100 lines
6.1 KiB
Markdown
100 lines
6.1 KiB
Markdown
# Chimera — Public Source
|
|
|
|
**A self-hosted PS4/PS5 library and console operations platform.**
|
|
|
|
Chimera brings library inventory, verified backups, durable transfers, media, console services and guarded operations into one browser or Electron interface. It is intended for consoles, games, backups and homebrew you are authorized to manage.
|
|
|
|
> This is the curated public source edition. Updates are generated from the private canonical repository after validation. Private history, deployment configuration, live data and third-party binaries with unverified redistribution rights are excluded.
|
|
|
|
## Interface
|
|
|
|
|
|
|
|
*Reference capture of an unconfigured, disconnected dashboard. No live console address, account or library is shown; the interface reports unavailable capabilities rather than claiming a successful connection.*
|
|
|
|
## What it does
|
|
|
|
| Area | Purpose |
|
|
|---|---|
|
|
| Library | Inventory titles, metadata and locations across local roots and a configured console. |
|
|
| Protection | Catalogue backups, verify hashes and preserve recovery evidence. |
|
|
| Transfers | Track upload/download/install queues, retries, progress and completion states. |
|
|
| Console | Observe explicitly configured services and require confirmation for sensitive operations. |
|
|
| Media | Browse and export screenshots and clips. |
|
|
| Payloads | Review source metadata, checksums, compatibility and manually initiated workflows. |
|
|
| Remote Play | Coordinate a restricted local companion; the native client is installed separately. |
|
|
|
|
The server uses authentication, CSRF protection, an encrypted secret store and exact destructive confirmations. A queued transfer, an accepted upload and a verified installation are distinct states. Missing prerequisites do not make a feature operational.
|
|
|
|
## Try the source locally
|
|
|
|
Requires **Node.js 24** and **npm 11**. The browser server is the simplest source-only entry point:
|
|
|
|
```bash
|
|
git clone https://gitea.itworx.tech/Jens/chimera-Public.git
|
|
cd chimera-Public
|
|
npm ci --ignore-scripts
|
|
HOST=127.0.0.1 PORT=6967 npm run start:server
|
|
```
|
|
|
|
Open `http://127.0.0.1:6967`, create the administrator when prompted and use a unique password. Server state is created outside tracked source in the application's configured data directory. For a disposable evaluation set `CHIMERA_DATA_DIR` to an empty directory. Native optional tools and Electron require their separate prerequisites; `--ignore-scripts` intentionally does not install their binaries.
|
|
|
|
### Source-only container
|
|
|
|
Create the external secret files and configure the HTTPS origin before starting the container:
|
|
|
|
```bash
|
|
cp .env.example .env
|
|
mkdir -p /secure/chimera
|
|
openssl rand -base64 32 > /secure/chimera/master.key
|
|
openssl rand -base64 32 > /secure/chimera/bootstrap.token
|
|
sudo chown 1000:1000 /secure/chimera/master.key /secure/chimera/bootstrap.token
|
|
sudo chmod 600 /secure/chimera/master.key /secure/chimera/bootstrap.token
|
|
# Edit .env with your actual HTTPS origin and external secret paths.
|
|
docker compose up --build -d
|
|
```
|
|
|
|
Local Compose file secrets keep host permissions. The image runs as UID 1000, so ensure it can read both mounted secret files; adapt the ownership/ACL for rootless Docker.
|
|
|
|
The public Compose example exposes only `127.0.0.1:6967`, persists application state in a named volume and runs as an unprivileged user. The container binds internally to all interfaces so that Docker port forwarding works; HTTPS origin, host and secret settings remain required. It does not mount your host libraries or bundle console payloads/native conversion tools. Start with an empty instance before configuring read-only library mounts.
|
|
|
|
For network access, use an HTTPS reverse proxy and configure `CHIMERA_PUBLIC_ORIGIN`, `CHIMERA_ALLOWED_HOSTS`, `CHIMERA_COOKIE_SECURE=1`, `CHIMERA_TRUST_PROXY=1`, a high-entropy master key file and a separate bootstrap-token file. Keep those files outside the repository. The server rejects an incomplete security boundary on non-loopback binds. Do not expose the plain HTTP evaluation port directly to the internet.
|
|
|
|
## Usage
|
|
|
|
1. Create an administrator and review settings.
|
|
2. Add an authorized console host and the services you actually run.
|
|
3. Add library or backup roots with the least necessary filesystem access.
|
|
4. Connect manually, scan inventory and review the observed status.
|
|
5. Preview a change and provide the requested confirmation before mutation.
|
|
|
|
Chimera does not provide a jailbreak. Windows-only helpers, console payloads, firmware, package assets and native conversion toolchains are not distributed here. Their associated workflows require separately obtained compatible prerequisites and may be unavailable in this source-only container. Desktop packaging is not a supported public artifact yet.
|
|
|
|
## Architecture and validation
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
Browser --> Server[Authenticated HTTP and WebSocket server]
|
|
Electron --> Services[Shared application services]
|
|
Server --> Services
|
|
Services --> State[Local database and encrypted secrets]
|
|
Services --> Console[Explicitly configured console services]
|
|
```
|
|
|
|
`renderer/` contains the interface; `src/server/` owns the server boundary; `src/services/` contains domain workflows; `src/persistence/` and `src/security/` own storage and credentials. Synthetic tests are under `test/`.
|
|
|
|
```bash
|
|
node scripts/check-syntax.js
|
|
node --test --test-concurrency=1 test/server/app-server.test.js
|
|
```
|
|
|
|
The export manifest records source revision and file hashes. It is source provenance, not evidence that a live console operation or deployment succeeded.
|
|
|
|
## License and attribution
|
|
|
|
Original Chimera source is licensed under [Apache License 2.0](LICENSE). See [NOTICE](NOTICE) and [third-party notices](THIRD_PARTY_NOTICES.md). Porkfolio by StonedModder is the historical starting point; the owner confirmed that its original code has been fully replaced. Dependencies retain their own licenses. No rights to Sony software, firmware, games, trademarks or third-party binaries are granted.
|
|
|
|
## Security and changes
|
|
|
|
Use the private reporting instructions in [SECURITY.md](SECURITY.md). The public edition receives updates from the canonical repository; publication does not copy private Git history or operational evidence.
|