jacobh2
7fb86f5524
- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy. - Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs 0750 1000:1000 and Caddy's /data to 10002. - deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests, warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs only write:package. - Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted read-only at /secrets. - README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks, APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
54 lines
2.0 KiB
Bash
54 lines
2.0 KiB
Bash
#!/usr/bin/env bash
|
|
# Shared helpers for the infra/dev scripts. Sourced, not run.
|
|
# shellcheck disable=SC2034 # variables are used by the scripts that source this file
|
|
|
|
dev_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
repo_root="$(cd "$dev_dir/../.." && pwd)"
|
|
|
|
# infra/dev/.env (git-ignored) when it exists, otherwise the committed example.
|
|
if [[ -f "$dev_dir/.env" ]]; then env_file="$dev_dir/.env"; else env_file="$dev_dir/.env.example"; fi
|
|
|
|
die() { printf '%s: %s\n' "$(basename "$0")" "$*" >&2; exit 1; }
|
|
|
|
# Value of KEY in the env file; DEFAULT (the compose.yaml default, optional) when unset or blank.
|
|
env_value() {
|
|
local v
|
|
v="$(sed -n "s/^$1=//p" "$env_file" | tail -n 1)"
|
|
printf '%s\n' "${v:-${2:-}}"
|
|
}
|
|
|
|
compose() {
|
|
docker compose -f "$dev_dir/compose.yaml" --env-file "$env_file" "$@"
|
|
}
|
|
|
|
# Resolve a path from the env file the way compose does: relative to infra/dev/.
|
|
dev_path() {
|
|
case "$1" in
|
|
/*) printf '%s\n' "$1" ;;
|
|
*) printf '%s\n' "$dev_dir/$1" ;;
|
|
esac
|
|
}
|
|
|
|
# The Mac's address on the interface that carries the default route (the home Wi-Fi).
|
|
lan_address() {
|
|
local iface
|
|
iface="$(route -n get default 2>/dev/null | awk '/interface:/ {print $2}')"
|
|
[[ -n "$iface" ]] && ipconfig getifaddr "$iface" 2>/dev/null
|
|
}
|
|
|
|
# Fill infra/dev/secrets/ (git-ignored, mounted read-only at /secrets) with only the FCM key from
|
|
# KVITT_SECRETS_DIR, so the server container sees no other secret (D-117). Without the key the folder is left
|
|
# empty and the server starts with push disabled (§10.4).
|
|
stage_fcm_key() {
|
|
local src stage="$dev_dir/secrets"
|
|
src="$(dev_path "$(env_value KVITT_SECRETS_DIR ../secrets)")/fcm-service-account.json"
|
|
install -d -m 0700 "$stage"
|
|
find "$stage" -mindepth 1 -maxdepth 1 ! -name fcm-service-account.json -exec rm -rf {} +
|
|
if [[ -f "$src" ]]; then
|
|
install -m 0600 "$src" "$stage/fcm-service-account.json"
|
|
else
|
|
rm -f "$stage/fcm-service-account.json"
|
|
echo "$(basename "$0"): no $src; the server starts with push disabled." >&2
|
|
fi
|
|
}
|