I’m looking for a Web app (self-hosted on GNU/Linux server, FLOSS) that allows me to read/create/edit notes and upload/download files (ideally as attachments to notes). It can be a wiki, but it doesn’t have to be.
As I want to access this site also from devices which I don’t trust (e.g., public computers which could have keyloggers installed), and I can’t use a mobile phone for two-factor authentication, I want to use one-time passwords which I’ll print out and carry with me.
I’ll be the only user of the site. My account (or one of my accounts, in case the app requires using a new account for each OTP) should also have a stable password, which I’ll only use on trusted devices.
Accessing the notes (and ideally, but not necessarily, also the files) must only be possible while logged in.
It should let me generate a new set of one-time passwords, and optionally invalidate previously generated unused passwords. Ideally it would only allow this while not using a one-time password currently (or maybe only via SSH, or from an admin account, etc.).
The app should only allow one concurrent session. If multiple sessions are detected (e.g., from different IPs, user agents, whatever) it should logout all of them, requiring me to use another one-time password to login again.
When I’m logging out, the session should be invalidated, so even if an attacker copied my session cookie, they should not be able to browse the site after I logged out.
(I’m aware that this doesn’t protect me from eavesdroppers that have control over the device, as they are able to read what I access, or even take over my session on that device; but the important part is that these eavesdroppers can’t access the site anymore after I logged out/in once.)
