add csp for uploads

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [valeriansaliou/sonic](https://github.com/valeriansaliou/sonic) | minor | `v1.7.4` -> `v1.8.1` |

> ❗ **Important**
>
> Release Notes retrieval for this PR were skipped because no github.com credentials were available.
> If you are self-hosted, please see [this instruction](https://github.com/renovatebot/renovate/blob/master/docs/usage/examples/self-hosting.md#githubcom-token-for-release-notes).

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: #20
Co-authored-by: Renovate Bot <renovate@coopcloud.tech>

.env.sample

@@ -122,6 +122,7 @@ UPLOAD_LIMIT=20000000
 # OpenID Connect: connect as a client to the OpenID Connect provider with callback url https://yourinstance.tld/openid/client/openid_1
 #COMPOSE_FILE="$COMPOSE_FILE:compose.auth.openid.yml"
 #SECRET_OPENID_CLIENT_SECRET_VERSION=v1
+# OPENID_1_ISSUER=
 # OPENID_1_DISCOVERY=
 # OPENID_1_DISPLAY_NAME=
 # OPENID_1_CLIENT_ID=

README.md

@@ -15,24 +15,38 @@ A [coop-cloud](https://coopcloud.tech) recipe for deploying [Bonfire](https://bo
 
 ## Basic usage
 
-1. Set up Docker Swarm and [`abra`]
-2. Deploy [`coop-cloud/traefik`]
-3. `abra app new bonfire --secrets` (optionally with `--pass` if you'd like to save secrets in `pass`) and select your server from the list and enter the domain name you want Bonfire to be served from
-4. `abra app config YOUR_APP_DOMAIN_NAME` and check/edit the config keys
-5. `abra app deploy YOUR_APP_DOMAIN_NAME`
-6. Open the configured domain in your browser and sign up! 
+1. `abra app new bonfire --secrets`
+2. `abra app config <app-name>`
+3. `abra app deploy <app-name>`
+4. Open the Elixir console: `abra app run <app-name> app bin/bonfire remote`
+5. Create admin account in Elixir console (the first account created this way will get admin rights): `Bonfire.Me.make_account_only("my@email.net", "my pw")`
 
-## Upgrades 
-`abra app deploy --force your-server.domain.name`
+## Use a custom Bonfire flavour
 
-NOTE: we recommend switching to the new `sonic` search backend (instead of the deprecated `meilisearch`):
-1. comment the `COMPOSE_FILE` line that contains `compose.meilisearch.yml` in the `.env` file for your bonfire instancem and replace with a line like `COMPOSE_FILE="compose.yml:compose.sonic.yml"`
+By default, this recipe deploys the Bonfire `social` flavour. If you want a different one uncomment and define `APP_FLAVOUR` in you env file.
+
+## Use a custom Bonfire version
+
+Attention: This is not recommended for production deployment!
+
+You can deploy another version of Bonfire by using `APP_VERSION` and `APP_PLATFORM`. Be aware that not all versions might be compatible with this recipe, especially the quite old ones.
+If you want to use bleeding edge releases try setting `APP_VERSION=latest-alpha`. When using this, every time you deploy with `abra app deploy --force <app-name>` the latest alpha replease will be used.
+
+## Using a search backend
+
+1. uncomment the `COMPOSE_FILE` line that contains `compose.sonic.yml` in the `.env` file for your bonfire instance.
 2. add `SONIC_PASSWORD=a-super-secret-password` to the same file (make sure to change the password after pasting!)
-3. redeploy with `abra app deploy --force your-server.domain.name`
+3. redeploy with `abra app deploy --force <app-name>`
 
+## Protect the instance with basic auth
 
-[`abra`]: https://docs.coopcloud.tech/abra/
-[`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik
+For e.g. a testing phase you can protect your Bonfire instance with basic auth:
+
+1. uncomment the section `## BASIC_AUTH`
+2. create a username/password combination with `echo $(htpasswd -nB <username>)`
+3. add the combination as secret with `abra app secret insert <app-name> usersfile v1 '<the-user-password-combination>'`
+
+## 
 
 ## FAQ
 
@@ -44,3 +58,5 @@ Go into your app's Elixir console and enter something like `Bonfire.Me.make_acco
 
 ### How can I get to the app's Elixir console?
 `abra app run your-server.domain.name app bin/bonfire remote`
+
+For more, see [docs.coopcloud.tech](https://docs.coopcloud.tech).

abra.sh

@@ -1,5 +1,9 @@
 export APP_ENTRYPOINT_VERSION=v4
 export PG_BACKUP_VERSION=v6
 export MEILI_BACKUP_VERSION=v4
-export SONIC_CFG_VERSION=v1
+export SONIC_CFG_VERSION=v2
 export SONIC_ENTRYPOINT_VERSION=v1
+export POSTGRES_ENTRYPOINT_VERSION=v6
+export POSTGRES_TUNE_VERSION=v2
+export POSTGRES_CONF_TMPL_VERSION=v3
+export BASH_ENVSUBST_VERSION=v1

compose.auth.openid.yml

@@ -4,6 +4,7 @@ services:
   app:
     environment:
       - OPENID_1_DISPLAY_NAME
+      - OPENID_1_ISSUER
       - OPENID_1_DISCOVERY
       - OPENID_1_CLIENT_ID
       - OPENID_1_CLIENT_SECRET_FILE=/run/secrets/openid_client_secret

compose.basicauth.yml

@@ -7,6 +7,8 @@ services:
       labels:
         - "traefik.http.middlewares.${STACK_NAME}_basicauth.basicauth.usersFile=/run/secrets/usersfile"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}_basicauth"
+        # the uploads router (see compose.yml) needs the basic auth too, or uploads would bypass it
+        - "traefik.http.routers.${STACK_NAME}_uploads.middlewares=${STACK_NAME}_basicauth,${STACK_NAME}_uploads_csp"
 
 secrets:
   usersfile:

compose.sonic.yml

@@ -15,7 +15,7 @@ services:
     #   - sonic_password
       
   search:
-    image: valeriansaliou/sonic:v1.7.4
+    image: valeriansaliou/sonic:v1.8.1
     # secrets:
     #   - sonic_password
     volumes:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: ${CONTAINER_REGISTRY:-bonfirenetworks/bonfire}:${APP_VERSION:-1.0.6}-${APP_FLAVOUR:-social}-${APP_PLATFORM:-amd64}
+    image: ${CONTAINER_REGISTRY:-bonfirenetworks/bonfire}:${APP_VERSION:-1.0.7}-${APP_FLAVOUR:-social}-${APP_PLATFORM:-amd64}
     logging:
       driver: "json-file"
       options:
@@ -88,7 +88,14 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=2.0.1+1.0.6-social-amd64"
+        # uploads (e.g. SVG) are served from the instance's origin, so stop any script in them from running if opened directly
+        - "traefik.http.middlewares.${STACK_NAME}_uploads_csp.headers.customresponseheaders.Content-Security-Policy=sandbox; default-src 'none'; style-src 'unsafe-inline'"
+        - "traefik.http.routers.${STACK_NAME}_uploads.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS}) && PathPrefix(`/data/uploads/`)"
+        - "traefik.http.routers.${STACK_NAME}_uploads.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}_uploads.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.${STACK_NAME}_uploads.service=${STACK_NAME}"
+        - "traefik.http.routers.${STACK_NAME}_uploads.middlewares=${STACK_NAME}_uploads_csp"
+        - "coop-cloud.${STACK_NAME}.version=2.0.3+1.0.7-social-amd64"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:4000"]
       interval: 30s

sonic.cfg

@@ -6,13 +6,15 @@
 
 [channel]
   inet = "0.0.0.0:1491"
+  # keep in sync with :keepalive_interval in Bonfire.Search.Sonic, which must stay under this or Sonic drops our idle ingest/search connections
   tcp_timeout = 300
 
-  [channel.search]
-    query_limit_default = 10
-    query_limit_maximum = 200
-    suggest_limit_default = 5
-    suggest_limit_maximum = 20
+# moved out of [channel.search], deprecated since Sonic 1.8
+[search]
+  query_limit_default = 10
+  query_limit_maximum = 200
+  suggest_limit_default = 5
+  suggest_limit_maximum = 20
 
 [store.kv]
   path = "/var/lib/sonic/store/kv/"