mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
5a32e29b8c
* fix(security): harden SVG sanitizer, rate limiting, and analytics defaults - SVG: add control-char stripping in href values to block whitespace/null-byte obfuscated javascript: URIs; block <feImage> with external href (SSRF via SVG filter primitives); expand test suite to 32 inline bypass payloads - Rate limiting: add per-route limits on tool endpoints (60/min) and batch (20/min); fix compose files defaulting RATE_LIMIT_PER_MIN to 0 which mapped to 50,000 in code; simplify rate limit registration to use env.ts default - Analytics: default ANALYTICS_ENABLED to false so self-hosters do not unknowingly send telemetry - Docker: add --max-time 5 and -s flags to compose healthcheck curl commands * fix: remove stale login limit bypass, reduce error log noise, clean up fixtures - Fix getLoginAttemptLimit() ignoring LOGIN_ATTEMPT_LIMIT when global rate limit exceeded 1000/min, which let the global limit override the stricter per-route login brute-force protection - Downgrade rate limit 429 responses from error to warn level in the global error handler to avoid log noise and unnecessary Sentry reports - Log 4xx client errors at warn level instead of error level - Remove 11 orphaned SVG attack fixture files replaced by inline test payloads
105 lines
3.6 KiB
YAML
105 lines
3.6 KiB
YAML
name: SnapOtter
|
|
|
|
# CPU deployment — no GPU required.
|
|
# Usage: docker compose up -d
|
|
# GPU: docker compose -f docker-compose-gpu.yml up -d
|
|
|
|
services:
|
|
SnapOtter:
|
|
build:
|
|
context: ..
|
|
dockerfile: docker/Dockerfile
|
|
image: snapotter/snapotter:latest
|
|
container_name: SnapOtter
|
|
ports:
|
|
# For internet-facing deployments, bind to localhost only:
|
|
# - "127.0.0.1:1349:1349"
|
|
- "1349:1349"
|
|
volumes:
|
|
- SnapOtter-data:/data # Database, AI models, user files
|
|
- SnapOtter-workspace:/tmp/workspace # Temp processing (auto-cleaned)
|
|
environment:
|
|
- AUTH_ENABLED=true
|
|
- DEFAULT_USERNAME=admin
|
|
# Set a strong password. Default is 'admin' -- CHANGE THIS for any non-local deployment.
|
|
# - DEFAULT_PASSWORD=your-strong-password-here
|
|
- DEFAULT_PASSWORD=admin
|
|
- SKIP_MUST_CHANGE_PASSWORD=${SKIP_MUST_CHANGE_PASSWORD:-false}
|
|
- MAX_UPLOAD_SIZE_MB=${MAX_UPLOAD_SIZE_MB:-0}
|
|
- MAX_BATCH_SIZE=${MAX_BATCH_SIZE:-0}
|
|
- MAX_MEGAPIXELS=${MAX_MEGAPIXELS:-0}
|
|
- CONCURRENT_JOBS=${CONCURRENT_JOBS:-0}
|
|
- MAX_WORKER_THREADS=${MAX_WORKER_THREADS:-0}
|
|
- PROCESSING_TIMEOUT_S=${PROCESSING_TIMEOUT_S:-0}
|
|
- MAX_PIPELINE_STEPS=${MAX_PIPELINE_STEPS:-0}
|
|
- RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-1000}
|
|
- MAX_USERS=${MAX_USERS:-0}
|
|
- SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS:-168}
|
|
- TRUST_PROXY=${TRUST_PROXY:-true}
|
|
# OIDC Authentication (optional)
|
|
# - EXTERNAL_URL=https://photos.example.com
|
|
# - OIDC_ENABLED=false
|
|
# - OIDC_ISSUER_URL=
|
|
# - OIDC_CLIENT_ID=
|
|
# - OIDC_CLIENT_SECRET=
|
|
# - OIDC_SCOPES=openid profile email
|
|
# - OIDC_AUTO_CREATE_USERS=true
|
|
# - OIDC_DEFAULT_ROLE=user
|
|
# - OIDC_AUTO_LINK_USERS=false
|
|
# - OIDC_PROVIDER_NAME=
|
|
# - OIDC_USERNAME_CLAIM=preferred_username
|
|
# - OIDC_CLOCK_TOLERANCE=30
|
|
# - COOKIE_SECRET=
|
|
#
|
|
# Docker secrets (_FILE convention): mount secrets as files instead of
|
|
# passing them as plain-text env vars. Supported for sensitive vars only.
|
|
# - DEFAULT_PASSWORD_FILE=/run/secrets/snapotter_password
|
|
# - S3_ACCESS_KEY_ID_FILE=/run/secrets/s3_access_key
|
|
# - S3_SECRET_ACCESS_KEY_FILE=/run/secrets/s3_secret_key
|
|
# - OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_secret
|
|
# - COOKIE_SECRET_FILE=/run/secrets/cookie_secret
|
|
# - SNAPOTTER_LICENSE_KEY_FILE=/run/secrets/license_key
|
|
restart: unless-stopped
|
|
# --- Security hardening ---
|
|
mem_limit: 6g
|
|
memswap_limit: 6g
|
|
cpus: 4
|
|
pids_limit: 512
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
- CHOWN
|
|
- SETUID
|
|
- SETGID
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
# NOTE: security_opt: [no-new-privileges:true] is intentionally omitted.
|
|
# gosu requires setuid to drop from root to the snapotter user.
|
|
# Mitigation: cap_drop: ALL limits available capabilities after privilege drop.
|
|
# NOTE: read_only: true is not set because PUID/PGID remapping requires
|
|
# writing to /etc/passwd and /etc/group. Consider using Docker --user flag
|
|
# instead of PUID/PGID for read-only rootfs support.
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-sf", "--max-time", "5", "http://localhost:1349/api/v1/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 60s
|
|
retries: 3
|
|
shm_size: '2gb'
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
|
|
# Uncomment to use Docker secrets (requires Docker Swarm or compose v2.23+):
|
|
# secrets:
|
|
# snapotter_password:
|
|
# file: ./secrets/snapotter_password.txt
|
|
# oidc_secret:
|
|
# file: ./secrets/oidc_secret.txt
|
|
|
|
volumes:
|
|
SnapOtter-data:
|
|
SnapOtter-workspace:
|