m1saka
66abb76318
Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low): - Locking: replace the global API and workspace mutexes with per-instance and per-user keyed locks (new internal/api/locks.go) so a slow restore, upgrade or transfer no longer blocks unrelated users or instances; move Docker I/O out of the build queue and invalidate concurrent image-index observations with a generation counter; serialize instance deletion behind in-flight creation. - Security: equalize login timing for unknown usernames, periodically purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit vulnerabilities (2 critical RCE). - Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with removal guidance after first start, exclude test scripts from the image, and cap panel resources (cpus: 2, pids_limit: 512). - Reliability: check rows.Err() on admin listing loops, surface intent polling errors without sticking, disable close during in-flight create. Verified: go build/vet, full go test -race -count=1 ./..., frontend tsc build + 32 tests, npm audit 0, compose config, real-container healthcheck.
22 lines
1.1 KiB
Bash
22 lines
1.1 KiB
Bash
# Copy to .env (ignored by git). Use an absolute dedicated data directory.
|
|
DSH_HOST_DATA_ROOT=/var/lib/dsh-mgr
|
|
DSH_ADMIN_USERNAME=admin
|
|
# Supply a unique strong password before FIRST start; the panel reads it only
|
|
# while the account table is empty. Remove the value after the administrator
|
|
# account exists, then run `docker compose up -d --force-recreate panel`
|
|
# to remove it from the container environment and `docker inspect` output.
|
|
# Restarting the existing container does not update its environment.
|
|
DSH_ADMIN_PASSWORD=
|
|
# Numeric group from: stat -c %g /var/run/docker.sock
|
|
DOCKER_GID=
|
|
# Exact docker info --format {{.DockerRootDir}}; mounted read-only for statfs.
|
|
DSH_DOCKER_ROOT_DIR=
|
|
# Optional exact extension allowlist, e.g. .txt,.md,.json,.yaml,.go
|
|
# Empty permits arbitrary workspace files; this is not malware/content scanning.
|
|
UPLOAD_ALLOWED_EXTENSIONS=
|
|
# Public origin of the panel exactly as browsers see it (scheme://host, no
|
|
# path); controls Origin/CSRF validation and Secure cookies.
|
|
PANEL_PUBLIC_URL=http://127.0.0.1:8088
|
|
# Optional proxy networks. X-Forwarded-For is ignored unless the peer is in these CIDRs.
|
|
TRUSTED_PROXY_CIDRS=
|