Module proxy 

Pictures, files and previews fetched by the user’s Magnitude server instead of by this device.

A picture loaded here, a file downloaded here, or a page previewed here is a request from this device’s address to whoever hosts the thing, and most of it arrives without a click: sending someone a link or an emoji is enough to learn where they are. Magnitude fetches on the client’s behalf (magnitude-unfurl for a page’s metadata, magnitude-proxy for everything else), advertised in its information document. This module finds the first configured server that offers it and routes through it, under one privacy setting, on by default.

Every outbound request in every crate resolves its destination through crate::net::egress, which asks here. The only requests that never come through are the ones that cannot: Nostr relay sockets, and the signed writes (upload, mirror, delete, discovery) to a Blossom server the user chose, which already carry the user’s key.

When the setting is on and no configured server offers previews, there is no preview: falling back to fetching the page here would be the leak with a new name. Pictures do fall back to a direct load when no server offers the proxy, because an avatar that never appears is not a privacy feature anyone chose; the setting’s own help text says so.

Constants

PROXY_EXT

SETTING_KEY

UNFURL_EXT

Functions

enabled

The setting, read fresh each time: it is one SQLite row and a change in Settings must take effect on the next picture, not the next launch.

forget_picks

Forget the remembered picks: the server list or a setting changed.

proxied

Where to actually load url from. The proxy’s address when the setting is on, a server offers it, and the URL is somebody else’s; None means load it directly. A blob on one of the user’s own servers is already theirs to fetch, and a proxy URL is not proxied again.

proxy_authorization

A signed Authorization for a proxied request, so the proxy charges the account rather than the address and a recognised account gets its own allowance. None when nobody is signed in; the proxy then treats the request as a stranger’s, which still works.

proxy_server_of

The proxy server a proxied URL points at, so its authorization can be scoped to it.

proxy_url

server_offering

The first configured Blossom server whose information document lists extension, as an origin without a trailing slash.

wants_proxy

Everything over http(s) that is not ours goes through the proxy: a picture, an avatar, an emoji, and an attachment on somebody’s Blossom server, which otherwise learns the recipient’s address on every download. Only our own domains load directly, and a URL that is already a proxy or preview request is never wrapped again.