diff --git a/Dockerfile b/Dockerfile index fa0109a..1f510dd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,18 +1,28 @@ # syntax=docker/dockerfile:1.7 # ============================================================================ -# Build stage: create a self-contained venv with all dependencies +# Build stage: Debian 12's Python (paths/libs match the distroless runtime) # ============================================================================ -FROM python:3.11-slim-bookworm AS builder +# We deliberately do NOT use python:3.11-slim-bookworm here — that image is +# Python.org's, which installs Python to /usr/local with an RPATH pointing +# back into /usr/local/lib. Distroless has libpython under /usr/lib, so the +# RPATH would break. Debian's apt-installed python3 lives at the same paths +# as distroless's, so symlinks and libpython all resolve correctly. +FROM debian:12-slim AS builder ENV PYTHONDONTWRITEBYTECODE=1 \ PYTHONUNBUFFERED=1 \ PIP_NO_CACHE_DIR=1 \ PIP_DISABLE_PIP_VERSION_CHECK=1 -# --copies bundles the Python binary itself into /opt/venv so the runtime -# stage gets a self-contained tree (no symlinks back to /usr/local/bin). -RUN python -m venv --copies /opt/venv +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + python3 python3-pip python3-venv \ + && rm -rf /var/lib/apt/lists/* + +# Default (symlink) venv. /opt/venv/bin/python ends up as a symlink to +# /usr/bin/python3, which distroless also provides. +RUN python3 -m venv /opt/venv ENV PATH=/opt/venv/bin:$PATH # Install runtime deps into the venv's site-packages @@ -22,7 +32,7 @@ RUN pip install \ redis==5.0.* # Pre-compile bytecode for faster cold start on a read-only rootfs -RUN python -m compileall -q /opt/venv +RUN python3 -m compileall -q /opt/venv # ============================================================================ # Runtime stage: distroless Python 3.11, non-root, no shell @@ -37,7 +47,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \ WORKDIR /app -# Self-contained venv (its bin/python and site-packages travel together) +# Venv ships its site-packages; its bin/python symlink resolves against +# distroless's /usr/bin/python3 and Debian's libpython at /usr/lib/... COPY --from=builder --chown=nonroot:nonroot /opt/venv /opt/venv # Application source (its own layer so source-only changes don't bust dep cache) @@ -46,7 +57,5 @@ COPY --chown=nonroot:nonroot app.py favicon.ico /app/ USER nonroot EXPOSE 8000 -# Invoking the venv's Python directly makes its site-packages discoverable -# automatically (sys.prefix points inside /opt/venv) — no PYTHONPATH needed. ENTRYPOINT ["/opt/venv/bin/python", "-m", "uvicorn"] CMD ["app:app", "--host", "0.0.0.0", "--port", "8000"] diff --git a/README.md b/README.md index 2deca5a..c7ae1ff 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Aukpad -Simple **live collaboration notepad** with websockets and FastAPI. +Simple **temporary live collaboration notepad** with websockets and FastAPI — pads expire automatically after a configurable retention period. [Issue tracker](https://git.uphillsecurity.com/cf7/aukpad/issues) | `Libera Chat #aukpad` @@ -16,23 +16,34 @@ The goal is to keep it simple! For feature-rich solutions please check out [hedg ## Features **Use cases:** -- shared notepad on multiple machines +- shared notepad across multiple machines - collaboration on the same notepage with multiple people (notes, config, etc) -- config changes in aukpad > `curl -o app.conf https://aukpad.com/{pad_id}/raw` > change config in aukpad > repeat `curl` command +- piping configs: `curl -o app.conf https://aukpad.com/{pad_id}/raw` → edit in aukpad → repeat -**Available**: -- live collab notepad -- line numbers -- custom path `{pad_id}` for more privacy (1–64 chars, `[a-zA-Z0-9_-]`) -- optional caching with valkey/redis -- pad creation with HTTP post requests with curl (see *Usage*) -- `{pad_id}/raw` HTTP endpoint -- optional password protection (HTTP endpoint accessible with GET /{pad_id}/raw?pw=mysecurepasswordhunter2) +**Editor:** +- real-time WebSocket collaboration with cursor preservation across remote edits +- per-pad password protection (PBKDF2-SHA256), with a built-in password generator in the UI +- line numbers; Tab inserts 4 spaces +- dark / light mode (auto-detects system preference, manual toggle) +- copy-to-clipboard and "new pad" buttons, live peer count in the header -**Ideas**: +**Endpoints:** +- custom pad path `{pad_id}` (1–64 chars, `[a-zA-Z0-9_-]`); auto-generated IDs are 8-char `[a-z0-9]` +- `POST /` — create a pad from request body (curl-friendly, see *Usage*) +- `GET /{pad_id}/raw` — raw text (auth via `?pw=…` for protected pads) +- `GET /system/info` — instance configuration page +- WebSocket `/ws/{pad_id}` — live collaboration + +**Deployment:** +- optional Valkey/Redis cache for cross-restart persistence +- configurable text-size, connection, room, and retention limits +- per-IP rate limiting (pad creation + failed password attempts), reverse-proxy aware +- distroless, non-root, read-only-rootfs container image + +**Ideas:** [Check out the open feature requests](https://git.uphillsecurity.com/cf7/aukpad/issues?q=&type=all&sort=&state=open&labels=12&milestone=0&project=0&assignee=0&poster=0&archived=false) -**Not planned**: +**Not planned:** - accounts / RBAC --- @@ -61,10 +72,6 @@ ip -br a | curl -X POST https://aukpad.com --data-binary @- # command output Open `127.0.0.1:8000` -Alternative, use Github Container Repository: - -`ghcr.io/caffeinefueled1/aukpad:latest` - **Adv. example with Podman** ```bash @@ -93,7 +100,6 @@ podman run -d --name aukpad-app \ --tmpfs /tmp \ --security-opt no-new-privileges:true \ --cap-drop ALL \ - --user 1000:1000 \ -e USE_VALKEY=true \ -e VALKEY_URL=redis://:xeZNopyIeMMncqDFPHtJQwMwIathgMWo@localhost:6379 \ -e MAX_TEXT_SIZE=5 \ @@ -130,12 +136,6 @@ For security concerns or reports, please contact via `hello a t uphillsecurity d --- -## Notes - -- [Github Mirror available](https://github.com/CaffeineFueled1/aukpad) - ---- - ## License **Apache License** diff --git a/app.py b/app.py index cb453bb..7d5b619 100644 --- a/app.py +++ b/app.py @@ -590,6 +590,18 @@ def get_system_info():

Instance

{DESCRIPTION}

+

Simple temporary live collaboration notepad with websockets and FastAPI — pads expire automatically after a configurable retention period.

+
+ +
+

Features

+