Add README with setup, usage, architecture, and security docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -0,0 +1,75 @@
+# TinyWeb
+
+A personal, decentralized search engine built on the [Reticulum](https://reticulum.network/) mesh network. Curate your own index of web pages, search it locally, and share collections with friends over an encrypted mesh. No algorithms, no ads, no tracking.
+
+## Features
+
+- **Personal search index** — Save pages you find valuable, search them with full-text search (SQLite FTS5)
+- **Tagging** — Organize saved pages with comma-separated tags
+- **Bookmarklet** — One-click indexing from any browser tab
+- **Subscriptions** — Subscribe to friends' TinyWeb instances over Reticulum and search their indexes alongside yours
+- **Custom templates** — Full HTML/CSS/JS template editor to personalize your instance
+- **Import/export** — JSON-based backup and restore
+- **Mesh-native** — Works over Reticulum without the internet; encrypted and decentralized by default
+
+## Getting started
+
+```bash
+pip install -r requirements.txt
+python app.py
+```
+
+This starts the Reticulum server and an HTTP gateway on `http://localhost:8080`. Open it in your browser.
+
+Your destination hash is printed on startup — share it with friends so they can subscribe to your index.
+
+## Remote gateway
+
+To browse a remote TinyWeb instance without running your own index:
+
+```bash
+python gateway.py <destination_hash>
+```
+
+This connects over Reticulum and serves the remote instance at `http://localhost:8080`.
+
+## How it works
+
+1. **Save pages** — Use the `/add` form or the bookmarklet (found on `/style`) to index any URL
+2. **Search** — Full-text search across your saved pages, linked pages from trusted sites, and synced subscriptions
+3. **Subscribe** — Add a friend's destination hash on `/subscriptions` to sync their shared index
+4. **Customize** — Edit your site name, HTML template, and sharing settings on `/style`
+
+## Project structure
+
+```
+app.py          — Entry point: boots Reticulum, starts HTTP gateway
+gateway.py      — HTTP-to-RNS bridge (local or remote dispatch)
+handlers.py     — Route dispatcher and all request handlers
+db.py           — SQLite database, FTS5, URL fetching, SSRF protection
+templates.py    — HTML template rendering and escaping
+rns_client.py   — Reticulum client for fetching remote site lists
+themes/         — Saved HTML templates (e.g. kodama.html)
+```
+
+## Security
+
+TinyWeb includes several hardening measures:
+
+- **CSRF protection** — All POST forms use per-session tokens via double-submit cookies
+- **SSRF prevention** — URL fetching validates hostnames against private IP ranges, with redirect re-validation
+- **FTS5 injection prevention** — Search queries are sanitized before passing to SQLite MATCH
+- **Content Security Policy** — CSP headers on all HTML responses restrict script/style/frame sources
+- **XSS escaping** — All user-supplied content is HTML-escaped before rendering
+- **Bookmark authentication** — The bookmarklet endpoint requires a secret token
+- **Identity file protection** — The Reticulum identity key is restricted to owner-only permissions (0600)
+
+## Dependencies
+
+- [requests](https://docs.python-requests.org/) — HTTP fetching
+- [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/) — HTML parsing and link extraction
+- [rns](https://reticulum.network/) — Reticulum mesh networking
+
+## Philosophy
+
+TinyWeb is built for the slow web — intentionality over speed, human curation over algorithmic feeds, privacy over surveillance, and community over corporations. Every page in your index was saved because you found it valuable, not because an algorithm told you to click.