← Back to Gallery

🐕🖼️✨🔒 DoggyGallery FAQ
🔍 Filter 📚 API

What is DoggyGallery?

DoggyGallery is a secure, self-hosted media gallery server for serving images and videos over HTTPS. It's designed with security as the top priority, enforcing modern encryption standards and authentication.

📦 Installation & Resources:
🔒 How does authentication work?

DoggyGallery uses HTTP Basic Authentication over TLS 1.3. While HTTP Basic Auth sends credentials with each request, it is completely safe when used with TLS 1.3 because:

  • All traffic is encrypted end-to-end - Your credentials are encrypted before leaving your device
  • TLS 1.3 only - We enforce the latest TLS version with no fallback to older, vulnerable protocols
  • Constant-time comparison - Credentials are validated using timing-attack resistant algorithms
  • Credentials zeroized - Passwords are securely erased from memory after use
Why TLS 1.3 makes HTTP Basic Auth secure:

TLS 1.3 provides forward secrecy, authenticated encryption, and eliminates all known vulnerabilities from older TLS versions. When credentials are sent over TLS 1.3, they're protected by AES-256-GCM or ChaCha20-Poly1305 encryption, making interception impossible without compromising the TLS connection itself.

🛡️ What security features does DoggyGallery have?

DoggyGallery implements multiple layers of security protection:

Transport Security:

  • TLS 1.3 enforcement - Only the latest TLS protocol is accepted (no TLS 1.2 or older)
  • HSTS headers - Forces browsers to always use HTTPS
  • Modern cipher suites - Uses only secure, forward-secret ciphers

Authentication Security:

  • Rate limiting - Limits failed login attempts (10 attempts per 60 seconds per IP)
  • Constant-time comparison - Prevents timing attacks during credential validation
  • Memory protection - Passwords are zeroized from memory using the zeroize crate
  • Failed attempt logging - All authentication failures are logged with client IPs

Content Security:

  • Path traversal protection - Prevents access to files outside the media directory
  • SVG XSS protection - SVG files are sandboxed with restrictive CSP headers
  • Security headers - X-Frame-Options, X-Content-Type-Options, CSP, and more
  • Media-only serving - Only image and video files can be accessed
🚨 How does rate limiting work?

DoggyGallery implements smart rate limiting that only restricts failed authentication attempts:

  • Failed logins are tracked per IP address
  • After 10 failed attempts within 60 seconds, the IP is temporarily blocked
  • Successful authentication immediately clears the rate limit for that IP
  • Once authenticated, users can make unlimited requests - no browsing restrictions
  • Old entries are cleaned up automatically every 5 minutes
Design Philosophy: Rate limiting should protect against brute-force attacks without hindering legitimate users. Once you're authenticated, browse freely!
🔐 What about TLS certificates?

DoggyGallery supports two certificate modes:

1. Self-signed certificates (development):

  • Use --self-signed-certs-on-the-fly to generate certificates automatically
  • Certificates are generated fresh on each startup using rcgen
  • Great for local development and testing
  • Browsers will show security warnings (expected behavior)

2. Custom certificates (production):

  • Use --cert and --key to provide your own certificate files
  • Supports certificates from Let's Encrypt, commercial CAs, or your own CA
  • Required for production deployments
  • No browser warnings when using trusted certificates
⚠️ Production Warning: Always use proper, CA-signed certificates in production. Self-signed certificates should only be used for development and testing.
📁 What file types are supported?

DoggyGallery supports images, videos, and audio files in a beautiful, responsive grid:

Images:

  • Loading...

Videos:

  • Loading...

Audio:

  • Loading...

Files are displayed with thumbnails, and clicking opens them in a lightbox with navigation controls. All other file types are ignored for security.

MIME Type Validation: DoggyGallery validates file content using magic bytes, not just extensions. This prevents malicious files disguised with fake extensions (e.g., malware.exe renamed to photo.jpg) from being served.
📱 What are the navigation features?

DoggyGallery includes mobile-friendly navigation controls:

  • Keyboard shortcuts: Use arrow keys to navigate left/right, Escape to close
  • Touch gestures: Swipe left/right on mobile devices to navigate between images
  • Navigation buttons: On-screen Prev/Next buttons for easy navigation
  • Random button: Jump to a random image in the current gallery
  • Arrow buttons: Large arrow overlays on the sides of the lightbox
Mobile Optimized: All controls are sized appropriately for touch interaction, with large tap targets and smooth transitions.
🔍 What privacy measures are in place?

DoggyGallery respects your privacy:

  • No analytics - No tracking cookies, no third-party scripts
  • Minimal logging - Only authentication attempts and errors are logged
  • Self-hosted - Your media never leaves your server
  • No external dependencies - All assets are served locally
  • IP privacy - IP addresses are only used for rate limiting and not permanently stored
🔮 Is DoggyGallery quantum-resistant?

Yes! DoggyGallery uses AWS-LC-RS cryptography which provides a foundation for post-quantum security:

Current Quantum-Resistant Features:

  • AWS-LC-RS crypto provider - Amazon's cryptographic library with NIST post-quantum algorithm implementations
  • 256-bit cipher suites only - AES-256-GCM-SHA384 and ChaCha20-Poly1305-SHA256 (no AES-128 allowed)
  • X25519 key exchange - Current standard with path to post-quantum upgrade
  • TLS 1.3 only - Latest protocol with strongest security properties

What is AWS-LC-RS?

AWS-LC-RS is a Rust cryptographic library maintained by Amazon Web Services. It's built on AWS-LC (AWS's fork of BoringSSL) and includes:

  • FIPS-validated cryptographic implementations
  • Post-quantum algorithm research and implementations
  • Preparation for NIST post-quantum standards (ML-KEM, ML-DSA)
  • Battle-tested code used in AWS production infrastructure
Future-Proof Design: When NIST finalizes post-quantum cryptographic standards like ML-KEM (Kyber) for key exchange and ML-DSA (Dilithium) for signatures, DoggyGallery can adopt them by simply updating the AWS-LC-RS library. The architecture is already in place.
Why This Matters: Quantum computers pose a future threat to current cryptography. By using AWS-LC-RS now with strong 256-bit ciphers, DoggyGallery is positioned to seamlessly adopt post-quantum key exchange algorithms as they become standardized, protecting against "harvest now, decrypt later" attacks.
🌐 What about HTTP/2 and HTTP/3?

DoggyGallery enforces HTTP/2 only - there is no fallback to HTTP/1.1. This provides significant performance and security benefits:

HTTP/2 Benefits:

  • Multiplexing: Multiple requests over a single TCP connection
  • Header compression: Reduces overhead significantly
  • Server push: Proactive resource delivery
  • Binary protocol: More efficient parsing
  • Stream prioritization: Better resource loading order

Why not HTTP/3?

HTTP/3 uses QUIC (UDP-based) instead of TCP, which requires a completely different server architecture. While HTTP/3 offers benefits like:

  • Faster connection establishment
  • Better handling of packet loss
  • Connection migration

...implementing it would require migrating from axum-server to quinn or h3, which is beyond the current scope. HTTP/2 over TLS 1.3 already provides excellent performance and security.

Current Stack: TLS 1.3 + HTTP/2 ONLY
All connections must support HTTP/2. Clients that don't support HTTP/2 (very rare in 2025) will not be able to connect.
🛠️ How do I self-host DoggyGallery?

DoggyGallery is built with Rust and designed for easy deployment:

Quick Start: 

# Build the project
cargo build --release

# Run with self-signed certs (development)
./target/release/doggygallery \
    --self-signed-certs-on-the-fly \
    --media-dir /path/to/media \
    --username admin \
    --password "your-secure-password" \
    --host 0.0.0.0 \
    --port 7833

# Run with custom certificates (production)
./target/release/doggygallery \
    --cert /path/to/cert.pem \
    --key /path/to/key.pem \
    --media-dir /path/to/media \
    --username admin \
    --password "your-secure-password"

All options can also be set via environment variables. See the README for full deployment instructions.

⚠️ Security best practices

To maximize security when running DoggyGallery:

  • Use strong passwords - Long, random passwords for authentication
  • Use proper certificates - Get free certificates from Let's Encrypt for production
  • Keep it updated - Regularly update to get the latest security patches
  • Restrict network access - Use firewall rules to limit who can reach the server
  • Monitor logs - Watch for suspicious authentication patterns
  • Run with minimal privileges - Don't run as root; use a dedicated service account
  • Keep dependencies updated - Run cargo audit regularly
📞 How do I report security issues?

If you discover a security vulnerability in DoggyGallery:

Responsible disclosure helps keep all users secure.