chaim
0340a670ed
Implements the fixes catalogued under Task Master tasks 1-19, derived from the security audit at .claude/plans/adaptive-sleeping-diffie.md. Critical - C-1 SSRF userinfo bypass: PDF proxy now rejects URLs containing userinfo or non-default ports, and asserts netloc == hostname. - C-2 No authentication: optional NADLAN_API_KEY gate guards /api/search/*, /api/appraisals/pdf and /mcp until Traefik mTLS is wired up. Default behavior unchanged when env unset. High - H-1 Error info leak: HTTPException details replaced with generic string; full exceptions still logged via logger.exception. - H-2 Security headers middleware: HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, CSP, server-banner stripped. - H-3 Swagger gated: /api/docs and /api/openapi.json hidden when ENVIRONMENT=production. - H-4 PDF proxy DoS: streams in 8KB chunks, rejects upstream above 50MB Content-Length, also rejects mid-stream overrun. Magic-byte check moved before StreamingResponse so we can 502 cleanly. - H-5 Per-IP rate limit: token-bucket per (path, IP) on /mcp, /api/search/*, /api/appraisals/pdf. Reads X-Forwarded-For for client IP behind Traefik. Medium - M-1 CORS: ALLOWED_ORIGINS env, allow_headers narrowed, no creds. - M-2 Deal model: extra="ignore" + explicit fields for gushNum, parcelNum, subParcelNum, streetNameHeb, houseNum, deal_source, deal_type, deal_type_description, distance_meters. Frontend now reads snake_case. - M-3 Input validators: regex on block, plot, appraiser names, dates, address, free-text — Hebrew + Latin + safe punctuation. - M-4 COOLIFY_UUID moved out of deploy.yaml into Gitea Actions secret. - M-5 Base images pinned to sha256 digests. - M-6 Runtime deps tightened to ~= compatible-release. - M-7 1MB request-body size limit middleware. Low / privacy - L-1 Heebo self-hosted via @fontsource. Removed Google Fonts links and CSP entries. Added meta referrer + meta robots noindex. - L-2 Cache-Control: immutable for /assets, no-cache for HTML. - L-3 Logger no longer prints user-supplied addresses; emits length only. - L-4 Dockerfile healthcheck uses literal port 8000. - L-5 PDF proxy stream cleanup uses contextlib.suppress. Tests: 331 passed, 17 skipped. Frontend typecheck passes. Findings file: .claude/plans/adaptive-sleeping-diffie.md Tasks: .taskmaster/tasks/tasks.json Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
57 lines
1.6 KiB
YAML
57 lines
1.6 KiB
YAML
name: Build & Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
|
|
env:
|
|
REGISTRY: gitea.dev.marcus-law.co.il
|
|
IMAGE: mcp-servers/nadlan-mcp
|
|
# COOLIFY_UUID is provided as a Gitea Actions secret to avoid leaking
|
|
# the infra mapping in source control.
|
|
|
|
jobs:
|
|
build-and-deploy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Login to Gitea Registry
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
|
|
docker login ${{ env.REGISTRY }} \
|
|
-u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build and tag image
|
|
run: |
|
|
BASE="${{ env.REGISTRY }}/${{ env.IMAGE }}"
|
|
TAGS="-t ${BASE}:latest -t ${BASE}:build-${{ github.run_number }}"
|
|
|
|
REF="${{ github.ref }}"
|
|
if [[ "$REF" == refs/tags/v* ]]; then
|
|
VERSION="${REF#refs/tags/}"
|
|
TAGS="$TAGS -t ${BASE}:${VERSION}"
|
|
fi
|
|
|
|
docker build $TAGS .
|
|
|
|
- name: Push image
|
|
run: |
|
|
BASE="${{ env.REGISTRY }}/${{ env.IMAGE }}"
|
|
docker push "${BASE}:latest"
|
|
docker push "${BASE}:build-${{ github.run_number }}"
|
|
|
|
REF="${{ github.ref }}"
|
|
if [[ "$REF" == refs/tags/v* ]]; then
|
|
VERSION="${REF#refs/tags/}"
|
|
docker push "${BASE}:${VERSION}"
|
|
fi
|
|
|
|
- name: Trigger Coolify redeploy
|
|
run: |
|
|
curl -sf \
|
|
"http://coolify:8080/api/v1/deploy?uuid=${{ secrets.COOLIFY_UUID }}&force=true" \
|
|
-H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
|