tools: scripts, readme and config files
This adds a minimal setup to run the customized cryptpad instance. All info is in the readme.md. The config.js and nginx.conf will go away at some point, once a central qcode infra repo is in place.pull/1/head
parent
57e1445e3f
commit
e1224868e0
GPG Key ID:
540189B756BF5B12
@ -0,0 +1,3 @@
|
||||
**/.git
|
||||
cryptpad/config/config.js
|
||||
cryptpad/customize
|
||||
@ -0,0 +1 @@
|
||||
build
|
||||
@ -0,0 +1,18 @@
|
||||
FROM node:16.14-slim AS build
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
RUN apt-get update -qq && \
|
||||
apt-get install -yq git ca-certificates && \
|
||||
npm install -g bower
|
||||
|
||||
# the bootstrap is created in tools/build-prod.sh
|
||||
COPY build/bootstrap.tar /
|
||||
RUN mkdir -p /build && \
|
||||
cd /build && \
|
||||
tar -xf /bootstrap.tar && \
|
||||
npm ci && \
|
||||
bower install --allow-root --production
|
||||
|
||||
FROM node:16.14-alpine
|
||||
COPY --from=build /build /app
|
||||
WORKDIR /app
|
||||
@ -0,0 +1,288 @@
|
||||
/* globals module */
|
||||
|
||||
/* DISCLAIMER:
|
||||
|
||||
There are two recommended methods of running a CryptPad instance:
|
||||
|
||||
1. Using a standalone nodejs server without HTTPS (suitable for local development)
|
||||
2. Using NGINX to serve static assets and to handle HTTPS for API server's websocket traffic
|
||||
|
||||
We do not officially recommend or support Apache, Docker, Kubernetes, Traefik, or any other configuration.
|
||||
Support requests for such setups should be directed to their authors.
|
||||
|
||||
If you're having difficulty difficulty configuring your instance
|
||||
we suggest that you join the project's IRC/Matrix channel.
|
||||
|
||||
If you don't have any difficulty configuring your instance and you'd like to
|
||||
support us for the work that went into making it pain-free we are quite happy
|
||||
to accept donations via our opencollective page: https://opencollective.com/cryptpad
|
||||
|
||||
*/
|
||||
module.exports = {
|
||||
/* CryptPad is designed to serve its content over two domains.
|
||||
* Account passwords and cryptographic content is handled on the 'main' domain,
|
||||
* while the user interface is loaded on a 'sandbox' domain
|
||||
* which can only access information which the main domain willingly shares.
|
||||
*
|
||||
* In the event of an XSS vulnerability in the UI (that's bad)
|
||||
* this system prevents attackers from gaining access to your account (that's good).
|
||||
*
|
||||
* Most problems with new instances are related to this system blocking access
|
||||
* because of incorrectly configured sandboxes. If you only see a white screen
|
||||
* when you try to load CryptPad, this is probably the cause.
|
||||
*
|
||||
* PLEASE READ THE FOLLOWING COMMENTS CAREFULLY.
|
||||
*
|
||||
*/
|
||||
|
||||
/* httpUnsafeOrigin is the URL that clients will enter to load your instance.
|
||||
* Any other URL that somehow points to your instance is supposed to be blocked.
|
||||
* The default provided below assumes you are loading CryptPad from a server
|
||||
* which is running on the same machine, using port 3000.
|
||||
*
|
||||
* In a production instance this should be available ONLY over HTTPS
|
||||
* using the default port for HTTPS (443) ie. https://cryptpad.fr
|
||||
* In such a case this should be also handled by NGINX, as documented in
|
||||
* cryptpad/docs/example.nginx.conf (see the $main_domain variable)
|
||||
*
|
||||
* Note: you may provide multiple origins for the purpose of accessing
|
||||
* a development instance via different URLs, like so:
|
||||
* httpUnsafeOrigin: 'http://127.0.0.1:3000/ http://localhost:3000/',
|
||||
*
|
||||
* Such configuration is not recommended for production instances,
|
||||
* as the development team does not actively test such configuration
|
||||
* and it may have unintended consequences in practice.
|
||||
*
|
||||
*/
|
||||
httpUnsafeOrigin: 'https://cryptpad.qcode.ch',
|
||||
|
||||
/* httpSafeOrigin is the URL that is used for the 'sandbox' described above.
|
||||
* If you're testing or developing with CryptPad on your local machine then
|
||||
* it is appropriate to leave this blank. The default behaviour is to serve
|
||||
* the main domain over port 3000 and to serve the content over port 3001.
|
||||
*
|
||||
* This is not appropriate in a production environment where invasive networks
|
||||
* may filter traffic going over abnormal ports.
|
||||
* To correctly configure your production instance you must provide a URL
|
||||
* with a different domain (a subdomain is sufficient).
|
||||
* It will be used to load the UI in our 'sandbox' system.
|
||||
*
|
||||
* This value corresponds to the $sandbox_domain variable
|
||||
* in the example nginx file.
|
||||
*
|
||||
* CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS.
|
||||
*/
|
||||
httpSafeOrigin: 'https://cryptpad.qcodecdn.ch',
|
||||
|
||||
/* httpAddress specifies the address on which the nodejs server
|
||||
* should be accessible. By default it will listen on 127.0.0.1
|
||||
* (IPv4 localhost on most systems). If you want it to listen on
|
||||
* all addresses, including IPv6, set this to '::'.
|
||||
*
|
||||
*/
|
||||
httpAddress: '127.0.0.1',
|
||||
|
||||
/* httpPort specifies on which port the nodejs server should listen.
|
||||
* By default it will serve content over port 3000, which is suitable
|
||||
* for both local development and for use with the provided nginx example,
|
||||
* which will proxy websocket traffic to your node server.
|
||||
*
|
||||
*/
|
||||
httpPort: 3000,
|
||||
|
||||
/* httpSafePort allows you to specify an alternative port from which
|
||||
* the node process should serve sandboxed assets. The default value is
|
||||
* that of your httpPort + 1. You probably don't need to change this.
|
||||
*
|
||||
*/
|
||||
//httpSafePort: 3001,
|
||||
|
||||
/* CryptPad will launch a child process for every core available
|
||||
* in order to perform CPU-intensive tasks in parallel.
|
||||
* Some host environments may have a very large number of cores available
|
||||
* or you may want to limit how much computing power CryptPad can take.
|
||||
* If so, set 'maxWorkers' to a positive integer.
|
||||
*/
|
||||
// maxWorkers: 4,
|
||||
|
||||
/* =====================
|
||||
* Admin
|
||||
* ===================== */
|
||||
|
||||
/*
|
||||
* CryptPad contains an administration panel. Its access is restricted to specific
|
||||
* users using the following list.
|
||||
* To give access to the admin panel to a user account, just add their public signing
|
||||
* key, which can be found on the settings page for registered users.
|
||||
* Entries should be strings separated by a comma.
|
||||
*/
|
||||
adminKeys: [
|
||||
'[admin@cryptpad.qcode.ch/LSxbkUbVQbJZ8Tqna6Y2gg69iI0eRclGe+NjJrtiW-A=]',
|
||||
'[x1ddos@cryptpad.qcode.ch/w74oU0GPvPc9OxX+2l0kefvQOSZwI61E4lpZeACJlTw=]',
|
||||
],
|
||||
adminEmail: 'root@qcode.ch',
|
||||
|
||||
/* =====================
|
||||
* STORAGE
|
||||
* ===================== */
|
||||
|
||||
/* Pads that are not 'pinned' by any registered user can be set to expire
|
||||
* after a configurable number of days of inactivity (default 90 days).
|
||||
* The value can be changed or set to false to remove expiration.
|
||||
* Expired pads can then be removed using a cron job calling the
|
||||
* `evict-inactive.js` script with node
|
||||
*
|
||||
* defaults to 90 days if nothing is provided
|
||||
*/
|
||||
inactiveTime: false,
|
||||
|
||||
/* CryptPad archives some data instead of deleting it outright.
|
||||
* This archived data still takes up space and so you'll probably still want to
|
||||
* remove these files after a brief period.
|
||||
*
|
||||
* cryptpad/scripts/evict-inactive.js is intended to be run daily
|
||||
* from a crontab or similar scheduling service.
|
||||
*
|
||||
* The intent with this feature is to provide a safety net in case of accidental
|
||||
* deletion. Set this value to the number of days you'd like to retain
|
||||
* archived data before it's removed permanently.
|
||||
*
|
||||
* defaults to 15 days if nothing is provided
|
||||
*/
|
||||
archiveRetentionTime: 7,
|
||||
|
||||
/* It's possible to configure your instance to remove data
|
||||
* stored on behalf of inactive accounts. Set 'accountRetentionTime'
|
||||
* to the number of days an account can remain idle before its
|
||||
* documents and other account data is removed.
|
||||
*
|
||||
* Leave this value commented out to preserve all data stored
|
||||
* by user accounts regardless of inactivity.
|
||||
*/
|
||||
accountRetentionTime: 365,
|
||||
|
||||
/* Starting with CryptPad 3.23.0, the server automatically runs
|
||||
* the script responsible for removing inactive data according to
|
||||
* your configured definition of inactivity. Set this value to `true`
|
||||
* if you prefer not to remove inactive data, or if you prefer to
|
||||
* do so manually using `scripts/evict-inactive.js`.
|
||||
*/
|
||||
//disableIntegratedEviction: true,
|
||||
|
||||
|
||||
/* Max Upload Size (bytes)
|
||||
* this sets the maximum size of any one file uploaded to the server.
|
||||
* anything larger than this size will be rejected
|
||||
* defaults to 20MB if no value is provided
|
||||
*/
|
||||
maxUploadSize: 100 * 1024 * 1024,
|
||||
|
||||
/* Users with premium accounts (those with a plan included in their customLimit)
|
||||
* can benefit from an increased upload size limit. By default they are restricted to the same
|
||||
* upload size as any other registered user.
|
||||
*
|
||||
*/
|
||||
//premiumUploadSize: 100 * 1024 * 1024,
|
||||
|
||||
/* =====================
|
||||
* DATABASE VOLUMES
|
||||
* ===================== */
|
||||
|
||||
/*
|
||||
* CryptPad stores each document in an individual file on your hard drive.
|
||||
* Specify a directory where files should be stored.
|
||||
* It will be created automatically if it does not already exist.
|
||||
*/
|
||||
filePath: './data/datastore/',
|
||||
|
||||
/* CryptPad offers the ability to archive data for a configurable period
|
||||
* before deleting it, allowing a means of recovering data in the event
|
||||
* that it was deleted accidentally.
|
||||
*
|
||||
* To set the location of this archive directory to a custom value, change
|
||||
* the path below:
|
||||
*/
|
||||
archivePath: './data/archive',
|
||||
|
||||
/* CryptPad allows logged in users to request that particular documents be
|
||||
* stored by the server indefinitely. This is called 'pinning'.
|
||||
* Pin requests are stored in a pin-store. The location of this store is
|
||||
* defined here.
|
||||
*/
|
||||
pinPath: './data/pins',
|
||||
|
||||
/* if you would like the list of scheduled tasks to be stored in
|
||||
a custom location, change the path below:
|
||||
*/
|
||||
taskPath: './data/tasks',
|
||||
|
||||
/* if you would like users' authenticated blocks to be stored in
|
||||
a custom location, change the path below:
|
||||
*/
|
||||
blockPath: './data/block',
|
||||
|
||||
/* CryptPad allows logged in users to upload encrypted files. Files/blobs
|
||||
* are stored in a 'blob-store'. Set its location here.
|
||||
*/
|
||||
blobPath: './data/blob',
|
||||
|
||||
/* CryptPad stores incomplete blobs in a 'staging' area until they are
|
||||
* fully uploaded. Set its location here.
|
||||
*/
|
||||
blobStagingPath: './data/blobstage',
|
||||
|
||||
decreePath: './data/decrees',
|
||||
|
||||
/* CryptPad supports logging events directly to the disk in a 'logs' directory
|
||||
* Set its location here, or set it to false (or nothing) if you'd rather not log
|
||||
*/
|
||||
logPath: './data/logs',
|
||||
|
||||
/* =====================
|
||||
* Debugging
|
||||
* ===================== */
|
||||
|
||||
/* CryptPad can log activity to stdout
|
||||
* This may be useful for debugging
|
||||
*/
|
||||
logToStdout: true,
|
||||
|
||||
/* CryptPad can be configured to log more or less
|
||||
* the various settings are listed below by order of importance
|
||||
*
|
||||
* silly, verbose, debug, feedback, info, warn, error
|
||||
*
|
||||
* Choose the least important level of logging you wish to see.
|
||||
* For example, a 'silly' logLevel will display everything,
|
||||
* while 'info' will display 'info', 'warn', and 'error' logs
|
||||
*
|
||||
* This will affect both logging to the console and the disk.
|
||||
*/
|
||||
logLevel: 'debug',
|
||||
|
||||
/* clients can use the /settings/ app to opt out of usage feedback
|
||||
* which informs the server of things like how much each app is being
|
||||
* used, and whether certain clientside features are supported by
|
||||
* the client's browser. The intent is to provide feedback to the admin
|
||||
* such that the service can be improved. Enable this with `true`
|
||||
* and ignore feedback with `false` or by commenting the attribute
|
||||
*
|
||||
* You will need to set your logLevel to include 'feedback'. Set this
|
||||
* to false if you'd like to exclude feedback from your logs.
|
||||
*/
|
||||
logFeedback: false,
|
||||
|
||||
/* CryptPad supports verbose logging
|
||||
* (false by default)
|
||||
*/
|
||||
verbose: true,
|
||||
|
||||
/* Surplus information:
|
||||
*
|
||||
* 'installMethod' is included in server telemetry to voluntarily
|
||||
* indicate how many instances are using unofficial installation methods
|
||||
* such as Docker.
|
||||
*
|
||||
*/
|
||||
installMethod: 'unspecified',
|
||||
};
|
||||
@ -0,0 +1,16 @@
|
||||
<!DOCTYPE html>
|
||||
<html class="cp" id="four-oh-four">
|
||||
<!-- If this file is not called customize.dist/src/template.html, it is generated -->
|
||||
<head>
|
||||
<title data-localization="main_title">CryptPad: Collaboration suite, encrypted and open-source</title>
|
||||
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
|
||||
<link rel="icon" type="image/png" href="/customize/favicon/main-favicon.png" id="favicon"/>
|
||||
<script async data-bootload="/customize/four-oh-four.js" data-main="/common/boot.js?ver=1.0" src="/bower_components/requirejs/require.js?ver=2.3.5"></script>
|
||||
</head>
|
||||
<body class="html">
|
||||
<noscript>
|
||||
<h1>404</h1>
|
||||
<h3>We couldn't find the page you were looking for</h3>
|
||||
|
||||
</noscript>
|
||||
@ -0,0 +1,16 @@
|
||||
<!DOCTYPE html>
|
||||
<html class="cp" id="five-hundred">
|
||||
<!-- If this file is not called customize.dist/src/template.html, it is generated -->
|
||||
<head>
|
||||
<title data-localization="main_title">CryptPad: Collaboration suite, encrypted and open-source</title>
|
||||
<meta content="text/html; charset=utf-8" http-equiv="content-type"/>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
|
||||
<link rel="icon" type="image/png" href="/customize/favicon/main-favicon.png" id="favicon"/>
|
||||
<script async data-bootload="/customize/four-oh-four.js" data-main="/common/boot.js?ver=1.0" src="/bower_components/requirejs/require.js?ver=2.3.5"></script>
|
||||
</head>
|
||||
<body class="html">
|
||||
<noscript>
|
||||
<h1>500</h1>
|
||||
<h3>Internal server error</h3>
|
||||
|
||||
</noscript>
|
||||
@ -0,0 +1,19 @@
|
||||
// see all options in www/common/application_config_internal.js
|
||||
define(['/common/application_config_internal.js'], function (AppConfig) {
|
||||
// remove the survey link in the menu
|
||||
AppConfig.surveyURL = "";
|
||||
|
||||
// show all app types in document creation dialog
|
||||
AppConfig.hiddenTypes = [];
|
||||
|
||||
// enable OnlyOffice docs and preso support
|
||||
AppConfig.enableEarlyAccess = true;
|
||||
|
||||
// user passwords are hashed with scrypt, and salted with their username.
|
||||
// this value will be appended to the username, causing the resulting hash
|
||||
// to differ from other CryptPad instances if customized.
|
||||
AppConfig.loginSalt = '';
|
||||
AppConfig.minimumPasswordLength = 8;
|
||||
|
||||
return AppConfig;
|
||||
});
|
||||
@ -0,0 +1,219 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name cryptpad.qcode.ch cryptpad.qcodecdn.ch;
|
||||
|
||||
access_log /var/log/nginx/cryptpad.log;
|
||||
error_log /var/log/nginx/cryptpad.log;
|
||||
|
||||
# expected to cover both main and sandbox hostnames.
|
||||
ssl_certificate /etc/ssl/qcode/cryptpad.qcode.ch.crt;
|
||||
ssl_certificate_key /etc/ssl/qcode/cryptpad.qcode.ch.key;
|
||||
|
||||
ssl_dhparam /etc/nginx/snippets/dhparam; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
|
||||
ssl_session_timeout 5m;
|
||||
ssl_session_cache shared:cryptpadSSL:5m;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
# https://cipherli.st/
|
||||
ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
|
||||
ssl_ecdh_curve secp384r1;
|
||||
|
||||
# CryptPad serves static assets over these two domains.
|
||||
# `main_domain` is what users will enter in their address bar.
|
||||
# Privileged computation such as key management is handled in this scope
|
||||
# UI content is loaded via the `sandbox_domain`.
|
||||
# "Content Security Policy" headers prevent content loaded via the sandbox
|
||||
# from accessing privileged information.
|
||||
# These variables must be different to take advantage of CryptPad's sandboxing techniques.
|
||||
# In the event of an XSS vulnerability in CryptPad's front-end code
|
||||
# this will limit the amount of information accessible to attackers.
|
||||
set $main_domain "cryptpad.qcode.ch";
|
||||
set $sandbox_domain "cryptpad.qcodecdn.ch";
|
||||
|
||||
# By default CryptPad allows remote domains to embed CryptPad documents in iframes.
|
||||
# This behaviour can be blocked by changing $allowed_origins from "*" to the
|
||||
# sandbox domain, which must be permitted to load content from the main domain
|
||||
# in order for CryptPad to work as expected.
|
||||
#
|
||||
# An example is given below which can be uncommented if you want to block
|
||||
# remote sites from including content from your server
|
||||
set $allowed_origins "*";
|
||||
# set $allowed_origins "https://${sandbox_domain}";
|
||||
|
||||
# CryptPad's dynamic content (websocket traffic and encrypted blobs)
|
||||
# can be served over separate domains. Using dedicated domains (or subdomains)
|
||||
# for these purposes allows you to move them to a separate machine at a later date
|
||||
# if you find that a single machine cannot handle all of your users.
|
||||
# If you don't use dedicated domains, this can be the same as $main_domain
|
||||
# If you do, they can be added as exceptions to any rules which block connections to remote domains.
|
||||
# You can find these variables referenced below in the relevant places
|
||||
set $api_domain "cryptpad.qcode.ch";
|
||||
#set $files_domain "files.your-main-domain.com";
|
||||
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header Access-Control-Allow-Origin "${allowed_origins}";
|
||||
# add_header X-Frame-Options "SAMEORIGIN";
|
||||
|
||||
# Enable SharedArrayBuffer in Firefox (for .xlsx export)
|
||||
add_header Cross-Origin-Resource-Policy cross-origin;
|
||||
add_header Cross-Origin-Embedder-Policy require-corp;
|
||||
|
||||
# Insert the path to your CryptPad repository root here
|
||||
root /home/cryptpad/static;
|
||||
index index.html;
|
||||
#error_page 404 customize/404.html;
|
||||
|
||||
# any static assets loaded with "ver=" in their URL will be cached for a year
|
||||
if ($args ~ ver=) {
|
||||
set $cacheControl max-age=31536000;
|
||||
}
|
||||
if ($uri ~ ^/.*(\/|\.html)$) {
|
||||
set $cacheControl no-cache;
|
||||
}
|
||||
# Will not set any header if it is emptystring
|
||||
add_header Cache-Control $cacheControl;
|
||||
|
||||
# CSS can be dynamically set inline, loaded from the same domain, or from $main_domain
|
||||
set $styleSrc "'unsafe-inline' 'self' https://${main_domain}";
|
||||
|
||||
# connect-src restricts URLs which can be loaded using script interfaces
|
||||
# if you have configured your instance to use a dedicated $files_domain or $api_domain
|
||||
# you will need to add them below as: https://${files_domain} and https://${api_domain}
|
||||
set $connectSrc "'self' https://${main_domain} blob: wss://${api_domain} https://${sandbox_domain}";
|
||||
|
||||
# fonts can be loaded from data-URLs or the main domain
|
||||
set $fontSrc "'self' data: https://${main_domain}";
|
||||
|
||||
# images can be loaded from anywhere, though we'd like to deprecate this as it allows the use of images for tracking
|
||||
set $imgSrc "'self' data: blob: https://${main_domain}";
|
||||
|
||||
# frame-src specifies valid sources for nested browsing contexts.
|
||||
# this prevents loading any iframes from anywhere other than the sandbox domain
|
||||
set $frameSrc "'self' https://${sandbox_domain} blob:";
|
||||
|
||||
# specifies valid sources for loading media using video or audio
|
||||
set $mediaSrc "blob:";
|
||||
|
||||
# defines valid sources for webworkers and nested browser contexts
|
||||
# deprecated in favour of worker-src and frame-src
|
||||
set $childSrc "https://${main_domain}";
|
||||
|
||||
# specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.
|
||||
# supercedes child-src but is unfortunately not yet universally supported.
|
||||
set $workerSrc "'self'";
|
||||
|
||||
# script-src specifies valid sources for javascript, including inline handlers
|
||||
set $scriptSrc "'self' resource: https://${main_domain}";
|
||||
|
||||
# frame-ancestors specifies which origins can embed your CryptPad instance
|
||||
# this must include 'self' and your main domain (over HTTPS) in order for CryptPad to work
|
||||
# if you have enabled remote embedding via the admin panel then this must be more permissive.
|
||||
# note: cryptpad.fr permits web pages served via https: and vector: (element desktop app)
|
||||
set $frameAncestors "'self' https://${main_domain}";
|
||||
# set $frameAncestors "'self' https: vector:";
|
||||
|
||||
set $unsafe 0;
|
||||
# the following assets are loaded via the sandbox domain
|
||||
# they unfortunately still require exceptions to the sandboxing to work correctly.
|
||||
if ($uri ~ ^\/(sheet|doc|presentation)\/inner.html.*$) { set $unsafe 1; }
|
||||
if ($uri ~ ^\/common\/onlyoffice\/.*\/.*\.html.*$) { set $unsafe 1; }
|
||||
|
||||
# everything except the sandbox domain is a privileged scope, as they might be used to handle keys
|
||||
if ($host != $sandbox_domain) { set $unsafe 0; }
|
||||
# this iframe is an exception. Office file formats are converted outside of the sandboxed scope
|
||||
# because of bugs in Chromium-based browsers that incorrectly ignore headers that are supposed to enable
|
||||
# the use of some modern APIs that we require when javascript is run in a cross-origin context.
|
||||
# We've applied other sandboxing techniques to mitigate the risk of running WebAssembly in this privileged scope
|
||||
if ($uri ~ ^\/unsafeiframe\/inner\.html.*$) { set $unsafe 1; }
|
||||
|
||||
# privileged contexts allow a few more rights than unprivileged contexts, though limits are still applied
|
||||
if ($unsafe) {
|
||||
set $scriptSrc "'self' 'unsafe-eval' 'unsafe-inline' resource: https://${main_domain}";
|
||||
}
|
||||
|
||||
# Finally, set all the rules you composed above.
|
||||
add_header Content-Security-Policy "default-src 'none'; child-src $childSrc; worker-src $workerSrc; media-src $mediaSrc; style-src $styleSrc; script-src $scriptSrc; connect-src $connectSrc; font-src $fontSrc; img-src $imgSrc; frame-src $frameSrc; frame-ancestors $frameAncestors";
|
||||
|
||||
# The nodejs process can handle all traffic whether accessed over websocket or as static assets
|
||||
# We prefer to serve static content from nginx directly and to leave the API server to handle
|
||||
# the dynamic content that only it can manage. This is primarily an optimization
|
||||
location ^~ /cryptpad_websocket {
|
||||
proxy_pass http://localhost:3000;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# WebSocket support (nginx 1.4)
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection upgrade;
|
||||
}
|
||||
|
||||
location ^~ /api/ {
|
||||
proxy_pass http://localhost:3000;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# These settings prevent both NGINX and the API server
|
||||
# from setting the same headers and creating duplicates
|
||||
proxy_hide_header Cross-Origin-Resource-Policy;
|
||||
add_header Cross-Origin-Resource-Policy cross-origin;
|
||||
proxy_hide_header Cross-Origin-Embedder-Policy;
|
||||
add_header Cross-Origin-Embedder-Policy require-corp;
|
||||
}
|
||||
|
||||
# encrypted blobs are immutable and are thus cached for a year
|
||||
location ^~ /blob/ {
|
||||
root /home/cryptpad/data;
|
||||
if ($request_method = 'OPTIONS') {
|
||||
add_header Access-Control-Allow-Origin "${allowed_origins}";
|
||||
add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
|
||||
add_header Access-Control-Allow-Headers 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
|
||||
add_header Access-Control-Max-Age 1728000;
|
||||
add_header Content-Type 'application/octet-stream; charset=utf-8';
|
||||
add_header Content-Length 0;
|
||||
return 204;
|
||||
}
|
||||
add_header Access-Control-Allow-Origin "${allowed_origins}";
|
||||
add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
|
||||
add_header Access-Control-Allow-Headers 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header Cache-Control max-age=31536000;
|
||||
add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Content-Length';
|
||||
}
|
||||
|
||||
# the "block-store" serves encrypted payloads containing users' drive keys
|
||||
# these payloads are unlocked via login credentials. They are mutable
|
||||
# and are thus never cached. They're small enough that it doesn't matter, in any case.
|
||||
location ^~ /block/ {
|
||||
root /home/cryptpad/data;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header Cache-Control max-age=0;
|
||||
}
|
||||
|
||||
# The nodejs server has some built-in forwarding rules to prevent
|
||||
# URLs like /pad from resulting in a 404. This simply adds a trailing slash
|
||||
# to a variety of applications.
|
||||
location ~ ^/(register|login|settings|user|pad|drive|poll|slide|code|whiteboard|file|media|profile|contacts|todo|filepicker|debug|kanban|sheet|support|admin|notifications|teams|calendar|presentation|doc|form|report|convert|checkup)$ {
|
||||
return 301 https://${main_domain}/$1/;
|
||||
}
|
||||
|
||||
# try to load customizeable content via /customize/ and fall back to the default content
|
||||
# located at /customize.dist/
|
||||
# This is what allows you to override behaviour.
|
||||
location ~ /customize/(.*)$ {
|
||||
rewrite ^/customize/(.*)$ $1 break;
|
||||
try_files /customize/$uri /customize.dist/$uri;
|
||||
#try_files /customize/$1 /customize.dist/$1 =404;
|
||||
}
|
||||
location ^~ /customize.dist/ {
|
||||
# simply serve static files from root
|
||||
}
|
||||
|
||||
# Finally, serve anything the above exceptions don't govern.
|
||||
try_files /www/$uri /www/$uri/index.html /customize/$uri;
|
||||
}
|
||||
@ -0,0 +1,90 @@
|
||||
A custom self-hosted instance of [CryptPad](https://cryptpad.fr/) for qcode
|
||||
infra, accessible at https://cryptpad.qcode.ch.
|
||||
|
||||
The upstream code lives in the [cryptpad](cryptpad/) sub directory. This
|
||||
is placed as a git subtree, not to be confused with submodule. To customize
|
||||
functionality or look&feel, copy a file from
|
||||
[cryptpad/customize.dist](cryptpad/customize.dist/) into
|
||||
[customize](customize/) and change it. The file will be served in place of
|
||||
the original dist.
|
||||
|
||||
See [upstream docs](https://docs.cryptpad.fr/en/admin_guide/customization.html)
|
||||
for customization details.
|
||||
|
||||
## Updating from upstream
|
||||
|
||||
Check the current status of the local cryptpad copy with:
|
||||
|
||||
git log cryptpad
|
||||
|
||||
Then go to https://github.com/xwiki-labs/cryptpad/commits/main and check where
|
||||
the upstream is at.
|
||||
|
||||
To update local copy with upstream changes, use
|
||||
[tools/pull-cryptpad-upstream.sh](tools/pull-cryptpad-upstream.sh) script.
|
||||
For example, to pull up to an imaginary release tag xyz, execute:
|
||||
|
||||
./tools/pull-cryptpad-upstream.sh xyz
|
||||
|
||||
It'll fetch from upstream and add new commits as if they were part of this repo.
|
||||
Finally, `git push` to update this repo's remote.
|
||||
|
||||
If instead you want to make a pull request, first create a branch. Something like
|
||||
`git checkout -b upstream-update-xyz master` should do. Then execute the above
|
||||
script and send the branch as a pull request.
|
||||
|
||||
For the record, initial subtree merge from upstream was done with the following
|
||||
command:
|
||||
|
||||
git subtree add -P cryptpad https://github.com/xwiki-labs/cryptpad.git 4.14.0
|
||||
|
||||
## Contributing to upstream
|
||||
|
||||
You'll probably want to have a separate repository, cloned directly from the
|
||||
upstream `https://github.com/xwiki-labs/cryptpad.git`. Since this repo's
|
||||
cryptpad dir is a copy of the upstream repo, it should be very easy to apply
|
||||
changes to both using patch files and `git apply` or `patch` commands.
|
||||
|
||||
See details on [how to contribute](https://docs.cryptpad.fr/en/how_to_contribute.html)
|
||||
in the upstream docs.
|
||||
|
||||
## Dev environment
|
||||
|
||||
To start a local dev instance, forget about the files in the root of this repo
|
||||
and simply work in the [cryptpad](cryptpad/) sub directory. In other words,
|
||||
follow [upstream dev guide](https://docs.cryptpad.fr/en/dev_guide/setup.html).
|
||||
|
||||
When done, a `git diff` will show some changes. Those in the `cryptpad/` sub
|
||||
directory should go to upstream. Anything else, notably the [customize](customize/)
|
||||
directory, lives in this repo.
|
||||
|
||||
## Production instance
|
||||
|
||||
To build for prod deployment, you'll need [podman](https://podman.io).
|
||||
Create prod build artifacts manually with:
|
||||
|
||||
./tools/build-prod.sh
|
||||
|
||||
The script creates few files in the `build` directory. Notably, the two files
|
||||
required for prod deployment are:
|
||||
|
||||
- `cryptpad-container-img-<git-commit-hash>.tar.gz`: container file with
|
||||
the nodejs server
|
||||
- `cryptpad-static-<git-commit-hash>.tar.gz`: static files served by
|
||||
nginx frontend
|
||||
|
||||
Copy both files to production machines. The `cryptpad-container-img.tar.gz` can
|
||||
be loaded on the machine with:
|
||||
|
||||
podman load path/to/cryptpad-container-img.tar.gz
|
||||
|
||||
Unpack the static files into a temp dir and sync with the prod dir:
|
||||
|
||||
rsync -rl --chown root:root --delete-after tmpdir/ path/to/proddir/
|
||||
|
||||
There are also a couple of config files, `config.js` and `nginx.conf`, in the root
|
||||
of this repo. These are production configs and will eventually move to
|
||||
another location with all the other prod infra configs.
|
||||
|
||||
All the manual steps described above will disappear once a central prod infra
|
||||
is in place.
|
||||
@ -0,0 +1,47 @@
|
||||
#!/bin/sh -e
|
||||
PODMAN=podman
|
||||
if ! type podman > /dev/null; then
|
||||
printf "$0 requires podman; see https://podman.io\n" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
cd $(dirname $0)/..
|
||||
|
||||
# all build artifacts are stored with this version suffix
|
||||
VERSION=$(git rev-parse --short HEAD)
|
||||
mkdir -p build
|
||||
|
||||
# cryptpad's node server needs a couple files from www/common.
|
||||
# it also needs 404.html and 500.html from customize[.dist], otherwise
|
||||
# the express server hogs CPU at 100% if a request hits a nonexistent file.
|
||||
# the customize dir must be mounted in read-only at container start.
|
||||
tar -cf build/bootstrap.tar \
|
||||
-C cryptpad \
|
||||
.bowerrc \
|
||||
bower.json \
|
||||
lib \
|
||||
package-lock.json \
|
||||
package.json \
|
||||
scripts \
|
||||
server.js \
|
||||
LICENSE
|
||||
mkdir -p cryptpad/www/bower_components
|
||||
$PODMAN build --rm --squash --net=host \
|
||||
-v $PWD/cryptpad/www/bower_components:/build/www/bower_components \
|
||||
-t cryptpad .
|
||||
$PODMAN save cryptpad | gzip > build/cryptpad-container-img-$VERSION.tar.gz
|
||||
|
||||
# static files served by an HTTP frontend, as well as the customize dir
|
||||
# required by the node server run in a container image.
|
||||
STATIC_TAR_OUT=build/cryptpad-static-$VERSION.tar
|
||||
tar -cf $STATIC_TAR_OUT \
|
||||
-C cryptpad \
|
||||
customize.dist \
|
||||
www \
|
||||
LICENSE
|
||||
# append custom files, in a separate step to preserve desired file
|
||||
# tree structure.
|
||||
tar -rf $STATIC_TAR_OUT customize
|
||||
printf "${VERSION}" > build/commit.txt
|
||||
tar -rf $STATIC_TAR_OUT -C build commit.txt
|
||||
# finally, gzip the archive for faster transfer/deployment.
|
||||
gzip -f $STATIC_TAR_OUT
|
||||
@ -0,0 +1,11 @@
|
||||
#!/bin/sh
|
||||
REPO="https://github.com/xwiki-labs/cryptpad.git"
|
||||
PREFIX=cryptpad
|
||||
REF="${1}"
|
||||
if [ -z "${ref}" ]; then
|
||||
printf "usage: $0 <ref>\n" 1>&2
|
||||
printf "ref: main, tag, branch or commit hash\n" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
cd $(dirname $0)/..
|
||||
exec git subtree pull -P "${PREFIX}" "${REPO}" "${REF}"
|
||||
Loading…
Reference in New Issue