andrew
b135f11557
Security (P0): - Remove committed session-secret default; auto-generate and persist a random secret to the config volume when SESSION_SECRET is unset (prevents forgeable session cookies / auth bypass). - Validate playlist names to a safe charset and render sldl configs via literal Python substitution instead of sed (closes a command-injection and path-traversal path through playlist names). - shlex-quote credential values written to shell-sourced env files, and strip newlines from values patched into .conf files. - Render playlist .conf files 0600; warn at startup if the master key is co-located with the config volume; document keeping it separate. Portability: - Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton. - Remove personal defaults (navidrome user "andrew", ephemeral.club URLs). - Ship generic example seeds; move the cross-album dedup keep-list and the legacy playlist import to editable config files; drop the personal _upgrade.csv. - Generic VPN reference in docker-compose.snippet.yml. First-run experience: - Redirect to /setup instead of 500 when OIDC is unconfigured; surface a missing master key inline; entrypoint exits with an actionable message when the config folder is not writable. - Add unauthenticated /health (JSON) and /setup (checklist) diagnostics. Docs: - Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced but missing); expand README with ownership, backups, advanced settings, and migration guidance. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
31 lines
1.2 KiB
Plaintext
31 lines
1.2 KiB
Plaintext
# artist-canonical.list
|
|
#
|
|
# Canonical artist-name casing. One name per line; '#' starts a comment.
|
|
# Write each name exactly as you want it stored (usually how Spotify or the
|
|
# artist stylizes it).
|
|
#
|
|
# The normalize-artist-casing job looks up every distinct album-artist value in
|
|
# your library. For any value that matches a name here case-insensitively but
|
|
# differs in casing, it rewrites the tag to the form below, and beets then moves
|
|
# the album folder to the canonical path.
|
|
#
|
|
# Why this matters: it prevents Linux-to-Windows Syncthing collisions like
|
|
# `Mall Grab/` versus `MALL GRAB/` (the same folder on Windows, two folders on
|
|
# Linux), and keeps one artist from being split across differently-cased folders.
|
|
#
|
|
# To add an artist:
|
|
# 1. Look them up and copy their displayed name exactly.
|
|
# 2. Add a line below.
|
|
# 3. Preview from Settings then Artist Casing, or run the job from Settings
|
|
# then Jobs.
|
|
#
|
|
# Characters that are illegal in Windows filenames (< > : " \ ? * |) are allowed
|
|
# here. beets substitutes them with `_` when building the on-disk path, so the
|
|
# tag stays correct while the folder stays Windows-safe.
|
|
#
|
|
# This file ships empty. Add your own names below, for example:
|
|
#
|
|
# Mall Grab
|
|
# Charli xcx
|
|
# deadmau5
|