kawaandClaude Sonnet 5
8d20d9be84
Sync Gitea releases to GitHub / sync-releases (push) Canceled after 0s
- Local accounts with bcrypt password hashing; first-run setup via POST /api/setup - Personal API tokens (dmv_<48hex>, SHA-256 hashed at rest) for scripted access - Server-side in-memory sessions with 32-byte secure cookie (dockmv_session, 7-day TTL, sliding renewal) - Login rate limiting (exponential backoff 1s–30s cap) per IP - Refuse to bind non-loopback while no account exists, unless DOCKMV_TRUST_ADDR=1 (for Docker's port mapping) - Every account can manage every other account (no roles in v1) - Auth middleware: public-path allowlist (/api/setup, /api/login, /api/logout, /api/me, /api/health) + session cookie check + API token (X-Auth-Token or Authorization: Bearer) check - Frontend AuthGate gates app on GET /api/me; shows setup screen or login form or app tree as needed - Account tab for personal token management; sign-out button in topbar - Break: removed --token flag, DOCKMV_TOKEN env var, ?token= query param, /api/health no longer auto-responds when unauthenticated Verified: go build/vet clean, frontend tsc+vite clean. Sandbox cannot execute binaries to test setup→login→session→token flow at runtime; recommend manual pass before merge. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
37 lines
1.3 KiB
YAML
37 lines
1.3 KiB
YAML
# dockmv, running on the SOURCE host.
|
|
#
|
|
# docker compose up -d
|
|
# docker compose logs dockmv # the URL is printed here
|
|
#
|
|
# The container needs the Docker socket to read containers and stream their
|
|
# data. That is equivalent to root on this host, so the UI is protected by a
|
|
# login (created on first visit) and should not be published to an untrusted
|
|
# network.
|
|
|
|
services:
|
|
dockmv:
|
|
image: git.azuze.fr/kawa/dockmv:${VERSION:-latest}
|
|
container_name: dockmv
|
|
restart: unless-stopped
|
|
ports:
|
|
# Bind to loopback only. Use an SSH tunnel to reach it from elsewhere:
|
|
# ssh -L 8080:127.0.0.1:8080 you@this-host
|
|
- "127.0.0.1:8080:8080"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
# Accounts, connections, trusted SSH host keys and built packages.
|
|
- migrate-data:/data
|
|
environment:
|
|
TZ: ${TZ:-UTC}
|
|
# dockmv listens on 0.0.0.0 *inside* the container so the ports: mapping
|
|
# above can reach it; that mapping (127.0.0.1 on the host side) is the
|
|
# actual loopback restriction, not this bind address. This tells dockmv
|
|
# not to second-guess that and refuse to start before setup is done.
|
|
DOCKMV_TRUST_ADDR: "1"
|
|
command:
|
|
- serve
|
|
- --addr=0.0.0.0:8080
|
|
|
|
volumes:
|
|
migrate-data:
|