andrew
b135f11557
Security (P0): - Remove committed session-secret default; auto-generate and persist a random secret to the config volume when SESSION_SECRET is unset (prevents forgeable session cookies / auth bypass). - Validate playlist names to a safe charset and render sldl configs via literal Python substitution instead of sed (closes a command-injection and path-traversal path through playlist names). - shlex-quote credential values written to shell-sourced env files, and strip newlines from values patched into .conf files. - Render playlist .conf files 0600; warn at startup if the master key is co-located with the config volume; document keeping it separate. Portability: - Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton. - Remove personal defaults (navidrome user "andrew", ephemeral.club URLs). - Ship generic example seeds; move the cross-album dedup keep-list and the legacy playlist import to editable config files; drop the personal _upgrade.csv. - Generic VPN reference in docker-compose.snippet.yml. First-run experience: - Redirect to /setup instead of 500 when OIDC is unconfigured; surface a missing master key inline; entrypoint exits with an actionable message when the config folder is not writable. - Add unauthenticated /health (JSON) and /setup (checklist) diagnostics. Docs: - Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced but missing); expand README with ownership, backups, advanced settings, and migration guidance. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39 lines
1.5 KiB
HTML
39 lines
1.5 KiB
HTML
{% extends "base.html" %}
|
|
{% block title %}Setup check · alembic{% endblock %}
|
|
{% block content %}
|
|
<section class="container" style="max-width:760px;margin:2rem auto;">
|
|
<div class="panel">
|
|
<h1 style="margin-top:0;">Setup check</h1>
|
|
{% if status == "ok" %}
|
|
<p class="muted">Everything needed to run is configured. You can log in from the
|
|
<a href="/">dashboard</a>.</p>
|
|
{% else %}
|
|
<p class="muted">Something needed to run is missing. Fix the items marked below,
|
|
then reload this page. You do not need to be logged in to see this.</p>
|
|
{% endif %}
|
|
|
|
<ul style="list-style:none;padding:0;margin:1.5rem 0 0;">
|
|
{% for c in checks %}
|
|
<li style="display:flex;gap:0.75rem;align-items:flex-start;padding:0.75rem 0;border-top:1px solid rgba(255,255,255,0.08);">
|
|
<span style="flex:0 0 auto;margin-top:0.15rem;">
|
|
{% if c.ok and c.get("warn") %}
|
|
<span class="badge badge-info" title="advisory">note</span>
|
|
{% elif c.ok %}
|
|
<span class="badge badge-success" title="ok">ok</span>
|
|
{% elif c.critical %}
|
|
<span class="badge" style="background:#b91c1c;color:#fff;" title="must fix">needs setup</span>
|
|
{% else %}
|
|
<span class="badge badge-muted" title="optional">optional</span>
|
|
{% endif %}
|
|
</span>
|
|
<span>
|
|
<strong>{{ c.key.replace("_", " ") }}</strong><br>
|
|
<span class="muted">{{ c.detail }}</span>
|
|
</span>
|
|
</li>
|
|
{% endfor %}
|
|
</ul>
|
|
</div>
|
|
</section>
|
|
{% endblock %}
|