andrew/alembic
1
0
Fork 0
Code Pull Requests Actions Releases 18 Wiki Activity

Security hardening and first-run/portability improvements

Browse Source 
Security (P0):
- Remove committed session-secret default; auto-generate and persist a
  random secret to the config volume when SESSION_SECRET is unset
  (prevents forgeable session cookies / auth bypass).
- Validate playlist names to a safe charset and render sldl configs via
  literal Python substitution instead of sed (closes a command-injection
  and path-traversal path through playlist names).
- shlex-quote credential values written to shell-sourced env files, and
  strip newlines from values patched into .conf files.
- Render playlist .conf files 0600; warn at startup if the master key is
  co-located with the config volume; document keeping it separate.

Portability:
- Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton.
- Remove personal defaults (navidrome user "andrew", ephemeral.club URLs).
- Ship generic example seeds; move the cross-album dedup keep-list and the
  legacy playlist import to editable config files; drop the personal
  _upgrade.csv.
- Generic VPN reference in docker-compose.snippet.yml.

First-run experience:
- Redirect to /setup instead of 500 when OIDC is unconfigured; surface a
  missing master key inline; entrypoint exits with an actionable message
  when the config folder is not writable.
- Add unauthenticated /health (JSON) and /setup (checklist) diagnostics.

Docs:
- Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced
  but missing); expand README with ownership, backups, advanced settings,
  and migration guidance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
andrew
2026-07-09 14:25:55 -06:00
parent 2a19f84575
commit b135f11557
40 changed files with 759 additions and 600 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pipeline/lib/backfill-buy-url.py
+1 -1
View File
@@ -146,7 +146,7 @@ def main():
ap.add_argument("--force", action="store_true",
help="overwrite an existing buy-link tag")
ap.add_argument("--azuracast-key", default=None)
ap.add_argument("--azuracast-base", default="https://admin.ephemeral.club")
ap.add_argument("--azuracast-base", default=os.environ.get("AZURACAST_BASE", ""))
ap.add_argument("--station", type=int, default=1)
ap.add_argument("--username", default=None,
help="Bandcamp username; default read from config.env if present")
pipeline/lib/backfill-spotify-tags.sh
+1 -1
View File
@@ -62,7 +62,7 @@ beet move 2>&1 | tail -5 >> "$LOG"
NAVIDROME_ENV="${ALEMBIC_CONFIG_DIR:-/config}/pipeline/navidrome/admin.env"
[ -f "$NAVIDROME_ENV" ] && source "$NAVIDROME_ENV"
ND_BASE="${ND_BASE:-http://navidrome:4533}"
ND_USER="${ND_USER:-andrew}"
ND_USER="${ND_USER:-}"
ND_PASS="${ND_PASS:-}"
echo "[$(date -Iseconds)] Triggering Navidrome full scan" | tee -a "$LOG"
pipeline/lib/dedup-library.sh
+17 -2
View File
@@ -407,8 +407,23 @@ log "[$(date -Iseconds)] === Pass 4: cross-album dedup (artist+title-base) ==="
beet ls -f "\$id${SEP}\$albumartist${SEP}\$album${SEP}\$title${SEP}\$path" \
2>/dev/null > /tmp/all-tracks.txt
# Pass artist + album allowlists into awk via -v
CROSS_ALBUM_KEEP_RE='^(porterrobinson|madeon|variousartists)$'
# Pass artist + album allowlists into awk via -v.
# The artist keep-list (artists whose same-title tracks across albums are NOT
# treated as duplicates) is user-editable config, not baked in here. Build the
# anchored regex from cross-album-keep.list: normalize each name the same way
# the awk norm() does (lowercase, letters+digits only) and OR them together.
# An empty/absent list means "protect nobody" -> use a pattern that can never
# match a normalized name (which only ever contains [a-z0-9], never '_').
CROSS_ALBUM_KEEP_FILE="${ALEMBIC_CONFIG_DIR:-/config}/pipeline/cross-album-keep.list"
if [[ -f "$CROSS_ALBUM_KEEP_FILE" ]]; then
_keep_names=$(grep -vE '^[[:space:]]*(#|$)' "$CROSS_ALBUM_KEEP_FILE" \
| tr 'A-Z' 'a-z' | sed -E 's/[^a-z0-9]//g' | grep -v '^$' | paste -sd'|' -)
fi
if [[ -n "${_keep_names:-}" ]]; then
CROSS_ALBUM_KEEP_RE="^(${_keep_names})\$"
else
CROSS_ALBUM_KEEP_RE='_never_'
fi
# Album-name patterns that indicate "intentional alt version" — these rows are
# filtered out before grouping, so any group needing 2+ matches will only form
# from items whose albums DON'T look like remix/live/single-version releases.
pipeline/lib/enrich-buy-url.py
+1 -1
View File
@@ -391,7 +391,7 @@ def main():
"re-matching — converts by album id. Skips links that "
"aren't purchasable (leaves them intact).")
ap.add_argument("--azuracast-key", default=None)
ap.add_argument("--azuracast-base", default="https://admin.ephemeral.club")
ap.add_argument("--azuracast-base", default=os.environ.get("AZURACAST_BASE", ""))
ap.add_argument("--station", type=int, default=1)
args = ap.parse_args()
pipeline/lib/export-laptop-playlists.py
+1 -1
View File
@@ -82,7 +82,7 @@ def _load_navidrome_env():
_nd_env = _load_navidrome_env()
ND_BASE = _nd_env.get("ND_BASE", "http://navidrome:4533")
ND_USER = _nd_env.get("ND_USER", "andrew")
ND_USER = _nd_env.get("ND_USER", "")
ND_PASS = _nd_env.get("ND_PASS", "")
ND_API_VERSION = "1.16.0"
ND_CLIENT = "dj-export"
pipeline/lib/fix-empty-album.sh
+1 -1
View File
@@ -22,7 +22,7 @@ mkdir -p "$(dirname "$LOG")"
NAVIDROME_ENV="${ALEMBIC_CONFIG_DIR:-/config}/pipeline/navidrome/admin.env"
[ -f "$NAVIDROME_ENV" ] && source "$NAVIDROME_ENV"
ND_BASE="${ND_BASE:-http://navidrome:4533}"
ND_USER="${ND_USER:-andrew}"
ND_USER="${ND_USER:-}"
ND_PASS="${ND_PASS:-}"
log() { echo "[$(date -Iseconds)] $*" | tee -a "$LOG"; }
pipeline/lib/fix-track-metadata.py
+1 -1
View File
@@ -68,7 +68,7 @@ def _load_navidrome_env():
_nd_env = _load_navidrome_env()
NAVIDROME_URL = f"{_nd_env.get('ND_BASE', 'http://navidrome:4533')}/rest/startScan.view"
NAVIDROME_USER = _nd_env.get("ND_USER", "andrew")
NAVIDROME_USER = _nd_env.get("ND_USER", "")
NAVIDROME_PASS = _nd_env.get("ND_PASS", "")
VORBIS_LIKE = (FLAC, OggOpus, OggVorbis)
pipeline/lib/import-dj-collection.py
+1 -1
View File
@@ -97,7 +97,7 @@ _nd_env = _load_navidrome_env()
# Subsonic
ND_BASE = _nd_env.get("ND_BASE", "http://navidrome:4533")
ND_USER = _nd_env.get("ND_USER", "andrew")
ND_USER = _nd_env.get("ND_USER", "")
ND_PASS = _nd_env.get("ND_PASS", "")
ND_API_VERSION = "1.16.0"
ND_CLIENT = "dj-import"
pipeline/lib/navidrome-scan.sh
+1 -1
View File
@@ -23,7 +23,7 @@ LIB="$MUSIC_DATA_DIR/Library"
CANARY="$LIB/.navidrome-canary"
MIN_ARTIST_DIRS=500 # library has ~1500; 500 is "clearly not wiped"
ND="${ND_BASE:-http://navidrome:4533}"
ND_USER="${ND_USER:-andrew}"
ND_USER="${ND_USER:-}"
ND_PASS="${ND_PASS:-}"
log() { echo "[$(date -Iseconds)] navidrome-scan: $*"; }
pipeline/lib/pipeline-status.sh
+2 -2
View File
@@ -28,7 +28,7 @@ NOW_TS=$(date +%s)
NAVIDROME_ENV="${ALEMBIC_CONFIG_DIR:-/config}/pipeline/navidrome/admin.env"
[ -f "$NAVIDROME_ENV" ] && source "$NAVIDROME_ENV"
ND_BASE="${ND_BASE:-http://navidrome:4533}"
ND_USER="${ND_USER:-andrew}"
ND_USER="${ND_USER:-}"
ND_PASS="${ND_PASS:-}"
# Tally counters for the header banner. Body collected first, then prepended.
@@ -366,7 +366,7 @@ except Exception as e:
# ---- Build header banner and prepend ----
HOSTNAME_SHORT=$(hostname -s)
DATE_HUMAN=$(TZ=America/Edmonton date '+%a %Y-%m-%d %H:%M %Z')
DATE_HUMAN=$(TZ="${TZ:-UTC}" date '+%a %Y-%m-%d %H:%M %Z')
BANNER_TITLE="🎵 Music pipeline · $HOSTNAME_SHORT · $DATE_HUMAN"
BANNER_TALLY=" $OK OK · $WARN warn · $SKIP skip"
sed -i "1c\\
pipeline/lib/recover-azuracast-playlists.py
+2 -2
View File
@@ -14,7 +14,7 @@ Default is dry-run. Pass --apply to actually write tags + assign.
Env / args:
--azuracast-key KEY AzuraCast API key (required)
--azuracast-base URL default https://admin.ephemeral.club
--azuracast-base URL default from AZURACAST_BASE env (empty if unset)
--station N default 1
--apply actually act (default is dry-run)
--only PLAYLIST limit recovery to one playlist (testing)
@@ -157,7 +157,7 @@ def beet_update(container_paths: list[str], log) -> None:
def main() -> int:
ap = argparse.ArgumentParser()
ap.add_argument("--azuracast-key", required=True)
ap.add_argument("--azuracast-base", default="https://admin.ephemeral.club")
ap.add_argument("--azuracast-base", default=os.environ.get("AZURACAST_BASE", ""))
ap.add_argument("--station", type=int, default=1)
ap.add_argument("--apply", action="store_true")
ap.add_argument("--only", default=None, help="limit recovery to one playlist name")
pipeline/lib/sync-bandcamp.py
+1 -1
View File
@@ -197,7 +197,7 @@ _IMAGE_EXTS = (".jpg", ".jpeg", ".png", ".webp")
# --- Buy-link tagging -------------------------------------------------------
# We stamp the release's Bandcamp page into the file so AzuraCast can show a
# "Buy" button on ephemeral.club. AzuraCast only auto-assigns custom fields
# "Buy" button on your station. AzuraCast only auto-assigns custom fields
# from its *known* tag enum, so a bespoke "BUY_URL" tag would be ignored
# (it lands in extraTags). Instead we use the "Commercial Information" tag —
# ID3 frame WCOM, getID3 key `commercial_information`, semantically "a webpage