marcandClaude Sonnet 4.6
9f060660a1
app.py: - Move warnings import to top-level imports - Remove MICRONAS_SECRET env var (undocumented, unnecessary) - Inline secret key derivation cleanly CLAUDE.md: - Remove stale quotas mention - Add WebDAV, setup.html, favicon to file layout - Document /etc/micronas/ permissions requirements - Document <Location> vs <Directory> for WebDAV DAV On PLANNING.md: - Mark Phase 5 complete with all shipped items - Add v1 complete marker and future ideas section README.md: - Simplify dev/test section (remove complex hash snippet) - Fix double blank line Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
51 lines
2.8 KiB
Markdown
51 lines
2.8 KiB
Markdown
# CLAUDE.md
|
|
|
|
Project context for Claude Code. See `PLANNING.md` for the full roadmap.
|
|
|
|
## What this is
|
|
A lightweight web GUI to manage file shares on a single home server (Proxmox
|
|
LXC/VM) — a minimal NAS control panel. Manages **SMB shares**, **NFS exports**,
|
|
**WebDAV shares**, and **system users** by editing host config files and reloading
|
|
daemons. Home/LAN use only.
|
|
|
|
## File layout
|
|
- `app.py` — Flask backend: all API routes, auth, business logic.
|
|
- `templates/index.html` — main SPA shell (Jinja2); no inline JS or CSS.
|
|
- `templates/login.html` — login form.
|
|
- `templates/setup.html` — first-time setup form (shown when no credentials exist).
|
|
- `static/css/app.css` — custom dark theme (GitHub-palette CSS variables).
|
|
- `static/img/favicon.svg` — app icon (drive bays with green LEDs).
|
|
- `static/js/utils.js` — shared helpers: `esc()`, `showToast()`, `apiFetch()`.
|
|
- `static/js/dashboard.js` — status dots, IPs, shares overview, active SMB connections, restart buttons.
|
|
- `static/js/shares.js` — SMB/NFS/WebDAV CRUD. Edit modal is async (fetches users+groups for dropdowns).
|
|
- `static/js/users.js` — user CRUD + password modal + group management + admin credential change modal.
|
|
- `static/js/main.js` — page init and 30 s auto-refresh.
|
|
- `micronas.service` — systemd unit (gunicorn `-w 1`, reads `/etc/micronas/micronas.env`).
|
|
|
|
## How it runs
|
|
Directly on the LXC/VM as a `systemd` service, Flask behind `gunicorn -w 1`.
|
|
Single worker is required — credential updates mutate `_creds` in-process.
|
|
**Not** in Docker for production — the app manipulates host services directly.
|
|
|
|
Auth uses **Flask sessions**. Credentials stored hashed (PBKDF2-HMAC-SHA256)
|
|
in `/etc/micronas/micronas.env`. First run redirects to `/setup`.
|
|
WebDAV htpasswd at `/etc/micronas/webdav.passwd` (group `www-data`, mode 640).
|
|
Config directory `/etc/micronas/` must be mode 750, owned `root:www-data`.
|
|
|
|
## Conventions & constraints
|
|
- **Keep it simple.** No database, no auth framework, dependency-light.
|
|
Config files (`/etc/samba/smb.conf`, `/etc/exports`) are the source of truth.
|
|
- **Security basics are non-negotiable even for home use:**
|
|
- Never use `subprocess.run(..., shell=True)` with user input. Use argument lists.
|
|
- Validate all input: names `^[A-Za-z0-9_-]+$`; paths must resolve under `/srv`.
|
|
- All routes require a valid session (`require_auth` decorator).
|
|
- **Config edits are safe:** parse into blocks, rewrite whole file — never
|
|
blindly append for edit/delete/toggle operations.
|
|
- WebDAV config uses `<Location>` blocks for `DAV On` (not `<Directory>`) —
|
|
required for Alias-mapped paths in Apache 2.4.
|
|
- LAN-only. Do not add internet-facing features.
|
|
|
|
## Out of scope
|
|
Backups, multi-user roles, databases, internet exposure, multi-host management,
|
|
disk quotas (ZFS-backed LXC doesn't support `setquota`).
|