diff --git a/Dockerfile b/Dockerfile index 95e0386..1f510dd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,24 +1,38 @@ # syntax=docker/dockerfile:1.7 # ============================================================================ -# Build stage: install Python dependencies into a dedicated prefix +# Build stage: Debian 12's Python (paths/libs match the distroless runtime) # ============================================================================ -FROM python:3.11-slim-bookworm AS builder +# We deliberately do NOT use python:3.11-slim-bookworm here — that image is +# Python.org's, which installs Python to /usr/local with an RPATH pointing +# back into /usr/local/lib. Distroless has libpython under /usr/lib, so the +# RPATH would break. Debian's apt-installed python3 lives at the same paths +# as distroless's, so symlinks and libpython all resolve correctly. +FROM debian:12-slim AS builder ENV PYTHONDONTWRITEBYTECODE=1 \ PYTHONUNBUFFERED=1 \ PIP_NO_CACHE_DIR=1 \ PIP_DISABLE_PIP_VERSION_CHECK=1 -# Install runtime deps into /install. --target keeps everything in one tree -# so we can copy it cleanly to a distroless image without venv/shebang issues. -RUN pip install --target=/install \ +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + python3 python3-pip python3-venv \ + && rm -rf /var/lib/apt/lists/* + +# Default (symlink) venv. /opt/venv/bin/python ends up as a symlink to +# /usr/bin/python3, which distroless also provides. +RUN python3 -m venv /opt/venv +ENV PATH=/opt/venv/bin:$PATH + +# Install runtime deps into the venv's site-packages +RUN pip install \ fastapi==0.115.* \ "uvicorn[standard]==0.30.*" \ redis==5.0.* -# Pre-compile bytecode for faster cold start under a read-only rootfs -RUN python -m compileall -q /install +# Pre-compile bytecode for faster cold start on a read-only rootfs +RUN python3 -m compileall -q /opt/venv # ============================================================================ # Runtime stage: distroless Python 3.11, non-root, no shell @@ -29,21 +43,19 @@ RUN python -m compileall -q /install FROM gcr.io/distroless/python3-debian12:nonroot ENV PYTHONDONTWRITEBYTECODE=1 \ - PYTHONUNBUFFERED=1 \ - PYTHONPATH=/app/lib + PYTHONUNBUFFERED=1 WORKDIR /app -# Site-packages first (rarely changes → maximises layer cache) -COPY --from=builder --chown=nonroot:nonroot /install /app/lib +# Venv ships its site-packages; its bin/python symlink resolves against +# distroless's /usr/bin/python3 and Debian's libpython at /usr/lib/... +COPY --from=builder --chown=nonroot:nonroot /opt/venv /opt/venv -# Application source (changes most often → its own layer) +# Application source (its own layer so source-only changes don't bust dep cache) COPY --chown=nonroot:nonroot app.py favicon.ico /app/ USER nonroot EXPOSE 8000 -# Module form (-m uvicorn) sidesteps broken shebangs in /app/lib/bin/uvicorn -# (those were generated against the builder's Python path, not distroless's). -ENTRYPOINT ["/usr/bin/python3", "-m", "uvicorn"] +ENTRYPOINT ["/opt/venv/bin/python", "-m", "uvicorn"] CMD ["app:app", "--host", "0.0.0.0", "--port", "8000"] diff --git a/README.md b/README.md index 2deca5a..c7ae1ff 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Aukpad -Simple **live collaboration notepad** with websockets and FastAPI. +Simple **temporary live collaboration notepad** with websockets and FastAPI — pads expire automatically after a configurable retention period. [Issue tracker](https://git.uphillsecurity.com/cf7/aukpad/issues) | `Libera Chat #aukpad` @@ -16,23 +16,34 @@ The goal is to keep it simple! For feature-rich solutions please check out [hedg ## Features **Use cases:** -- shared notepad on multiple machines +- shared notepad across multiple machines - collaboration on the same notepage with multiple people (notes, config, etc) -- config changes in aukpad > `curl -o app.conf https://aukpad.com/{pad_id}/raw` > change config in aukpad > repeat `curl` command +- piping configs: `curl -o app.conf https://aukpad.com/{pad_id}/raw` → edit in aukpad → repeat -**Available**: -- live collab notepad -- line numbers -- custom path `{pad_id}` for more privacy (1–64 chars, `[a-zA-Z0-9_-]`) -- optional caching with valkey/redis -- pad creation with HTTP post requests with curl (see *Usage*) -- `{pad_id}/raw` HTTP endpoint -- optional password protection (HTTP endpoint accessible with GET /{pad_id}/raw?pw=mysecurepasswordhunter2) +**Editor:** +- real-time WebSocket collaboration with cursor preservation across remote edits +- per-pad password protection (PBKDF2-SHA256), with a built-in password generator in the UI +- line numbers; Tab inserts 4 spaces +- dark / light mode (auto-detects system preference, manual toggle) +- copy-to-clipboard and "new pad" buttons, live peer count in the header -**Ideas**: +**Endpoints:** +- custom pad path `{pad_id}` (1–64 chars, `[a-zA-Z0-9_-]`); auto-generated IDs are 8-char `[a-z0-9]` +- `POST /` — create a pad from request body (curl-friendly, see *Usage*) +- `GET /{pad_id}/raw` — raw text (auth via `?pw=…` for protected pads) +- `GET /system/info` — instance configuration page +- WebSocket `/ws/{pad_id}` — live collaboration + +**Deployment:** +- optional Valkey/Redis cache for cross-restart persistence +- configurable text-size, connection, room, and retention limits +- per-IP rate limiting (pad creation + failed password attempts), reverse-proxy aware +- distroless, non-root, read-only-rootfs container image + +**Ideas:** [Check out the open feature requests](https://git.uphillsecurity.com/cf7/aukpad/issues?q=&type=all&sort=&state=open&labels=12&milestone=0&project=0&assignee=0&poster=0&archived=false) -**Not planned**: +**Not planned:** - accounts / RBAC --- @@ -61,10 +72,6 @@ ip -br a | curl -X POST https://aukpad.com --data-binary @- # command output Open `127.0.0.1:8000` -Alternative, use Github Container Repository: - -`ghcr.io/caffeinefueled1/aukpad:latest` - **Adv. example with Podman** ```bash @@ -93,7 +100,6 @@ podman run -d --name aukpad-app \ --tmpfs /tmp \ --security-opt no-new-privileges:true \ --cap-drop ALL \ - --user 1000:1000 \ -e USE_VALKEY=true \ -e VALKEY_URL=redis://:xeZNopyIeMMncqDFPHtJQwMwIathgMWo@localhost:6379 \ -e MAX_TEXT_SIZE=5 \ @@ -130,12 +136,6 @@ For security concerns or reports, please contact via `hello a t uphillsecurity d --- -## Notes - -- [Github Mirror available](https://github.com/CaffeineFueled1/aukpad) - ---- - ## License **Apache License** diff --git a/app.py b/app.py index 46d29ee..7d5b619 100644 --- a/app.py +++ b/app.py @@ -68,8 +68,8 @@ def init_valkey(): redis_client = redis.from_url(VALKEY_URL, decode_responses=True) redis_client.ping() # Test connection print(f"Valkey/Redis connected: {VALKEY_URL}") - except ImportError: - print("Warning: redis package not installed, falling back to memory-only storage") + except ImportError as e: + print(f"Warning: redis package import failed ({e}), falling back to memory-only storage") redis_client = None except Exception as e: print(f"Warning: Failed to connect to Valkey/Redis: {e}") @@ -590,6 +590,18 @@ def get_system_info():

Instance

{DESCRIPTION}

+

Simple temporary live collaboration notepad with websockets and FastAPI — pads expire automatically after a configurable retention period.

+
+ +
+

Features

+