mirror of
https://github.com/narrrl/pl8list-rewind.git
synced 2026-11-03 16:41:26 +01:00
nvrl
54a436ae48
New axum server in backend/ with the same HTTP API and database as the Python one. The pl8list session is only held in memory during the feed crawl and logged out afterwards. Local sessions use a __Host- cookie, 30-day idle expiry and weekly token rotation; the old cookie is migrated. The audio and image proxy only accepts known parameters, fixes the content type, follows redirects only to pl8list's file host and caches segments and images on disk. Strict security headers, origin checks on POST, body and concurrency limits. /impressum and /datenschutz are rendered from env variables. The account menu offers data export, sign out on all devices and account deletion. hls.js is self-hosted and artist images are proxied, so the browser only talks to this server. The Docker image builds a static binary on scratch.
33 lines
702 B
YAML
33 lines
702 B
YAML
# Generic setup: app on 127.0.0.1:8790. Put reverse proxy (Traefik labels, networks)
|
|
# in compose.override.yaml and drop the port mapping if the proxy reaches the
|
|
# container over a Docker network.
|
|
services:
|
|
app:
|
|
build: .
|
|
image: pl8list-infinite:latest
|
|
env_file:
|
|
- path: .env
|
|
required: false
|
|
environment:
|
|
TRUSTED_PROXY_HOPS: "0"
|
|
ports:
|
|
- "127.0.0.1:8790:8790"
|
|
volumes:
|
|
- data:/data
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
restart: unless-stopped
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "1m"
|
|
max-file: "3"
|
|
|
|
volumes:
|
|
data:
|