andrew
b135f11557
Security (P0): - Remove committed session-secret default; auto-generate and persist a random secret to the config volume when SESSION_SECRET is unset (prevents forgeable session cookies / auth bypass). - Validate playlist names to a safe charset and render sldl configs via literal Python substitution instead of sed (closes a command-injection and path-traversal path through playlist names). - shlex-quote credential values written to shell-sourced env files, and strip newlines from values patched into .conf files. - Render playlist .conf files 0600; warn at startup if the master key is co-located with the config volume; document keeping it separate. Portability: - Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton. - Remove personal defaults (navidrome user "andrew", ephemeral.club URLs). - Ship generic example seeds; move the cross-album dedup keep-list and the legacy playlist import to editable config files; drop the personal _upgrade.csv. - Generic VPN reference in docker-compose.snippet.yml. First-run experience: - Redirect to /setup instead of 500 when OIDC is unconfigured; surface a missing master key inline; entrypoint exits with an actionable message when the config folder is not writable. - Add unauthenticated /health (JSON) and /setup (checklist) diagnostics. Docs: - Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced but missing); expand README with ownership, backups, advanced settings, and migration guidance. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
30 lines
777 B
Python
30 lines
777 B
Python
from functools import lru_cache
|
|
|
|
from cryptography.fernet import Fernet
|
|
|
|
from app.settings import settings
|
|
|
|
|
|
@lru_cache(maxsize=1)
|
|
def _fernet() -> Fernet:
|
|
key_path = settings.encryption_key_file
|
|
if not key_path.exists():
|
|
raise RuntimeError(
|
|
f"Encryption key not found at {key_path}. Generate one with "
|
|
f"`openssl rand -base64 32` and mount it as the alembic_master_key "
|
|
f"Docker secret — see docker-compose.snippet.yml."
|
|
)
|
|
return Fernet(key_path.read_bytes().strip())
|
|
|
|
|
|
def key_present() -> bool:
|
|
return settings.encryption_key_file.exists()
|
|
|
|
|
|
def encrypt(value: str) -> bytes:
|
|
return _fernet().encrypt(value.encode())
|
|
|
|
|
|
def decrypt(value: bytes) -> str:
|
|
return _fernet().decrypt(value).decode()
|