8205db9bc3
Security:
- Bind HTTP gateway to 127.0.0.1 by default; add --bind for LAN opt-in
- Restrict Reticulum mesh surface to GET /api/sites only (CSRF cannot
authenticate mesh callers, so gate by whitelist)
- Cap request body size at 16 MiB to prevent memory DoS
- Redact /bookmark query strings from request logs so the bookmark token
and URLs do not land in stdout / docker / journal logs
- Tighten FTS5 sanitizer: strip colon, drop AND/OR/NOT/NEAR operator words
- Expand .dockerignore; document trust model in README
Features:
- Add sharing mode toggle (share everything except private vs share only
public-tagged) with /share/preview so users can see what subscribers
would receive before enabling sharing
Bugs:
- handle_export() crashed on every call (missing query kwarg)
- Dead float16 decompression branch in embeddings.py silently corrupted
the HNSW index when compress_embeddings was on
- GATEWAY_PORT staleness: --port and find_available_port had no effect
on the actual bind
- semantic_search default mismatched between db.py ("1") and the rest of
the app ("0"), causing embeddings to be generated when the UI said off
- Connection pool returned connections with uncommitted transactions to
the next consumer
- Gateway POST body decode 502'd on non-UTF-8 input
- ensure_rns_config clobbered user-edited ~/.reticulum/config; now only
rewrites files it authored (sentinel-tagged)
34 lines
796 B
Bash
Executable file
34 lines
796 B
Bash
Executable file
#!/bin/sh
|
|
# Generate Reticulum config with optional TCP peer
|
|
# Set RNS_TCP_HOST and RNS_TCP_PORT env vars to connect to a remote instance
|
|
|
|
CONFIG_DIR="/data/.reticulum"
|
|
CONFIG_FILE="$CONFIG_DIR/config"
|
|
|
|
mkdir -p "$CONFIG_DIR"
|
|
|
|
if [ ! -f "$CONFIG_FILE" ]; then
|
|
cat > "$CONFIG_FILE" <<EOF
|
|
[reticulum]
|
|
enable_transport = False
|
|
share_instance = No
|
|
|
|
[logging]
|
|
loglevel = 4
|
|
|
|
[interfaces]
|
|
[[Default Interface]]
|
|
type = AutoInterface
|
|
enabled = Yes
|
|
|
|
[[TCP Transport]]
|
|
type = TCPClientInterface
|
|
enabled = yes
|
|
target_host = ${RNS_TCP_HOST:-reticulum.derickphan.com}
|
|
target_port = ${RNS_TCP_PORT:-4242}
|
|
EOF
|
|
fi
|
|
|
|
export RNS_CONFIG_DIR="$CONFIG_DIR"
|
|
# Bind to 0.0.0.0 inside the container; isolation is handled by Docker's port mapping.
|
|
exec python app.py --bind 0.0.0.0 "$@"
|