Andreas Reinhold / reiniandClaude Opus 5.5
6578335568
ShareDownload::$authenticated was a public property without #[Locked], so a visitor with a share's link but not its password could set it from the browser and see the file list: names, folder paths, sizes and whether the share holds a text. The contents stayed protected; the flag is now locked, and a test tries to set it. Sessions hold the keys of the password shares a recipient unlocked, and were stored unencrypted in the sessions table wherever SESSION_ENCRYPT was not set, which includes every Docker install. They are now encrypted unless SESSION_ENCRYPT=false. Share keys never live in the session, so every share stays readable; people sign in again once. The container generated an APP_KEY when none was set, printed it to the logs and generated another on the next start, which left the shares without a password unreadable. It now refuses to start without one and says how to create it; docker-compose.example.yml requires it for both services. The command it names, and the README's, now pass --entrypoint php: the image's entrypoint ignores its arguments, so "docker run <image> php artisan key:generate --show" never ran it. Every proxy is trusted, so the password-reset mail built its link from a host a forged X-Forwarded-Host could choose. It is now built from APP_URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
106 lines
4.5 KiB
YAML
106 lines
4.5 KiB
YAML
# ============================================
|
|
# SealShare - Docker Compose Configuration
|
|
# ============================================
|
|
#
|
|
# Quick start:
|
|
# 1. Copy this file: cp docker-compose.example.yml docker-compose.yml
|
|
# 2. Edit the settings below (APP_URL and APP_KEY are required; uploads need HTTPS, see below)
|
|
# 3. Start: docker compose up -d
|
|
# 4. Open your browser to your configured domain
|
|
#
|
|
# APP_KEY is required: the container does not start without it. Create one with
|
|
# docker run --rm --entrypoint php gitea.nonameweb.ch/nonameweb/sealshare:latest artisan key:generate --show
|
|
# and keep it: it decrypts the shares, so a new key makes the existing ones unreadable.
|
|
#
|
|
# ============================================
|
|
|
|
services:
|
|
# ------------------------------------------
|
|
# SealShare Application (FrankenPHP/Octane)
|
|
# ------------------------------------------
|
|
app:
|
|
image: gitea.nonameweb.ch/nonameweb/sealshare:latest
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80" # HTTP
|
|
- "443:443" # HTTPS (a Let's Encrypt certificate with AUTO_HTTPS)
|
|
- "443:443/udp" # HTTP/3 (QUIC)
|
|
volumes:
|
|
- sealshare_storage:/app/storage/app # Uploaded & encrypted files
|
|
- sealshare_database:/app/database/sqlite # SQLite database
|
|
- caddy_data:/data # TLS certificates
|
|
- caddy_config:/config # Caddy configuration
|
|
environment:
|
|
# --- REQUIRED ---
|
|
APP_URL: # Your full URL, e.g. https://share.example.com
|
|
APP_KEY: # Required. Create one with php artisan key:generate --show (see above)
|
|
DB_DATABASE: /app/database/sqlite/database.sqlite # The SQLite file in sealshare_database
|
|
|
|
# --- HTTPS ---
|
|
# Files are encrypted in the uploader's browser, which browsers only allow over HTTPS (or on
|
|
# localhost). Either let this container fetch a Let's Encrypt certificate (ports 80 and 443
|
|
# reachable from the internet), or put a reverse proxy that terminates TLS in front of port 80.
|
|
# AUTO_HTTPS: "true"
|
|
# SERVER_NAME: share.example.com # The domain to fetch the certificate for (only with AUTO_HTTPS)
|
|
|
|
# --- Optional: Application ---
|
|
# APP_ENV: production
|
|
# APP_DEBUG: "false"
|
|
# LOG_CHANNEL: stderr
|
|
# LOG_LEVEL: warning
|
|
|
|
# --- Optional: Database ---
|
|
# DB_CONNECTION: sqlite # Options: sqlite, mysql, pgsql
|
|
# DB_HOST: # Required for mysql/pgsql
|
|
# DB_PORT: # Required for mysql/pgsql
|
|
# DB_DATABASE: # For mysql/pgsql the database's name, in place of the SQLite file above
|
|
# DB_USERNAME: # Required for mysql/pgsql
|
|
# DB_PASSWORD: # Required for mysql/pgsql
|
|
|
|
# --- Optional: Octane ---
|
|
# OCTANE_HTTPS: "false" # Set to "true" when using HTTPS
|
|
# OCTANE_MAX_EXECUTION_TIME: 300 # Max request execution time (seconds)
|
|
|
|
# --- Optional: Uploads ---
|
|
# UPLOAD_CHUNK_SIZE_MB: "16" # Each encrypted chunk the browser sends; a reverse proxy must accept a little more
|
|
|
|
# --- Optional: PHP limits ---
|
|
# PHP_UPLOAD_MAX_FILESIZE: "64M" # Only for the admin's logo upload: shares upload in chunks
|
|
# PHP_POST_MAX_SIZE: "64M"
|
|
# PHP_MAX_EXECUTION_TIME: "300"
|
|
# PHP_MAX_INPUT_TIME: "300"
|
|
# PHP_MEMORY_LIMIT: "512M"
|
|
healthcheck:
|
|
test: ["CMD", "/app/docker/healthcheck.sh"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 10s
|
|
retries: 3
|
|
|
|
# ------------------------------------------
|
|
# Scheduler - Runs cleanup for expired shares
|
|
# ------------------------------------------
|
|
scheduler:
|
|
image: gitea.nonameweb.ch/nonameweb/sealshare:latest
|
|
restart: unless-stopped
|
|
entrypoint: ["php", "artisan", "schedule:work"]
|
|
# The image's healthcheck asks the web server, which only the app service runs
|
|
healthcheck:
|
|
disable: true
|
|
volumes:
|
|
- sealshare_storage:/app/storage/app
|
|
- sealshare_database:/app/database/sqlite
|
|
environment:
|
|
APP_KEY: # Same key as the app service above
|
|
APP_URL: # Same URL as the app service above
|
|
DB_DATABASE: /app/database/sqlite/database.sqlite # Same as the app service above
|
|
depends_on:
|
|
app:
|
|
condition: service_healthy
|
|
|
|
volumes:
|
|
sealshare_storage: # Persistent: uploaded & encrypted files
|
|
sealshare_database: # Persistent: SQLite database
|
|
caddy_data: # Persistent: TLS certificates
|
|
caddy_config: # Persistent: Caddy configuration
|