andrew
b135f11557
Security (P0): - Remove committed session-secret default; auto-generate and persist a random secret to the config volume when SESSION_SECRET is unset (prevents forgeable session cookies / auth bypass). - Validate playlist names to a safe charset and render sldl configs via literal Python substitution instead of sed (closes a command-injection and path-traversal path through playlist names). - shlex-quote credential values written to shell-sourced env files, and strip newlines from values patched into .conf files. - Render playlist .conf files 0600; warn at startup if the master key is co-located with the config volume; document keeping it separate. Portability: - Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton. - Remove personal defaults (navidrome user "andrew", ephemeral.club URLs). - Ship generic example seeds; move the cross-album dedup keep-list and the legacy playlist import to editable config files; drop the personal _upgrade.csv. - Generic VPN reference in docker-compose.snippet.yml. First-run experience: - Redirect to /setup instead of 500 when OIDC is unconfigured; surface a missing master key inline; entrypoint exits with an actionable message when the config folder is not writable. - Add unauthenticated /health (JSON) and /setup (checklist) diagnostics. Docs: - Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced but missing); expand README with ownership, backups, advanced settings, and migration guidance. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
73 lines
2.8 KiB
Bash
Executable File
73 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# regen.sh — regenerate per-playlist sldl configs from _template.conf.
|
|
#
|
|
# Source of truth is $ALEMBIC_CONFIG_DIR/pipeline/playlists.json, written by
|
|
# the alembic app's playlist_service whenever a playlist is added/edited/
|
|
# removed via the UI. This script never edits that source of truth — it only
|
|
# renders it. Run automatically by the app before each playlist sync, or
|
|
# manually: regen.sh
|
|
#
|
|
# playlists.json shape: a JSON array of objects, each with at least
|
|
# {"name": "...", "spotify_url": "...", "active": true, "no_m3u": false}.
|
|
# Inactive playlists still get a .conf rendered (so a manual run is always
|
|
# possible) but are skipped by the scheduler.
|
|
|
|
set -euo pipefail
|
|
|
|
ALEMBIC_CONFIG_DIR="${ALEMBIC_CONFIG_DIR:-/config}"
|
|
MUSIC_DATA_DIR="${MUSIC_DATA_DIR:-/data/music}"
|
|
PIPELINE_DIR="${PIPELINE_DIR:-/app/pipeline}"
|
|
|
|
CONFIG_OUT_DIR="$ALEMBIC_CONFIG_DIR/pipeline"
|
|
PLAYLISTS_JSON="$CONFIG_OUT_DIR/playlists.json"
|
|
TEMPLATE="$PIPELINE_DIR/configs/_template.conf"
|
|
SLDL_DROPBOX_ROOT="$MUSIC_DATA_DIR/sldl-dropbox"
|
|
|
|
if [[ ! -f "$PLAYLISTS_JSON" ]]; then
|
|
echo "ERROR: $PLAYLISTS_JSON not found — nothing to regenerate." >&2
|
|
echo " This file is written by the alembic app; run its playlist" >&2
|
|
echo " import/seed step first if this is a fresh setup." >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$CONFIG_OUT_DIR"
|
|
|
|
# Render each playlist's .conf entirely in Python. The playlist name and URL
|
|
# are substituted as LITERAL text (single-pass regex replace, never re-scanned),
|
|
# not fed to `sed` — an earlier sed-based version let a crafted playlist name
|
|
# execute shell via GNU sed's `e` flag. Names are also re-validated here as
|
|
# defense in depth even though the app validates them before writing the JSON.
|
|
python3 - "$PLAYLISTS_JSON" "$TEMPLATE" "$CONFIG_OUT_DIR" "$SLDL_DROPBOX_ROOT" <<'PY'
|
|
import json, os, re, sys
|
|
|
|
playlists_json, template_path, out_dir, dropbox_root = sys.argv[1:5]
|
|
|
|
with open(playlists_json) as f:
|
|
playlists = json.load(f)
|
|
with open(template_path) as f:
|
|
template = f.read()
|
|
|
|
SAFE_NAME = re.compile(r"^[A-Za-z0-9 _-]{1,64}$")
|
|
|
|
for p in playlists:
|
|
name = p.get("name", "")
|
|
url = p.get("spotify_url", "")
|
|
if not SAFE_NAME.match(name):
|
|
print(f"WARNING: skipping playlist with unsafe name: {name!r}", file=sys.stderr)
|
|
continue
|
|
mapping = {
|
|
"PLAYLIST_NAME": name,
|
|
"SPOTIFY_URL": url,
|
|
"SLDL_DROPBOX_ROOT": dropbox_root,
|
|
}
|
|
pattern = re.compile("|".join(re.escape(k) for k in mapping))
|
|
rendered = pattern.sub(lambda m: mapping[m.group(0)], template)
|
|
out_path = os.path.join(out_dir, name + ".conf")
|
|
with open(out_path, "w") as f:
|
|
f.write(rendered)
|
|
# Holds the Soulseek password and Spotify secret once credentials are
|
|
# patched in, so keep it owner-only from the moment it is created.
|
|
os.chmod(out_path, 0o600)
|
|
print(f"Generated {out_path}")
|
|
PY
|