0 Fork 0

Files

T

marcandClaude Sonnet 4.6 67dacd4044 Update PLANNING.md and CLAUDE.md to reflect current state

- Mark Phase 1, 2, 2.5, 3 as complete
- Add project structure diagram to PLANNING.md
- Update CLAUDE.md: correct file layout, session auth, safe config
  rewrite pattern, remove stale references to index.html and Basic Auth

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-19 22:30:13 +02:00

2.5 KiB

Raw Blame History

CLAUDE.md

Project context for Claude Code. See PLANNING.md for the full roadmap.

What this is

A lightweight web GUI to manage file shares on a single home server (Proxmox LXC/VM) — a minimal NAS control panel. Manages SMB shares, NFS exports, quotas, and system users by editing host config files and reloading daemons. Home/LAN use only.

File layout

app.py — Flask backend: all API routes, auth, business logic.
templates/index.html — main SPA shell (Jinja2); no inline JS or CSS.
templates/login.html — login form.
static/css/app.css — custom dark theme (GitHub-palette CSS variables).
static/js/utils.js — shared helpers: esc(), showToast(), apiFetch().
static/js/dashboard.js — dashboard data loading.
static/js/shares.js — SMB/NFS CRUD (create, edit, delete, toggle).
static/js/quotas.js — quota modal logic.
static/js/users.js — user CRUD + password modal.
static/js/main.js — page init and 30 s auto-refresh.
micronas.service — systemd unit (gunicorn, reads /etc/micronas.env).
docker-compose.yml — dev/test sandbox only, not for production.

How it runs

Directly on the LXC/VM as a systemd service, Flask behind gunicorn. Not in Docker for production — the app manipulates host services (smbd, nfsd, /etc/exports, exportfs, setquota).

Auth uses Flask sessions with a secret key derived from MICRONAS_PASS. Credentials come from /etc/micronas.env (MICRONAS_USER, MICRONAS_PASS).

Conventions & constraints

Keep it simple. No database, no auth framework, dependency-light. Config files (/etc/samba/smb.conf, /etc/exports) are the source of truth.
Security basics are non-negotiable even for home use:
- Never use subprocess.run(..., shell=True) with user input. Use argument lists.
- Validate all input: names ^[A-Za-z0-9_-]+$; paths must resolve under /srv.
- All routes require a valid session (require_auth decorator).
Config edits are safe: _parse_smb_conf() / _write_smb_conf() and _parse_exports() / _write_exports() parse into blocks and rewrite the whole file — never blindly append for edit/delete/toggle operations.
LAN-only. Do not add internet-facing features.

Out of scope

Backups (Proxmox Backup Server), multi-user roles, databases, internet exposure, multi-host management.

Working agreement

Work in the phases defined in PLANNING.md; pause after each phase for the user to test.
Explain changes briefly. Don't add heavy dependencies without asking.

2.5 KiB Raw Blame History