should work out-of-the-box.
 ## Plakar
 Create your key and bucket on Garage server:
 ```bash
 garage key create my-plakar-key
 garage bucket create plakar-backups
 garage bucket allow plakar-backups --read --write --key my-plakar-key
 …
 ```
 On Plakar server, add your Garage as a storage location:
 ```bash
 plakar store add garageS3 s3://my-garage.tld/plakar-backups \
 region=garage # Or as you've specified in garage.toml \
 access_key=<Key ID from "garage key info my-plakar-key"> \
 secret_access_key=<Secret key from "garage key info my-plakar-key">
 ```
 Then create the repository.
 ```bash
 plakar at @garageS3 create -plaintext # Unencrypted
 # or
 plakar at @garageS3 create #encrypted
 ```
 If you encrypt your backups (Plakar default), you will need to define a strong passphrase. Do not forget to save your password safely. It will be needed to decrypt your backups.
 After the repository has been created, check that everything works as expected (that might give an empty result as no file has been added yet, but no error message):
 ```bash
 plakar at @garageS3 check
 ```
 Now that everything is configure, you can use Garage as your backups storage. For instance sync it with a local backup storage:
 ```bash
 $ plakar at ~/backups sync to @garageS3
 ```
 Or list the S3 storage content:
 ```bash
 $ plakar at @garageS3 ls
 ```
 More information in Plakar documentation: https://www.plakar.io/docs/main/quickstart/
--- a/doc/book/connect/cli.md
+++ b/doc/book/connect/cli.md
@ -259,7 +259,7 @@ duck --delete garage:/my-files/an-object.txt
 ## WinSCP (libs3) {#winscp}
-*You can find instructions on how to use the GUI in french [in our wiki](https://wiki.deuxfleurs.fr/fr/Guide/Garage/WinSCP).*
+*You can find instructions on how to use the GUI in french [in our wiki](https://guide.deuxfleurs.fr/prise_en_main/winscp/).*
 How to use `winscp.com`, the CLI interface of WinSCP:
--- a/doc/book/connect/repositories.md
+++ b/doc/book/connect/repositories.md
@ -17,7 +17,7 @@ Garage can also help you serve this content.
 ## Gitea
-You can use Garage with Gitea to store your [git LFS](https://git-lfs.github.com/) data, your users' avatar, and their attachements.
+You can use Garage with Gitea to store your [git LFS](https://git-lfs.github.com/) data, your users' avatar, and their attachments.
 You can configure a different target for each data type (check `[lfs]` and `[attachment]` sections of the Gitea documentation) and you can provide a default one through the `[storage]` section.
 Let's start by creating a key and a bucket (your key id and secret will be needed later, keep them somewhere):
--- a/doc/book/cookbook/ansible.md
+++ b/doc/book/cookbook/ansible.md
@ -8,18 +8,18 @@ have published Ansible roles.  We list them and compare them below.
 ## Comparison of Ansible roles
-| Feature                            | [ansible-role-garage](#zorun-ansible-role-garage) | [garage-docker-ansible-deploy](#moan0s-garage-docker-ansible-deploy) |
+| Feature                            | [ansible-role-garage](#zorun-ansible-role-garage) | [garage-docker-ansible-deploy](#moan0s-garage-docker-ansible-deploy) | [eddster ansible-role-garage](#eddster-ansible-role-garage) |
-|------------------------------------|---------------------------------------------|---------------------------------------------------------------|
+|------------------------------------|---------------------------------------------|---------------------------------------------------------------|---------------------------------|
-| **Runtime**                        | Systemd                                     | Docker                                                        |
+| **Runtime**                        | Systemd                                     | Docker                                                        | Systemd                         |
-| **Target OS**                      | Any Linux                                   | Any Linux                                                     |
+| **Target OS**                      | Any Linux                                   | Any Linux                                                     | Any Linux                       |
-| **Architecture**                   | amd64, arm64, i686                          | amd64, arm64                                                  |
+| **Architecture**                   | amd64, arm64, i686                          | amd64, arm64                                                  | arm64, arm, 386, amd64                            |
-| **Additional software**            | None                                        | Traefik                                                       |
+| **Additional software**            | None                                        | Traefik                                                       | Ngnix and Keepalived (optional) |
-| **Automatic node connection**      | ❌                                          | ✅                                                            |
+| **Automatic node connection**      | ❌                                          | ✅                                                            | ✅                              |
-| **Layout management**              | ❌                                          | ✅                                                            |
+| **Layout management**              | ❌                                          | ✅                                                            | ✅                              |
-| **Manage buckets & keys**          | ❌                                          | ✅ (basic)                                                    |
+| **Manage buckets & keys**          | ❌                                          | ✅ (basic)                                                    | ✅                              |
-| **Allow custom Garage config**     | ✅                                          | ❌                                                            |
+| **Allow custom Garage config**     | ✅                                          | ❌                                                            | ❌                              |
-| **Facilitate Garage upgrades**     | ✅                                          | ❌                                                            |
+| **Facilitate Garage upgrades**     | ✅                                          | ❌                                                            | ✅                              |
-| **Multiple instances on one host** | ✅                                          | ✅                                                            |
+| **Multiple instances on one host** | ✅                                          | ✅                                                            | ❌                              |
 ## zorun/ansible-role-garage
@ -49,3 +49,15 @@ structured DNS names, etc).
 As a result, this role makes it easier to start with Garage on Ansible,
 but is less flexible.
 ## eddster2309/ansible-role-garage
 [Source code](https://github.com/eddster2309/ansible-role-garage), [Ansible galaxy](https://galaxy.ansible.com/ui/standalone/roles/eddster2309/garage/)
 This role is a opinionated but customisable role using the official Garage
 static binaries and only requires Systemd. As such it should work on any
 Linux based host. It includes all the nesscary configuration to
 automatically setup a clustered Garage deployment. Most Garage
 configuration options are exposed through Ansible variables so while you
 can't provide a custom config you can get very close. It can optionally
 installed a HA nginx deployment with Keepalived.
--- a/doc/book/cookbook/binary-packages.md
+++ b/doc/book/cookbook/binary-packages.md
@ -15,9 +15,10 @@ Alpine Linux repositories (available since v3.17):
 apk add garage
 ```
-The default configuration file is installed to `/etc/garage.toml`. You can run
+The default configuration file is installed to `/etc/garage/garage.toml`. You can run
-Garage using: `rc-service garage start`. If you don't specify `rpc_secret`, it
+Garage using: `rc-service garage start`.
-will be automatically replaced with a random string on the first start.
+
 If you don't specify `rpc_secret`, it will be automatically replaced with a random string on the first start.
 Please note that this package is built without Consul discovery, Kubernetes
 discovery, OpenTelemetry exporter, and K2V features (K2V will be enabled once
@ -26,7 +27,7 @@ it's stable).
 ## Arch Linux
-Garage is available in the [AUR](https://aur.archlinux.org/packages/garage).
+Garage is available in the official repositories under [extra](https://archlinux.org/packages/extra/x86_64/garage).
 ## FreeBSD
--- a/doc/book/cookbook/encryption.md
+++ b/doc/book/cookbook/encryption.md
@ -53,20 +53,43 @@ and that's also why your nodes have super long identifiers.
 Adding TLS support built into Garage is not currently planned.
-## Garage stores data in plain text on the filesystem
+## Garage stores data in plain text on the filesystem or encrypted using customer keys (SSE-C)
-Garage does not handle data encryption at rest by itself, and instead delegates
+For standard S3 API requests, Garage does not encrypt data at rest by itself.
-to the user to add encryption, either at the storage layer (LUKS, etc) or on
+For the most generic at rest encryption of data, we recommend setting up your
-the client side (or both). There are no current plans to add data encryption
+storage partitions on encrypted LUKS devices.
 directly in Garage.
-Implementing data encryption directly in Garage might make things simpler for
+If you are developping your own client software that makes use of S3 storage,
-end users, but also raises many more questions, especially around key
+we recommend implementing data encryption directly on the client side and never
-management: for encryption of data, where could Garage get the encryption keys
+transmitting plaintext data to Garage. This makes it easy to use an external
-from ? If we encrypt data but keep the keys in a plaintext file next to them,
+untrusted storage provider if necessary.
-it's useless. We probably don't want to have to manage secrets in garage as it
+
-would be very hard to do in a secure way. Maybe integrate with an external
+Garage does support [SSE-C
-system such as Hashicorp Vault?
+encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html),
 an encryption mode of Amazon S3 where data is encrypted at rest using
 encryption keys given by the client.  The encryption keys are passed to the
 server in a header in each request, to encrypt or decrypt data at the moment of
 reading or writing. The server discards the key as soon as it has finished
 using it for the request.  This mode allows the data to be encrypted at rest by
 Garage itself, but it requires support in the client software. It is also not
 adapted to a model where the server is not trusted or assumed to be
 compromised, as the server can easily know the encryption keys.  Note however
 that when using SSE-C encryption, the only Garage node that knows the
 encryption key passed in a given request is the node to which the request is
 directed (which can be a gateway node), so it is easy to have untrusted nodes
 in the cluster as long as S3 API requests containing SSE-C encryption keys are
 not directed to them.
 Implementing automatic data encryption directly in Garage without client-side
 management of keys (something like
 [SSE-S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html))
 could make things simpler for end users that don't want to setup LUKS, but also
 raises many more questions, especially around key management: for encryption of
 data, where could Garage get the encryption keys from? If we encrypt data but
 keep the keys in a plaintext file next to them, it's useless. We probably don't
 want to have to manage secrets in Garage as it would be very hard to do in a
 secure way. At the time of speaking, there are no plans to implement this in
 Garage.
 # Adding data encryption using external tools
--- a/doc/book/cookbook/from-source.md
+++ b/doc/book/cookbook/from-source.md
@ -90,5 +90,6 @@ The following feature flags are available in v0.8.0:
 | `kubernetes-discovery` | optional | Enable automatic registration and discovery<br>of cluster nodes through the Kubernetes API |
 | `metrics` | *by default* | Enable collection of metrics in Prometheus format on the admin API |
 | `telemetry-otlp` | optional | Enable collection of execution traces using OpenTelemetry |
 | `syslog` | optional | Enable logging to Syslog |
 | `lmdb` | *by default* | Enable using LMDB to store Garage's metadata |
-| `sqlite` | optional | Enable using Sqlite3 to store Garage's metadata |
+| `sqlite` | *by default* | Enable using Sqlite3 to store Garage's metadata |
--- a/Show more
+++ b/Show more