2d7169e971
The cheap, real LOWs from the review (bucket 🅰); 🅱 items and won't-fix
decisions are recorded in docs/SECURITY-BACKLOG.md.
- XFF spoofing (highest-value): client_ip now prefers an unspoofable X-Real-IP
(Caddy `header_up X-Real-IP {remote_host}`) and otherwise takes the *rightmost*
X-Forwarded-For token, never the client-controlled leftmost. The join cap,
recover throttle, and admin-login floor all keyed on this. Unit-tested.
Caddyfile also drops the dead /media/previews|originals cache matchers (the
gateway sets its own Cache-Control) and the false "only host can download"
comment.
- admin_login: add a hard, non-disableable rate floor (30/5min/IP) so the DB
rate-limit master toggle can't remove brute-force protection.
- SSE: the broadcast upload-error payload no longer includes the raw error
(absolute filesystem paths) — generic message to clients, details logged
server-side only.
- Access logs: the request span logs the path only, never the query string, so
the replayable media `?sig=` capability isn't written to logs.
- Reaper TOCTOU: reap_deleted now deletes rows by the ids it actually unlinked
(DELETE … WHERE id = ANY) instead of re-evaluating the time predicate, so a
row crossing the grace line mid-sweep can't be row-deleted without its files
unlinked.
- Dockerfile: run the backend as a non-root user; create /media owned by `app`
so a fresh volume is writable.
- a11y: aria-labels on the upload caption and feed search inputs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
36 lines
1.1 KiB
Docker
36 lines
1.1 KiB
Docker
# --- Build stage ---
|
|
FROM rust:1.88-alpine AS builder
|
|
|
|
RUN apk add --no-cache musl-dev pkgconfig openssl-dev
|
|
|
|
WORKDIR /app
|
|
COPY Cargo.toml Cargo.lock* ./
|
|
# Pre-fetch deps with a dummy build for layer caching
|
|
RUN mkdir src && echo "fn main(){}" > src/main.rs && \
|
|
cargo build --release && \
|
|
rm -rf src
|
|
|
|
COPY src ./src
|
|
COPY static ./static
|
|
COPY migrations ./migrations
|
|
RUN touch src/main.rs && cargo build --release
|
|
|
|
# --- Runtime stage ---
|
|
FROM alpine:3.21
|
|
|
|
# Run as an unprivileged user (defense-in-depth). The media volume mounts at
|
|
# /media; creating it here as `app` means a fresh named volume inherits app
|
|
# ownership and is writable without running as root. (An existing root-owned
|
|
# volume from a prior deploy needs a one-time `chown -R app:app` — see deploy notes.)
|
|
RUN apk add --no-cache ca-certificates ffmpeg \
|
|
&& addgroup -S app && adduser -S -G app app \
|
|
&& mkdir -p /media && chown app:app /media
|
|
|
|
WORKDIR /app
|
|
COPY --from=builder /app/target/release/eventsnap-backend ./
|
|
RUN chown -R app:app /app
|
|
|
|
USER app
|
|
EXPOSE 3000
|
|
CMD ["./eventsnap-backend"]
|