MemoriC

Your photos, your storage. Always private.

MemoriC is a privacy-first photo backup and gallery app. The web app and tunnel broker run on memory.clouderized.com. A lightweight agent runs on the customer's home machine and stores all full-resolution photos. Photos never rest on the server — only thumbnails do.

Built on the Clouderized platform (dogfooding).

---

Docs

File	Contents
SPEC.md	Full product spec — architecture, data flow, tiers
PLAN.md	Build plan — phases and milestones
memory/	Broker service (FastAPI)
agent/	Home agent (Go)
memoric-app/	Android app (Flutter)

Run Agent As User Service (Linux)

From repo root:

cd agent
./install-user-service.sh

Then manage with:

systemctl --user start memoric-agent
systemctl --user stop memoric-agent
systemctl --user status memoric-agent
journalctl --user -u memoric-agent -f

Default photo storage path:

• ~/memoric/photos

To use a different path, edit:

• ~/.config/systemd/user/memoric-agent.service and change Environment=STORAGE_DIR=..., then run:

systemctl --user daemon-reload
systemctl --user restart memoric-agent

Run Agent On Windows (User Task)

From PowerShell (repo root):

cd agent
.\install-windows-task.ps1

This installs a per-user Scheduled Task (MemoriCAgent) that starts on login and writes photos to:

• %USERPROFILE%\memoric\photos

Manage with:

schtasks /Query /TN MemoriCAgent /V /FO LIST
schtasks /Run /TN MemoriCAgent
schtasks /End /TN MemoriCAgent
cd agent
.\uninstall-windows-task.ps1

Agent LAN Bind and Security (Phase 1)

The agent now exposes a local API/UI listener for LAN-ready control.

Defaults:

• bind_host: 0.0.0.0
• bind_port: 5051
• allowed_subnets: private ranges (10/8, 172.16/12, 192.168/16, loopback, ULA/link-local IPv6)

Config file path:

• Linux/macOS: ~/.config/memoric-agent/config.json
• Windows: %AppData%\memoric-agent\config.json

Example config:

{
  "storage_dir": "/home/you/memoric/photos",
  "bind_host": "0.0.0.0",
  "bind_port": 5051,
  "allowed_subnets": ["192.168.0.0/16", "10.0.0.0/8", "127.0.0.0/8"],
  "auth_mode": "pairing_token",
  "pairing_token": "change-me"
}

Environment overrides (optional):

• STORAGE_DIR
• AGENT_BIND_HOST
• AGENT_BIND_PORT
• AGENT_ALLOWED_SUBNETS (comma-separated CIDRs)
• AGENT_PAIRING_TOKEN

Phase 1 endpoints:

• GET /healthz (subnet-restricted)
• GET /api/status (subnet-restricted)
• POST /api/control/ping (subnet-restricted + token auth)

Auth for mutable endpoints:

• Authorization: Bearer <pairing_token> or X-Agent-Token: <pairing_token>
• If no pairing_token is configured, the agent generates and persists one on startup.

Pairing lifecycle endpoints:

• GET /api/pairing/status (subnet-restricted)
• GET /api/pairing/reveal (subnet-restricted, localhost only)
• POST /api/pairing/rotate (subnet-restricted + current token auth)
• POST /agents/pairing-token on broker (app JWT required; stores only a token hash)