secure/trusted replication

[mchangrh]

maybe for the future, but in order to have secure replication, there must be some sort of central trust database or some way to validate the files. This can be done with hashes such as xxh3 which runs at RAM or L3 cache speeds

This isn't that difficult to integrate but requires validation of the hash itself, either by downloading them from the main server over rsync or https. While the risk of bad data is possible, it's less likely once a list of trusted individuals/ mirrors is established

a hypothetical would go like this:

server

• generates new dumps
• xxh3 is generated along with dump
• push is sent over webhook with xxh3 hash
• xxh3hash file generated in dump

mirror

• receive xxh3hash by webhook or rsync
• download new files
• verify against hashes from main server