From e85c8f075fe46439601de4ec5a49d41f15dc8ec3 Mon Sep 17 00:00:00 2001 From: "Liam Verdejo (ES)" Date: Fri, 4 Sep 2026 10:04:28 +0200 Subject: [PATCH 1/2] Feat: Fixing up docker --- .env.example | 2 ++ .github/copilot-instructions.md | 11 ++++++++--- CLAUDE.md | 9 +++++++++ Dockerfile | 7 +++++-- docker-compose.yml | 2 ++ 5 files changed, 26 insertions(+), 5 deletions(-) diff --git a/.env.example b/.env.example index 63cda1e..6dc5001 100644 --- a/.env.example +++ b/.env.example @@ -2,6 +2,8 @@ GITDB_REPOSITORY_URL=https://github.com/your-org/your-gitdb-repository.git GITDB_ENCRYPTION_KEY=replace-with-a-long-random-secret +ORIGIN=http://localhost:3000 + # Optional GitDB configuration GITDB_BRANCH=main GITDB_DATA_PATH=./data/gitdb diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 270f008..eb71b26 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -54,9 +54,14 @@ riesgo y mapeos de herramientas. Los modulos actuales son `auth`, `config`, `org `projects`, `storage` y `code-report`. Las rutas deben importar desde el `index.ts` publico. GitDB es la unica fuente de verdad para usuarios, roles, API keys, organizaciones, proyectos, -metadata de storage y code reports. Se configura con `GITDB_REPOSITORY_URL` y cada escritura es -un commit auditable. Usar `getGitDb()` y `src/lib/database/schemas.ts`; no añadir otra base de -datos sin discutir la arquitectura y planificar la migracion. +metadata de storage y code reports. Se configura con `GITDB_REPOSITORY_URL` (URLs HTTPS o SSH +como `git@github.com:user/repo.git`) y cada escritura es un commit auditable. Usar `getGitDb()` y +`src/lib/database/schemas.ts`; no añadir otra base de datos sin discutir la arquitectura y +planificar la migracion. La imagen Docker incluye `openssh-client` y configura SSH_AUTH_SOCK en +produccion para soportar autenticacion SSH. + +La variable `ORIGIN` fija el origen de la aplicacion (ej: `http://localhost:3000`) para que el +CSRF Origin check de SvelteKit no dependa del header Host, previniendo bypass en proxys. ## RBAC y seguridad diff --git a/CLAUDE.md b/CLAUDE.md index ed27671..4634ae1 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -88,6 +88,15 @@ metadata, and code reports are GitDB entities in the repository configured by `src/lib/database/schemas.ts`; do not add another database or persistence backend without an architecture discussion and migration plan. +`GITDB_REPOSITORY_URL` supports both HTTPS and SSH URLs (e.g., `git@github.com:user/repo.git`). +The Docker image includes `openssh-client` and pre-configures GitHub's SSH key fingerprints; in +production, ensure SSH authentication credentials are available via `SSH_AUTH_SOCK` or a mounted +SSH directory. + +`ORIGIN` environment variable pins the application's public origin (e.g., `http://localhost:3000`). +SvelteKit's CSRF Origin check depends on this value instead of deriving it from the incoming Host +header, preventing bypasses when running behind a proxy that rewrites Host headers. + ## Authorization Permission grants are always scope-prefixed and match the catalog in `src/lib/config/permissions.ts` diff --git a/Dockerfile b/Dockerfile index f395f9a..2bbce65 100644 --- a/Dockerfile +++ b/Dockerfile @@ -22,8 +22,11 @@ WORKDIR /app ENV NODE_ENV=production -# GitDB clones and syncs its backing repository at runtime. -RUN apk add --no-cache git +# GitDB clones and syncs its backing repository at runtime; openssh-client +# provides the ssh binary git needs for git@ remotes. +RUN apk add --no-cache git openssh-client && \ + mkdir -p /root/.ssh && \ + ssh-keyscan -t rsa,ecdsa,ed25519 github.com >> /root/.ssh/known_hosts # SvelteKit adapter-node output lives in build/ COPY --from=builder /app/build ./build diff --git a/docker-compose.yml b/docker-compose.yml index 7cb4430..b96ea9e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -6,8 +6,10 @@ services: - .env environment: GITDB_DATA_PATH: /app/data/gitdb + SSH_AUTH_SOCK: /ssh-agent ports: - '3000:3000' volumes: - ./data:/app/data + - /run/host-services/ssh-auth.sock:/ssh-agent restart: unless-stopped From e47d089110df7072015edbf2f1e8260a37f6c122 Mon Sep 17 00:00:00 2001 From: "Liam Verdejo (ES)" Date: Fri, 4 Sep 2026 11:46:44 +0200 Subject: [PATCH 2/2] Feat: Fixing up docker --- .github/copilot-instructions.md | 9 +++++---- CLAUDE.md | 6 +++--- Dockerfile | 2 +- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index eb71b26..fad4150 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -55,10 +55,11 @@ riesgo y mapeos de herramientas. Los modulos actuales son `auth`, `config`, `org GitDB es la unica fuente de verdad para usuarios, roles, API keys, organizaciones, proyectos, metadata de storage y code reports. Se configura con `GITDB_REPOSITORY_URL` (URLs HTTPS o SSH -como `git@github.com:user/repo.git`) y cada escritura es un commit auditable. Usar `getGitDb()` y -`src/lib/database/schemas.ts`; no añadir otra base de datos sin discutir la arquitectura y -planificar la migracion. La imagen Docker incluye `openssh-client` y configura SSH_AUTH_SOCK en -produccion para soportar autenticacion SSH. +como `git@github.com:user/repo.git`, `git@bitbucket.org:team/repo.git`, o `git@gitlab.com:group/repo.git`) +y cada escritura es un commit auditable. Usar `getGitDb()` y `src/lib/database/schemas.ts`; +no añadir otra base de datos sin discutir la arquitectura y planificar la migracion. La imagen Docker +incluye `openssh-client` con fingerprints SSH preconfigurados para GitHub, Bitbucket y GitLab; +en produccion, asegurar que las credenciales SSH esten disponibles via `SSH_AUTH_SOCK` o directorio montado. La variable `ORIGIN` fija el origen de la aplicacion (ej: `http://localhost:3000`) para que el CSRF Origin check de SvelteKit no dependa del header Host, previniendo bypass en proxys. diff --git a/CLAUDE.md b/CLAUDE.md index 4634ae1..3df4eef 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -89,9 +89,9 @@ metadata, and code reports are GitDB entities in the repository configured by architecture discussion and migration plan. `GITDB_REPOSITORY_URL` supports both HTTPS and SSH URLs (e.g., `git@github.com:user/repo.git`). -The Docker image includes `openssh-client` and pre-configures GitHub's SSH key fingerprints; in -production, ensure SSH authentication credentials are available via `SSH_AUTH_SOCK` or a mounted -SSH directory. +The Docker image includes `openssh-client` and pre-configures the SSH key fingerprints for GitHub, +Bitbucket, and GitLab; in production, ensure SSH authentication credentials are available via +`SSH_AUTH_SOCK` or a mounted SSH directory. `ORIGIN` environment variable pins the application's public origin (e.g., `http://localhost:3000`). SvelteKit's CSRF Origin check depends on this value instead of deriving it from the incoming Host diff --git a/Dockerfile b/Dockerfile index 2bbce65..56e3d60 100644 --- a/Dockerfile +++ b/Dockerfile @@ -26,7 +26,7 @@ ENV NODE_ENV=production # provides the ssh binary git needs for git@ remotes. RUN apk add --no-cache git openssh-client && \ mkdir -p /root/.ssh && \ - ssh-keyscan -t rsa,ecdsa,ed25519 github.com >> /root/.ssh/known_hosts + ssh-keyscan -t rsa,ecdsa,ed25519 github.com bitbucket.org gitlab.com >> /root/.ssh/known_hosts # SvelteKit adapter-node output lives in build/ COPY --from=builder /app/build ./build