andrew
b135f11557
Security (P0): - Remove committed session-secret default; auto-generate and persist a random secret to the config volume when SESSION_SECRET is unset (prevents forgeable session cookies / auth bypass). - Validate playlist names to a safe charset and render sldl configs via literal Python substitution instead of sed (closes a command-injection and path-traversal path through playlist names). - shlex-quote credential values written to shell-sourced env files, and strip newlines from values patched into .conf files. - Render playlist .conf files 0600; warn at startup if the master key is co-located with the config volume; document keeping it separate. Portability: - Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton. - Remove personal defaults (navidrome user "andrew", ephemeral.club URLs). - Ship generic example seeds; move the cross-album dedup keep-list and the legacy playlist import to editable config files; drop the personal _upgrade.csv. - Generic VPN reference in docker-compose.snippet.yml. First-run experience: - Redirect to /setup instead of 500 when OIDC is unconfigured; surface a missing master key inline; entrypoint exits with an actionable message when the config folder is not writable. - Add unauthenticated /health (JSON) and /setup (checklist) diagnostics. Docs: - Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced but missing); expand README with ownership, backups, advanced settings, and migration guidance. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
926 B
Plaintext
21 lines
926 B
Plaintext
# djmix-albums.txt — albums to include in the djmix.m3u8 exclusion playlist
|
|
#
|
|
# Each non-comment line is a beet query for one album. Lines without a pipe (|)
|
|
# are passed as a single beet query argument. Lines containing | are split on |
|
|
# and each part is passed as a separate beet query term (ANDed together).
|
|
#
|
|
# Use | to combine an album-artist and an album constraint, for example:
|
|
# albumartist::Some Artist | album:Some Live Set 2024
|
|
#
|
|
# Single-field lines with spaces work fine as one argument, because beet treats
|
|
# the whole string after the colon as the value. Do not split names on commas.
|
|
#
|
|
# To find the exact album name in your own library first:
|
|
# beet ls -f '$albumartist|$album' 'artist:Name' | sort -u
|
|
# Then add a line and run the DJ-mix playlist job.
|
|
#
|
|
# This file ships empty. Add your own albums below, for example:
|
|
#
|
|
# album:Some Live Set 2024
|
|
# albumartist::Some Artist | album:Secret Show 2023
|