marcandClaude Opus 5
68e184163e
This is a private instance, so anyone able to reach the login page could previously give themselves an account. The registration route is gone rather than hidden, and the login screen no longer hints that accounts can be made. Accounts now come from an admin under Account → Administration: create, delete, and reset a password. Appointing further admins is deliberately not offered — with one admin it is not needed, and it is the one power that turns a compromised account into a lost instance. The first admin comes from INKNOTE_ADMIN_USER / INKNOTE_ADMIN_PASSWORD, used only when the database has no users, or to choose whom to promote when an older database has users but no admin. Once an admin exists both are ignored, so leaving them in .env cannot reset anything. Two things that would otherwise have been quietly wrong: - a deleted user's token stayed valid until it expired, because tokens are signed rather than stored and there was no session to revoke. authMiddleware now checks the account still exists, so an open tab stops working the moment the account is deleted. - deleting an account takes its notes, notebooks, drawings and version history with it via ON DELETE CASCADE. Verified: no orphaned rows in notes, notebooks, sync_log, attachments or note_versions. Deletion asks for the username to be typed back, since it destroys data that version history cannot bring back. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
77 lines
2.5 KiB
YAML
77 lines
2.5 KiB
YAML
# ─────────────────────────────────────────────
|
|
# InkNote — lokales Test-Setup (baut aus dem Quellcode)
|
|
#
|
|
# Prod-nah (nginx + gebautes Bundle) auf :3000
|
|
# docker compose -f docker-compose.dev.yml up -d --build
|
|
#
|
|
# Mit Hot-Reload-Dev-Server auf :5173 zusätzlich
|
|
# docker compose -f docker-compose.dev.yml --profile dev up -d --build
|
|
#
|
|
# docker compose -f docker-compose.dev.yml logs -f
|
|
# docker compose -f docker-compose.dev.yml down
|
|
#
|
|
# Secrets kommen aus .env (nicht committen!)
|
|
# Daten liegen unter ${INKNOTE_DATA_DIR:-./data} auf dem Host.
|
|
# ─────────────────────────────────────────────
|
|
|
|
services:
|
|
inknote-server:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile
|
|
container_name: inknote-server-dev
|
|
restart: unless-stopped
|
|
environment:
|
|
- PORT=4000
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- ENCRYPTION_KEY=${ENCRYPTION_KEY}
|
|
# Only used when the database has no users at all: creates the first admin.
|
|
- INKNOTE_ADMIN_USER=${INKNOTE_ADMIN_USER:-}
|
|
- INKNOTE_ADMIN_PASSWORD=${INKNOTE_ADMIN_PASSWORD:-}
|
|
- NODE_ENV=development
|
|
# Bind mounts, not named volumes: the data sits in a plain directory on the
|
|
# Docker host where the host's own backup picks it up.
|
|
user: "${INKNOTE_UID:-1000}:${INKNOTE_GID:-1000}"
|
|
volumes:
|
|
- ${INKNOTE_DATA_DIR:-./data}/db:/app/data
|
|
- ${INKNOTE_DATA_DIR:-./data}/uploads:/app/uploads
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://localhost:4000/api/health"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 10s
|
|
|
|
inknote-web:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: dockerfile
|
|
container_name: inknote-web-dev
|
|
restart: unless-stopped
|
|
ports:
|
|
- "3000:80"
|
|
depends_on:
|
|
inknote-server:
|
|
condition: service_healthy
|
|
|
|
# Vite mit Hot-Reload — nur mit "--profile dev"
|
|
inknote-vite:
|
|
image: node:20-alpine
|
|
container_name: inknote-vite-dev
|
|
profiles: ["dev"]
|
|
working_dir: /app
|
|
command: sh -c "npm install && npm run dev"
|
|
environment:
|
|
- VITE_API_TARGET=http://inknote-server:4000
|
|
volumes:
|
|
- ./frontend:/app
|
|
- inknote-dev-node-modules:/app/node_modules
|
|
ports:
|
|
- "5173:5173"
|
|
depends_on:
|
|
inknote-server:
|
|
condition: service_healthy
|
|
|
|
volumes:
|
|
inknote-dev-node-modules:
|