diff --git a/Services/Website/.env.local b/Services/Website/.env.local index fe55149..bd958b6 100644 --- a/Services/Website/.env.local +++ b/Services/Website/.env.local @@ -51,36 +51,11 @@ ANALYTICS_DOMAINS= # Whether the pages also embed the session recorder script: true | false ANALYTICS_RECORDER=false -# --- Security ---------------------------------------------------------------- +# --- Passkeys ---------------------------------------------------------------- -# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and -# `connect-src`, or the tracker is blocked; drop those two once analytics is off. -SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none' - -# `X-Content-Type-Options`: disables MIME sniffing. -SECURITY_CONTENT_TYPE_OPTIONS=nosniff - -# `X-Frame-Options`: DENY | SAMEORIGIN -SECURITY_FRAME_OPTIONS=DENY - -# `Referrer-Policy`. -SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin - -# `Permissions-Policy`: denies browser features the site does not use. -SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=() - -# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but -# remember it stickily once seen, so it stays off in local development. -# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains - -# --- Reverse proxy ----------------------------------------------------------- - -# Both assert a TLS-terminating reverse proxy that sets the forwarded headers, so -# set them together; off for a directly reachable server, where clients can forge -# the headers. The former drives the HTTPS redirect, the latter keys the rate-limit -# buckets by the first `X-Forwarded-For` entry. -HTTPS_TRUST_FORWARDED_PROTO=false -RATE_LIMIT_TRUST_FORWARDED_FOR=false +# Origin the sign-in screen is served at; browsers bind passkeys to it. +# WebAuthn only runs on HTTPS or on localhost (not 127.0.0.1). In production it follows SITE_ORIGIN. +PASSKEYS_ORIGIN=http://localhost:8080 # --- Persistence ------------------------------------------------------------- @@ -110,8 +85,39 @@ DATABASE_TLS=off # Username of the database to connect as. DATABASE_USERNAME=ccn -# --- Passkeys ---------------------------------------------------------------- +# --- Reverse proxy ----------------------------------------------------------- -# Origin the sign-in screen is served at; browsers bind passkeys to it. -# WebAuthn only runs on HTTPS or on localhost (not 127.0.0.1). -PASSKEYS_ORIGIN=http://localhost:8080 +# Both assert a TLS-terminating reverse proxy that sets the forwarded headers, so +# set them together; off for a directly reachable server, where clients can forge +# the headers. The former drives the HTTPS redirect, the latter keys the rate-limit +# buckets by the first `X-Forwarded-For` entry. +HTTPS_TRUST_FORWARDED_PROTO=false +RATE_LIMIT_TRUST_FORWARDED_FOR=false + +# --- Security ---------------------------------------------------------------- + +# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and +# `connect-src`, or the tracker is blocked; drop those two once analytics is off. +SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none' + +# `X-Content-Type-Options`: disables MIME sniffing. +SECURITY_CONTENT_TYPE_OPTIONS=nosniff + +# `X-Frame-Options`: DENY | SAMEORIGIN +SECURITY_FRAME_OPTIONS=DENY + +# `Referrer-Policy`. +SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin + +# `Permissions-Policy`: denies browser features the site does not use. +SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=() + +# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but +# remember it stickily once seen, so it stays off in local development. +# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains + +# --- Site -------------------------------------------------------------------- + +# Public origin of the site (scheme and host, no trailing slash). Leave unset locally: the app's default applies, and +# the local Compose override points it at http://localhost. +# SITE_ORIGIN=https://ccn.rock-n-co.de \ No newline at end of file diff --git a/Services/Website/Dockerfile b/Services/Website/Dockerfile index c4bea90..a765ec5 100644 --- a/Services/Website/Dockerfile +++ b/Services/Website/Dockerfile @@ -128,6 +128,12 @@ COPY --from=build --chown=hummingbird:hummingbird /staging /app # Provide configuration needed by the built-in crash reporter and some sensible default behaviors. ENV SWIFT_BACKTRACE=enable=yes,sanitize=yes,threads=all,images=all,interactive=no,swift-backtrace=./swift-backtrace-static +# The photos sellers upload are the one thing written at runtime: their folder alone is writable, and it is where the +# Compose file mounts a volume. A named volume takes the ownership of the folder it is first mounted over. +RUN mkdir -p /app/Resources/Static/uploads \ + && chown hummingbird:hummingbird /app/Resources/Static/uploads \ + && chmod 750 /app/Resources/Static/uploads + # Ensure all further commands run as the hummingbird user USER hummingbird:hummingbird diff --git a/Services/Website/README.md b/Services/Website/README.md index 6f03b15..156f80d 100644 --- a/Services/Website/README.md +++ b/Services/Website/README.md @@ -478,10 +478,19 @@ The Makefile and Compose files read these from `.env` (or the environment). Prov | `LOG_LEVEL` | Runtime log level (default `info`). | | `HTTP_SERVER_NAME` | Runtime server name (default `CCNWebsite`). | | `SECURITY_STRICT_TRANSPORT_SECURITY` | HSTS header value (default `max-age=31536000; includeSubDomains`). | +| `SITE_ORIGIN` | The public origin: scheme and host, no trailing slash. The local override points it at `http://localhost`. | +| `PASSKEYS_ORIGIN` | The origin browsers bind passkeys to: exactly where the sign-in screen is served, over HTTPS. Follows `SITE_ORIGIN` unless set apart. Left at the app's default (`http://localhost:8080`) every ceremony fails; changed later, it strands every passkey already registered. | +| `ANALYTICS_WEBSITE_ID`, `ANALYTICS_DOMAINS`, `ANALYTICS_RECORDER` | Passed through to the tracker; an empty identifier leaves it off. | | `DATABASE_DRIVER` | `inMemory` or `postgres`. The production Compose file defaults it to `postgres`; the local override defaults back to the in-memory backend. | | `DATABASE_HOST`, `DATABASE_PASSWORD` | **Mandatory** — the production Compose file carries no default for either, since none can be correct: `localhost` inside the container is the container itself, and a blank password authenticates as nobody. It refuses to start without them rather than booting a website that serves 503s. Both come from `.env`, which is git-ignored — never commit the password. Compose interpolates each file before merging, so both must be set for a local `docker compose up` too, even though the override pins the host. | | `DATABASE_PORT`, `DATABASE_NAME`, `DATABASE_USERNAME` | The rest of the PostgreSQL connection (when `DATABASE_DRIVER=postgres`); these do default (`5432`, `ccn`, `ccn`). | | `DATABASE_POOL_MAX_PER_EVENT_LOOP` | Pooled connections per event loop (default `4`) — see the [connection budget](#persistence) before scaling out. | | `DATABASE_TLS` | TLS posture: `off`, `prefer`, or `require`. The production Compose file defaults it to `require`, which refuses a server offering no TLS; the local override defaults it to `off` for the plaintext development container. `prefer` continues in plaintext when the upgrade is stripped, handing over the password — so it is not a safe production posture. | -Run the migrations against the production database once before (or during) rollout: `docker compose -f docker-compose.yml run --rm website --database-migrate`. +Run the migrations against the production database once before (or during) rollout: `docker compose -f docker-compose.yml run --rm website --database-migrate`. They seed the prototype's demo shops, listings, and accounts too. + +What else a deployment needs: +- **HTTPS in front**: browsers run WebAuthn nowhere else, and `HTTPS_TRUST_FORWARDED_PROTO` (on by default in the production Compose file) is what marks the session cookie `Secure`. +- **The uploads volume**: the image is read-only but for `Resources/Static/uploads`, where the Compose file mounts `website-uploads` so sellers' photos outlive a redeploy. +- **Room for uploads in the proxy**: a listing form carries up to 13 MB of photos — nginx allows 1 MB by default (`client_max_body_size`). +- **One replica**: sessions, passkey ceremonies, and recovery links live in the process's memory; a restart signs everyone out. diff --git a/Services/Website/docker-compose.override.yml b/Services/Website/docker-compose.override.yml index 0ba253d..a173ac9 100644 --- a/Services/Website/docker-compose.override.yml +++ b/Services/Website/docker-compose.override.yml @@ -18,6 +18,9 @@ services: dockerfile: Services/Website/Dockerfile environment: LOG_LEVEL: debug + # Served over plain HTTP on localhost — the one place browsers run WebAuthn without HTTPS. Not 127.0.0.1. + SITE_ORIGIN: http://localhost:${HOST_PORT:-8080} + PASSKEYS_ORIGIN: http://localhost:${HOST_PORT:-8080} HTTPS_TRUST_FORWARDED_PROTO: "false" RATE_LIMIT_TRUST_FORWARDED_FOR: "false" DATABASE_DRIVER: ${DATABASE_DRIVER:-inMemory} diff --git a/Services/Website/docker-compose.yml b/Services/Website/docker-compose.yml index 0aad753..5b9447b 100644 --- a/Services/Website/docker-compose.yml +++ b/Services/Website/docker-compose.yml @@ -8,6 +8,9 @@ name: ccn-platform # # The `-f docker-compose.yml` flag is important in production: it skips the docker-compose.override.yml file, which # Compose would otherwise merge in automatically for local development. +# +# Run one replica: sessions, passkey ceremonies, and recovery links live in the process's memory, so a second instance +# would not know the first one's sign-ins — and a restart signs everyone out. services: website: image: ${HOST_CONTAINER}/${HOST_OWNER}/${IMAGE_NAME}:${IMAGE_TAG:-latest} @@ -19,6 +22,17 @@ services: environment: LOG_LEVEL: ${LOG_LEVEL:-info} HTTP_SERVER_NAME: ${HTTP_SERVER_NAME:-CCNWebsite} + # The public origin: scheme and host, no trailing slash. The HTTPS redirect and the canonical links derive from it. + SITE_ORIGIN: ${SITE_ORIGIN:-https://ccn.rock-n-co.de} + # The origin browsers bind passkeys to: exactly where the sign-in screen is served — same scheme, same host, no + # `www.` either way. Left at the app's default (http://localhost:8080) every ceremony fails, so it follows + # SITE_ORIGIN unless set apart. It must be HTTPS: browsers run WebAuthn nowhere else but localhost, and it is + # what marks the session cookie `Secure`. + PASSKEYS_ORIGIN: ${PASSKEYS_ORIGIN:-${SITE_ORIGIN:-https://ccn.rock-n-co.de}} + # Empty leaves the tracker off. + ANALYTICS_WEBSITE_ID: ${ANALYTICS_WEBSITE_ID:-} + ANALYTICS_DOMAINS: ${ANALYTICS_DOMAINS:-} + ANALYTICS_RECORDER: ${ANALYTICS_RECORDER:-false} # Falls back to the policy the app ships with; set it in `.env` to allow the analytics origin, # which must match `String.Analytics.origin`. SECURITY_CONTENT_SECURITY_POLICY: "${SECURITY_CONTENT_SECURITY_POLICY:-default-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'}" @@ -33,9 +47,14 @@ services: DATABASE_PASSWORD: ${DATABASE_PASSWORD:?DATABASE_PASSWORD is required} DATABASE_TLS: ${DATABASE_TLS:-require} DATABASE_POOL_MAX_PER_EVENT_LOOP: ${DATABASE_POOL_MAX_PER_EVENT_LOOP:-4} + volumes: + # The photos sellers upload. The rest of the image is read-only, and without the volume a redeploy would lose them. + - website-uploads:/app/Resources/Static/uploads healthcheck: test: ["CMD", "curl", "--fail", "--silent", "--show-error", "http://127.0.0.1:8080/health"] interval: 30s timeout: 5s retries: 3 start_period: 10s +volumes: + website-uploads: