mirror of
https://github.com/R0m1k3/FlowReader.git
synced 2026-10-14 18:59:52 +02:00
Claude
f3816f4d78
Replaces the Go server with a Rust one (axum, tokio, sqlx, feed-rs, ammonia, reqwest) serving the same REST/WebSocket API, so the React frontend is unchanged. - Same database: migrations keep the schema_migrations table and file names, Argon2id hashes and hashed session tokens created by the Go server keep working (users stay logged in), and feed item GUIDs are computed the same way, so existing articles are not re-ingested. - Same security model: SSRF-safe fetching (public addresses only, checked at resolution time and on every redirect), HTML sanitization, CSP and security headers, same-origin guard, WebSocket origin check, per-IP / per-user rate limits, trusted-proxy aware client IPs. - Fix: articles whose publication date lies in the future (ingested before the clamp existed) pinned the top of the list. The maintenance job now pulls such dates back at startup and daily. - Relative links and images in feed content are resolved against the article URL instead of being dropped. - Deploy: static musl binary in an Alpine image; the Unraid compose file uses pull_policy: always so the new image is applied on the next `docker compose up -d`. CI runs fmt, clippy and tests (including a PostgreSQL integration test) before building the image. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fc1UFpB4V1MGWLxHAu3BMK
78 lines
2.5 KiB
Rust
78 lines
2.5 KiB
Rust
//! Configuration from environment variables.
|
|
|
|
use std::net::IpAddr;
|
|
use std::path::PathBuf;
|
|
|
|
use ipnet::IpNet;
|
|
|
|
#[derive(Debug, Clone)]
|
|
pub struct Config {
|
|
pub port: u16,
|
|
pub database_url: String,
|
|
pub static_dir: PathBuf,
|
|
pub migrations_dir: PathBuf,
|
|
/// REGISTRATION_ENABLED=false closes sign-ups; the first account (admin
|
|
/// bootstrap) is always allowed.
|
|
pub registration_enabled: bool,
|
|
/// CIDRs whose X-Forwarded-For header is believed (TRUSTED_PROXIES).
|
|
pub trusted_proxies: Vec<IpNet>,
|
|
/// COOKIE_SECURE override: Some(true/false) or None for auto-detection.
|
|
pub cookie_secure: Option<bool>,
|
|
/// Extra hosts allowed as WebSocket origins (WS_ALLOWED_ORIGINS).
|
|
pub ws_allowed_origins: Vec<String>,
|
|
}
|
|
|
|
fn env(key: &str) -> Option<String> {
|
|
std::env::var(key).ok()
|
|
}
|
|
|
|
fn parse_bool(raw: &str) -> Option<bool> {
|
|
match raw.trim().to_ascii_lowercase().as_str() {
|
|
"true" | "1" | "yes" => Some(true),
|
|
"false" | "0" | "no" => Some(false),
|
|
_ => None,
|
|
}
|
|
}
|
|
|
|
pub fn parse_prefixes(raw: &str) -> Vec<IpNet> {
|
|
raw.split(',')
|
|
.map(str::trim)
|
|
.filter(|s| !s.is_empty())
|
|
.filter_map(|s| {
|
|
if s.contains('/') {
|
|
s.parse::<IpNet>().ok().map(|n| n.trunc())
|
|
} else {
|
|
s.parse::<IpAddr>().ok().map(IpNet::from)
|
|
}
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
impl Config {
|
|
pub fn from_env() -> Self {
|
|
Self {
|
|
port: env("PORT").and_then(|p| p.parse().ok()).unwrap_or(8080),
|
|
database_url: env("DATABASE_URL").unwrap_or_else(|| {
|
|
"postgres://flowreader:flowreader@db:5432/flowreader?sslmode=disable".into()
|
|
}),
|
|
static_dir: env("STATIC_DIR")
|
|
.unwrap_or_else(|| "./web/dist".into())
|
|
.into(),
|
|
migrations_dir: env("MIGRATIONS_DIR")
|
|
.unwrap_or_else(|| "./migrations".into())
|
|
.into(),
|
|
registration_enabled: env("REGISTRATION_ENABLED")
|
|
.and_then(|v| parse_bool(&v))
|
|
.unwrap_or(true),
|
|
trusted_proxies: parse_prefixes(&env("TRUSTED_PROXIES").unwrap_or_default()),
|
|
cookie_secure: env("COOKIE_SECURE").and_then(|v| parse_bool(&v)),
|
|
ws_allowed_origins: env("WS_ALLOWED_ORIGINS")
|
|
.unwrap_or_default()
|
|
.split(',')
|
|
.map(|o| o.trim().to_ascii_lowercase())
|
|
.filter(|o| !o.is_empty())
|
|
.collect(),
|
|
}
|
|
}
|
|
}
|