jeremy/hobbs-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(hobbs-organizer): v1.1.0 password-protected LAN-only admin for calendar links

Browse Source 
- /admin: first-visit password setup (scrypt), signed 30-day session cookie,
  calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test,
  history (20) with restore; /photo-admin -> /admin#photos placeholder
- settings in local /data (settings.json + auth.json + history/), seeded once
  from the calendar secret; dashboard + health read from settings
- start.mjs drops privileges after reading secrets and runs a front proxy that
  stamps the real client IP; admin refuses non-LAN and proxied requests
- deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3
This commit is contained in:
jeremy
2026-11-04 18:55:00 -06:00
parent e9c7e9df1a
commit 8715589cbb
28 changed files with 1532 additions and 380 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tv app/Hobbs-Family-Organizer-Self-Hosted-v1.0.0/Dockerfile
+4 -3
View File
@@ -27,11 +27,12 @@ ENV NODE_ENV=production \
COPY --from=production-dependencies --chown=10001:10001 /app/node_modules/ ./node_modules/
COPY --from=build --chown=10001:10001 /app/.next-build/ ./.next-build/
COPY --from=build --chown=10001:10001 /app/public/ ./public/
COPY --from=build --chown=10001:10001 /app/container/start.mjs ./container/start.mjs
COPY --from=build --chown=10001:10001 /app/container/start.mjs /app/container/reset-admin.mjs ./container/
COPY --from=build --chown=10001:10001 /app/package.json /app/next.config.mjs ./
RUN mkdir -p /app/.next-build/cache && chown -R 10001:10001 /app/.next-build
RUN mkdir -p /app/.next-build/cache /data && chown -R 10001:10001 /app/.next-build /data && chmod 700 /data
# The tiny supervisor starts as root only long enough to read Docker secrets,
# then launches Next.js as uid/gid 10001. Compose grants only SETUID/SETGID.
# then drops to uid/gid 10001 (Compose grants only SETUID/SETGID), prepares
# /data, runs the LAN-aware front proxy on :3000 and Next.js on 127.0.0.1:3001.
USER 0:0
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \