add csp for uploads

.env.sample

@@ -122,6 +122,7 @@ UPLOAD_LIMIT=20000000
 # OpenID Connect: connect as a client to the OpenID Connect provider with callback url https://yourinstance.tld/openid/client/openid_1
 #COMPOSE_FILE="$COMPOSE_FILE:compose.auth.openid.yml"
 #SECRET_OPENID_CLIENT_SECRET_VERSION=v1
+# OPENID_1_ISSUER=
 # OPENID_1_DISCOVERY=
 # OPENID_1_DISPLAY_NAME=
 # OPENID_1_CLIENT_ID=

abra.sh

@@ -1,7 +1,7 @@
 export APP_ENTRYPOINT_VERSION=v4
 export PG_BACKUP_VERSION=v6
 export MEILI_BACKUP_VERSION=v4
-export SONIC_CFG_VERSION=v1
+export SONIC_CFG_VERSION=v2
 export SONIC_ENTRYPOINT_VERSION=v1
 export POSTGRES_ENTRYPOINT_VERSION=v6
 export POSTGRES_TUNE_VERSION=v2

compose.auth.openid.yml

@@ -4,6 +4,7 @@ services:
   app:
     environment:
       - OPENID_1_DISPLAY_NAME
+      - OPENID_1_ISSUER
       - OPENID_1_DISCOVERY
       - OPENID_1_CLIENT_ID
       - OPENID_1_CLIENT_SECRET_FILE=/run/secrets/openid_client_secret

compose.basicauth.yml

@@ -7,6 +7,8 @@ services:
       labels:
         - "traefik.http.middlewares.${STACK_NAME}_basicauth.basicauth.usersFile=/run/secrets/usersfile"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}_basicauth"
+        # the uploads router (see compose.yml) needs the basic auth too, or uploads would bypass it
+        - "traefik.http.routers.${STACK_NAME}_uploads.middlewares=${STACK_NAME}_basicauth,${STACK_NAME}_uploads_csp"
 
 secrets:
   usersfile:

compose.yml

@@ -88,7 +88,14 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=2.0.2+1.0.7-social-amd64"
+        # uploads (e.g. SVG) are served from the instance's origin, so stop any script in them from running if opened directly
+        - "traefik.http.middlewares.${STACK_NAME}_uploads_csp.headers.customresponseheaders.Content-Security-Policy=sandbox; default-src 'none'; style-src 'unsafe-inline'"
+        - "traefik.http.routers.${STACK_NAME}_uploads.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS}) && PathPrefix(`/data/uploads/`)"
+        - "traefik.http.routers.${STACK_NAME}_uploads.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}_uploads.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.${STACK_NAME}_uploads.service=${STACK_NAME}"
+        - "traefik.http.routers.${STACK_NAME}_uploads.middlewares=${STACK_NAME}_uploads_csp"
+        - "coop-cloud.${STACK_NAME}.version=2.0.3+1.0.7-social-amd64"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:4000"]
       interval: 30s

sonic.cfg

@@ -6,13 +6,15 @@
 
 [channel]
   inet = "0.0.0.0:1491"
+  # keep in sync with :keepalive_interval in Bonfire.Search.Sonic, which must stay under this or Sonic drops our idle ingest/search connections
   tcp_timeout = 300
 
-  [channel.search]
-    query_limit_default = 10
-    query_limit_maximum = 200
-    suggest_limit_default = 5
-    suggest_limit_maximum = 20
+# moved out of [channel.search], deprecated since Sonic 1.8
+[search]
+  query_limit_default = 10
+  query_limit_maximum = 200
+  suggest_limit_default = 5
+  suggest_limit_maximum = 20
 
 [store.kv]
   path = "/var/lib/sonic/store/kv/"