Chimera - Public Source
A self-hosted PS4/PS5 library and console operations platform.
Chimera brings library inventory, verified backups, durable transfers, media, console services and guarded operations into one browser or Electron interface. It is intended for consoles, games, backups and homebrew you are authorized to manage.
This is the curated public source edition. Updates are generated from the private canonical repository after validation. Private history, deployment configuration, live data and third-party binaries with unverified redistribution rights are excluded.
Interface
Reference capture of an unconfigured, disconnected dashboard. No live console address, account or library is shown; the interface reports unavailable capabilities rather than claiming a successful connection.
What it does
| Area | Purpose |
|---|---|
| Library | Inventory titles, metadata and locations across local roots and a configured console. |
| Protection | Catalogue backups, verify hashes and preserve recovery evidence. |
| Transfers | Track upload/download/install queues, retries, progress and completion states. |
| Console | Observe explicitly configured services and require confirmation for sensitive operations. |
| Media | Browse and export screenshots and clips. |
| Payloads | Review source metadata, checksums, compatibility and manually initiated workflows. |
| Remote Play | Coordinate a restricted local companion; the native client is installed separately. |
The server uses authentication, CSRF protection, an encrypted secret store and exact destructive confirmations. A queued transfer, an accepted upload and a verified installation are distinct states. Missing prerequisites do not make a feature operational.
Try the source locally
Requires Node.js 24 and npm 11. The browser server is the simplest source-only entry point:
git clone https://gitea.itworx.tech/Jens/chimera-Public.git
cd chimera-Public
npm ci --ignore-scripts
CHIMERA_DATA_DIR="$HOME/.local/share/chimera-evaluation" HOST=127.0.0.1 PORT=6967 npm run start:server
Open http://127.0.0.1:6967, create the administrator when prompted and use a unique password. Server state is created outside tracked source in the application's configured data directory. For a disposable evaluation set CHIMERA_DATA_DIR to an empty directory. Native optional tools and Electron require their separate prerequisites; --ignore-scripts intentionally does not install their binaries.
On Windows PowerShell, set the same local boundary explicitly:
$env:CHIMERA_DATA_DIR = Join-Path $env:LOCALAPPDATA "Chimera-evaluation"
$env:HOST = "127.0.0.1"
$env:PORT = "6967"
npm run start:server
The configured directory is persistent application state. Keep it outside Git and retain it when restarting the server.
Source-only container
Create the external secret files and configure the HTTPS origin before starting the container:
cp .env.example .env
mkdir -p /secure/chimera
openssl rand -base64 32 > /secure/chimera/master.key
openssl rand -base64 32 > /secure/chimera/bootstrap.token
sudo chown 1000:1000 /secure/chimera/master.key /secure/chimera/bootstrap.token
sudo chmod 600 /secure/chimera/master.key /secure/chimera/bootstrap.token
# Edit .env with your actual HTTPS origin and external secret paths.
docker compose up --build -d
Open the configured HTTPS origin, enter the contents of the external bootstrap-token file in the first-run form, create the administrator and select the permitted storage roots. Compose maps CHIMERA_BOOTSTRAP_TOKEN_PATH to the container’s CHIMERA_BOOTSTRAP_TOKEN_FILE. Local loopback evaluation does not require this remote bootstrap token.
Local Compose file secrets keep host permissions. The image runs as UID 1000, so ensure it can read both mounted secret files; adapt the ownership/ACL for rootless Docker.
The public Compose example exposes only 127.0.0.1:6967, persists application state in a named volume and runs as an unprivileged user. The container binds internally to all interfaces so that Docker port forwarding works; HTTPS origin, host and secret settings remain required. It does not mount your host libraries or bundle console payloads/native conversion tools. Start with an empty instance before configuring read-only library mounts.
For network access, use an HTTPS reverse proxy and configure CHIMERA_PUBLIC_ORIGIN, CHIMERA_ALLOWED_HOSTS, CHIMERA_COOKIE_SECURE=1, CHIMERA_TRUST_PROXY=1, a high-entropy master key file and a separate bootstrap-token file. Keep those files outside the repository. The server rejects an incomplete security boundary on non-loopback binds. Do not expose the plain HTTP evaluation port directly to the internet.
Verify startup and preserve state
docker compose config
docker compose ps
docker compose logs --tail=100 chimera
curl http://127.0.0.1:6967/health/live
curl http://127.0.0.1:6967/health/ready
/health/live checks the responding HTTP process. Before administrator setup, /health/ready returns HTTP 503 with setup-required. After setup, inspect its JSON status and volume details: HTTP 200 can still report attention. Neither endpoint proves console connectivity.
Back up persistent application state and the external master-key file together before upgrading. The public chimera-data volume stores configuration, the database, encrypted secrets, logs, caches and application backups. Retain the previous source revision or image for rollback. Removing a named volume with docker compose down -v erases its state.
What works without a console?
You can evaluate administrator setup, navigation, configuration and local state without a console. Console inventory, FTP transfers, media retrieval and console operations need separately configured compatible services. The public container excludes payload binaries and native conversion tools.
Remote Play runs through a separately installed native client on the paired computer. Chimera coordinates that companion; it does not stream console video inside the browser.
Usage
- Create an administrator and review settings.
- Add an authorized console host and the services you actually run.
- Add library or backup roots with the least necessary filesystem access.
- Connect manually, scan inventory and review the observed status.
- Preview a change and provide the requested confirmation before mutation.
Chimera does not provide a jailbreak. Windows-only helpers, console payloads, firmware, package assets and native conversion toolchains are not distributed here. Their associated workflows require separately obtained compatible prerequisites and may be unavailable in this source-only container. Desktop packaging is not a supported public artifact yet.
Architecture and validation
flowchart LR
Browser --> Server[Authenticated HTTP and WebSocket server]
Electron --> Services[Shared application services]
Server --> Services
Services --> State[Local database and encrypted secrets]
Services --> Console[Explicitly configured console services]
renderer/ contains the interface; src/server/ owns the server boundary; src/services/ contains domain workflows; src/persistence/ and src/security/ own storage and credentials. Synthetic tests are under test/.
node scripts/check-syntax.js
node --test --test-concurrency=1 test/server/app-server.test.js
The export manifest records source revision and file hashes. It is source provenance, not evidence that a live console operation or deployment succeeded.
License and attribution
Original Chimera source is licensed under Apache License 2.0. See NOTICE and third-party notices. Porkfolio by StonedModder is the historical starting point; the owner confirmed that its original code has been fully replaced. Dependencies retain their own licenses. No rights to Sony software, firmware, games, trademarks or third-party binaries are granted.
Security and changes
Use the private reporting instructions in SECURITY.md. The public edition receives updates from the canonical repository; publication does not copy private Git history or operational evidence.