add csp for uploads

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [valeriansaliou/sonic](https://github.com/valeriansaliou/sonic) | minor | `v1.7.4` -> `v1.8.1` |

> ❗ **Important**
>
> Release Notes retrieval for this PR were skipped because no github.com credentials were available.
> If you are self-hosted, please see [this instruction](https://github.com/renovatebot/renovate/blob/master/docs/usage/examples/self-hosting.md#githubcom-token-for-release-notes).

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: #20
Co-authored-by: Renovate Bot <renovate@coopcloud.tech>

.env.sample

@@ -122,6 +122,7 @@ UPLOAD_LIMIT=20000000
 # OpenID Connect: connect as a client to the OpenID Connect provider with callback url https://yourinstance.tld/openid/client/openid_1
 #COMPOSE_FILE="$COMPOSE_FILE:compose.auth.openid.yml"
 #SECRET_OPENID_CLIENT_SECRET_VERSION=v1
+# OPENID_1_ISSUER=
 # OPENID_1_DISCOVERY=
 # OPENID_1_DISPLAY_NAME=
 # OPENID_1_CLIENT_ID=

abra.sh

@@ -1,5 +1,9 @@
 export APP_ENTRYPOINT_VERSION=v4
 export PG_BACKUP_VERSION=v6
 export MEILI_BACKUP_VERSION=v4
-export SONIC_CFG_VERSION=v1
+export SONIC_CFG_VERSION=v2
 export SONIC_ENTRYPOINT_VERSION=v1
+export POSTGRES_ENTRYPOINT_VERSION=v6
+export POSTGRES_TUNE_VERSION=v2
+export POSTGRES_CONF_TMPL_VERSION=v3
+export BASH_ENVSUBST_VERSION=v1

compose.auth.openid.yml

@@ -4,6 +4,7 @@ services:
   app:
     environment:
       - OPENID_1_DISPLAY_NAME
+      - OPENID_1_ISSUER
       - OPENID_1_DISCOVERY
       - OPENID_1_CLIENT_ID
       - OPENID_1_CLIENT_SECRET_FILE=/run/secrets/openid_client_secret

compose.basicauth.yml

@@ -7,6 +7,8 @@ services:
       labels:
         - "traefik.http.middlewares.${STACK_NAME}_basicauth.basicauth.usersFile=/run/secrets/usersfile"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}_basicauth"
+        # the uploads router (see compose.yml) needs the basic auth too, or uploads would bypass it
+        - "traefik.http.routers.${STACK_NAME}_uploads.middlewares=${STACK_NAME}_basicauth,${STACK_NAME}_uploads_csp"
 
 secrets:
   usersfile:

compose.sonic.yml

@@ -15,7 +15,7 @@ services:
     #   - sonic_password
       
   search:
-    image: valeriansaliou/sonic:v1.7.4
+    image: valeriansaliou/sonic:v1.8.1
     # secrets:
     #   - sonic_password
     volumes:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: ${CONTAINER_REGISTRY:-bonfirenetworks/bonfire}:${APP_VERSION:-1.0.5}-${APP_FLAVOUR:-social}-${APP_PLATFORM:-amd64}
+    image: ${CONTAINER_REGISTRY:-bonfirenetworks/bonfire}:${APP_VERSION:-1.0.7}-${APP_FLAVOUR:-social}-${APP_PLATFORM:-amd64}
     logging:
       driver: "json-file"
       options:
@@ -49,6 +49,8 @@ services:
       - ENABLE_SSO_PROVIDER
       - OAUTH_ISSUER
 
+      - BONFIRE_CONSOLE_TOKEN
+
       - SECRET_KEY_BASE_FILE=/run/secrets/secret_key_base
       - SIGNING_SALT_FILE=/run/secrets/signing_salt
       - ENCRYPTION_SALT_FILE=/run/secrets/encryption_salt
@@ -86,7 +88,14 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=1.0.0+1.0.5-social-amd64"
+        # uploads (e.g. SVG) are served from the instance's origin, so stop any script in them from running if opened directly
+        - "traefik.http.middlewares.${STACK_NAME}_uploads_csp.headers.customresponseheaders.Content-Security-Policy=sandbox; default-src 'none'; style-src 'unsafe-inline'"
+        - "traefik.http.routers.${STACK_NAME}_uploads.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS}) && PathPrefix(`/data/uploads/`)"
+        - "traefik.http.routers.${STACK_NAME}_uploads.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}_uploads.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.${STACK_NAME}_uploads.service=${STACK_NAME}"
+        - "traefik.http.routers.${STACK_NAME}_uploads.middlewares=${STACK_NAME}_uploads_csp"
+        - "coop-cloud.${STACK_NAME}.version=2.0.3+1.0.7-social-amd64"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:4000"]
       interval: 30s

release/2.0.0+1.0.5-social-amd64

@@ -0,0 +1 @@
+Mailisearch search backend was removed. If you want to use a search backend switch to sonic. See readme on how to use it.

sonic.cfg

@@ -6,13 +6,15 @@
 
 [channel]
   inet = "0.0.0.0:1491"
+  # keep in sync with :keepalive_interval in Bonfire.Search.Sonic, which must stay under this or Sonic drops our idle ingest/search connections
   tcp_timeout = 300
 
-  [channel.search]
-    query_limit_default = 10
-    query_limit_maximum = 200
-    suggest_limit_default = 5
-    suggest_limit_maximum = 20
+# moved out of [channel.search], deprecated since Sonic 1.8
+[search]
+  query_limit_default = 10
+  query_limit_maximum = 200
+  suggest_limit_default = 5
+  suggest_limit_maximum = 20
 
 [store.kv]
   path = "/var/lib/sonic/store/kv/"