jacobh2
7fb86f5524
- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy. - Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs 0750 1000:1000 and Caddy's /data to 10002. - deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests, warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs only write:package. - Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted read-only at /secrets. - README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks, APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
41 lines
1.2 KiB
Bash
Executable File
41 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Starts the development server (infra/dev/compose.yaml), waits for GET /health and prints the URLs.
|
|
# KVITT_PUBLIC_URL defaults to http://<Mac LAN address>:<port> when the env file leaves it empty.
|
|
# Usage: infra/dev/up.sh Stop with: infra/dev/up.sh --down
|
|
set -euo pipefail
|
|
# shellcheck source=lib.sh
|
|
. "$(dirname "$0")/lib.sh"
|
|
|
|
if [[ "${1:-}" == "--down" ]]; then
|
|
compose down
|
|
exit 0
|
|
fi
|
|
|
|
port="$(env_value KVITT_DEV_PORT 8080)"
|
|
lan="$(lan_address || true)"
|
|
|
|
public_url="$(env_value KVITT_PUBLIC_URL)"
|
|
if [[ -z "$public_url" ]]; then
|
|
if [[ -n "$lan" ]]; then public_url="http://$lan:$port"; else public_url="http://localhost:$port"; fi
|
|
fi
|
|
export KVITT_PUBLIC_URL="$public_url"
|
|
|
|
data_dir="$(dev_path "$(env_value KVITT_DEV_DATA_DIR ./data)")"
|
|
mkdir -p "$data_dir"
|
|
stage_fcm_key
|
|
|
|
compose up -d server
|
|
|
|
echo "Waiting for http://localhost:$port/health ..."
|
|
for _ in $(seq 1 30); do
|
|
if body="$(curl -fsS "http://localhost:$port/health" 2>/dev/null)"; then
|
|
echo "health: $body"
|
|
echo "Mac: http://localhost:$port"
|
|
[[ -n "$lan" ]] && echo "Phone: http://$lan:$port (home Wi-Fi)"
|
|
echo "Invites: $public_url"
|
|
exit 0
|
|
fi
|
|
sleep 1
|
|
done
|
|
die "/health did not answer within 30 s; see infra/dev/logs.sh"
|