Initial commit - Project start (July 17, 2025)

Original: feat: enhance security logging and ensure rate limit blocks are properly tracked - Add comprehensive logging for rate limit blocks with full request details - IP address (with proper proxy detection), user agent, headers, timestamps - Rate limit info (current count, limit, remaining, reset time) - Separate tracking for auth vs general endpoints - Enhance authentication failure logging - JWT validation failures with detailed error info - Admin auth attempts without token - Failed token validation with user context - All events include IP, path, method, user agent - Improve Winston logger configuration for production - Add automatic log rotation (10MB errors, 50MB combined) - Create separate security.log for auth/rate limit events - Ensure logs directory exists automatically - Add structured JSON format for log aggregation - Support container logging with LOG_TO_CONSOLE env var - Create comprehensive documentation - Security logging guide with examples - Monitoring recommendations - Configuration reference - Add test script to verify logging functionality All rate limit settings remain configurable via admin panel: - Window duration, max requests, auth limits - Skip authenticated requests option - Public endpoints only option 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-18 19:25:15 +02:00
commit 1773ed5f95
354 changed files with 61508 additions and 0 deletions
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# PicPeak Backup Script
+# Creates backups of database and storage
+
+set -e
+
+# Configuration
+BACKUP_DIR="./backups"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+BACKUP_NAME="picpeak_backup_${TIMESTAMP}"
+
+# Colors for output
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+NC='\033[0m'
+
+echo "🔄 Starting PicPeak backup..."
+
+# Create backup directory
+mkdir -p "${BACKUP_DIR}/${BACKUP_NAME}"
+
+# Backup database
+echo "📊 Backing up database..."
+if [ -f "./data/photo_sharing.db" ]; then
+    cp ./data/photo_sharing.db "${BACKUP_DIR}/${BACKUP_NAME}/"
+    echo -e "${GREEN}✓ SQLite database backed up${NC}"
+else
+    # PostgreSQL backup
+    docker exec picpeak-postgres pg_dump -U picpeak picpeak > "${BACKUP_DIR}/${BACKUP_NAME}/database.sql" 2>/dev/null || {
+        echo -e "${RED}⚠ Database backup failed - is PostgreSQL running?${NC}"
+    }
+fi
+
+# Backup storage
+echo "📸 Backing up photos..."
+if [ -d "./storage" ]; then
+    tar -czf "${BACKUP_DIR}/${BACKUP_NAME}/storage.tar.gz" ./storage 2>/dev/null || {
+        echo -e "${RED}⚠ Storage backup failed${NC}"
+        exit 1
+    }
+    echo -e "${GREEN}✓ Storage backed up${NC}"
+fi
+
+# Backup environment files
+echo "⚙️  Backing up configuration..."
+cp .env "${BACKUP_DIR}/${BACKUP_NAME}/.env.backup" 2>/dev/null || true
+
+# Create backup info
+echo "📝 Creating backup info..."
+cat > "${BACKUP_DIR}/${BACKUP_NAME}/backup_info.txt" << EOF
+PicPeak Backup
+Created: $(date)
+Version: $(grep version backend/package.json | head -1 | awk -F'"' '{print $4}')
+Storage Size: $(du -sh ./storage 2>/dev/null | cut -f1 || echo "N/A")
+EOF
+
+# Compress entire backup
+echo "📦 Compressing backup..."
+cd "${BACKUP_DIR}"
+tar -czf "${BACKUP_NAME}.tar.gz" "${BACKUP_NAME}"
+rm -rf "${BACKUP_NAME}"
+
+# Cleanup old backups (keep last 7)
+echo "🧹 Cleaning up old backups..."
+ls -t *.tar.gz | tail -n +8 | xargs -r rm
+
+echo -e "${GREEN}✅ Backup completed: ${BACKUP_DIR}/${BACKUP_NAME}.tar.gz${NC}"
+echo "💡 To restore: tar -xzf ${BACKUP_NAME}.tar.gz && follow restore instructions"
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+# Generate a secure JWT secret for PicPeak
+
+echo "==================================="
+echo "JWT Secret Generator for PicPeak"
+echo "==================================="
+echo ""
+
+# Generate the secret
+SECRET=$(openssl rand -hex 32)
+
+echo "Your new JWT secret (64 characters):"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "$SECRET"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+echo "To use this secret:"
+echo ""
+echo "1. For Docker Compose (.env file):"
+echo "   JWT_SECRET=$SECRET"
+echo ""
+echo "2. For environment variable:"
+echo "   export JWT_SECRET=$SECRET"
+echo ""
+echo "3. For systemd service:"
+echo "   Environment=\"JWT_SECRET=$SECRET\""
+echo ""
+echo "⚠️  IMPORTANT:"
+echo "   - Keep this secret secure and never commit it to version control"
+echo "   - Use different secrets for different environments"
+echo "   - Store production secrets in a secure secret management system"
+echo "   - Rotate secrets regularly (every 90 days recommended)"
+echo ""
@@ -0,0 +1,176 @@
+#!/bin/bash
+
+# Gitea Act Runner Installation Script
+set -e
+
+echo "==================================="
+echo "Gitea Act Runner Installation"
+echo "==================================="
+
+# Configuration
+GITEA_URL="https://gitea.nothaft.cloud"
+RUNNER_NAME="picpeak-runner-$(hostname)"
+RUNNER_VERSION="0.2.10"  # Latest stable version
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+echo -e "${YELLOW}This script will help you install and register a Gitea Act Runner${NC}"
+echo ""
+
+# Step 1: Get registration token
+echo -e "${GREEN}Step 1: Get Registration Token${NC}"
+echo "1. Go to: $GITEA_URL/admin/runners"
+echo "2. Click 'Create new Runner'"
+echo "3. Copy the registration token"
+echo ""
+read -p "Enter your registration token: " REGISTRATION_TOKEN
+
+if [ -z "$REGISTRATION_TOKEN" ]; then
+    echo -e "${RED}Error: Registration token is required${NC}"
+    exit 1
+fi
+
+# Step 2: Choose installation method
+echo ""
+echo -e "${GREEN}Step 2: Choose Installation Method${NC}"
+echo "1. Docker (Recommended)"
+echo "2. Binary installation"
+read -p "Choose method (1 or 2): " METHOD
+
+if [ "$METHOD" == "1" ]; then
+    # Docker installation
+    echo ""
+    echo -e "${GREEN}Installing with Docker...${NC}"
+    
+    # Check if Docker is installed
+    if ! command -v docker &> /dev/null; then
+        echo -e "${RED}Error: Docker is not installed${NC}"
+        echo "Please install Docker first: https://docs.docker.com/get-docker/"
+        exit 1
+    fi
+    
+    # Create docker-compose file for runner
+    cat > docker-compose.runner.yml << EOF
+version: '3.8'
+
+services:
+  gitea-runner:
+    image: gitea/act_runner:latest
+    container_name: gitea-runner
+    restart: unless-stopped
+    environment:
+      - GITEA_INSTANCE_URL=$GITEA_URL
+      - GITEA_RUNNER_REGISTRATION_TOKEN=$REGISTRATION_TOKEN
+      - GITEA_RUNNER_NAME=$RUNNER_NAME
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./runner-data:/data
+    networks:
+      - picpeak
+
+networks:
+  picpeak:
+    external: true
+EOF
+
+    echo "Starting Gitea Runner with Docker..."
+    docker-compose -f docker-compose.runner.yml up -d
+    
+    echo ""
+    echo -e "${GREEN}✓ Runner installed and started with Docker${NC}"
+    echo "Check logs with: docker logs gitea-runner"
+    
+elif [ "$METHOD" == "2" ]; then
+    # Binary installation
+    echo ""
+    echo -e "${GREEN}Installing binary...${NC}"
+    
+    # Detect OS and architecture
+    OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+    ARCH=$(uname -m)
+    
+    case "$ARCH" in
+        x86_64)
+            ARCH="amd64"
+            ;;
+        aarch64|arm64)
+            ARCH="arm64"
+            ;;
+        *)
+            echo -e "${RED}Unsupported architecture: $ARCH${NC}"
+            exit 1
+            ;;
+    esac
+    
+    # Download act_runner
+    DOWNLOAD_URL="https://gitea.com/gitea/act_runner/releases/download/v${RUNNER_VERSION}/act_runner-${RUNNER_VERSION}-${OS}-${ARCH}"
+    
+    echo "Downloading from: $DOWNLOAD_URL"
+    curl -L -o act_runner "$DOWNLOAD_URL"
+    chmod +x act_runner
+    
+    # Create config directory
+    mkdir -p ~/.config/act_runner
+    
+    # Register the runner
+    echo ""
+    echo -e "${GREEN}Registering runner...${NC}"
+    ./act_runner register \
+        --no-interactive \
+        --instance "$GITEA_URL" \
+        --token "$REGISTRATION_TOKEN" \
+        --name "$RUNNER_NAME" \
+        --labels "ubuntu-latest:docker://node:16-bullseye,ubuntu-22.04:docker://node:16-bullseye,ubuntu-20.04:docker://node:16-bullseye"
+    
+    # Create systemd service
+    if [ "$OS" == "linux" ]; then
+        echo ""
+        echo -e "${GREEN}Creating systemd service...${NC}"
+        
+        sudo tee /etc/systemd/system/gitea-runner.service > /dev/null << EOF
+[Unit]
+Description=Gitea Act Runner
+After=network.target
+
+[Service]
+Type=simple
+User=$USER
+WorkingDirectory=$PWD
+ExecStart=$PWD/act_runner daemon
+Restart=always
+RestartSec=5
+Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+        sudo systemctl daemon-reload
+        sudo systemctl enable gitea-runner
+        sudo systemctl start gitea-runner
+        
+        echo -e "${GREEN}✓ Runner installed as systemd service${NC}"
+        echo "Check status with: sudo systemctl status gitea-runner"
+        echo "Check logs with: sudo journalctl -u gitea-runner -f"
+    else
+        echo ""
+        echo -e "${GREEN}✓ Runner installed${NC}"
+        echo "Start runner with: ./act_runner daemon"
+    fi
+fi
+
+echo ""
+echo -e "${GREEN}==================================="
+echo "Installation Complete!"
+echo "===================================${NC}"
+echo ""
+echo "Next steps:"
+echo "1. Go to: $GITEA_URL/paul/picpeak/settings/actions/runners"
+echo "2. Verify your runner appears in the list"
+echo "3. Push a commit to trigger the test workflow"
+echo ""
+echo "If the runner doesn't appear, check the logs for errors."
@@ -0,0 +1,73 @@
+#!/bin/bash
+set -e
+
+echo "Photo Sharing Platform - Docker Installation"
+echo "==========================================="
+
+# Check if running as root
+if [[ $EUID -ne 0 ]]; then
+   echo "This script must be run as root" 
+   exit 1
+fi
+
+# Function to check if command exists
+command_exists() {
+    command -v "$1" >/dev/null 2>&1
+}
+
+# Check prerequisites
+echo "Checking prerequisites..."
+
+# Install Docker if not present
+if ! command_exists docker; then
+    echo "Installing Docker..."
+    curl -fsSL https://get.docker.com -o get-docker.sh
+    sh get-docker.sh
+    rm get-docker.sh
+fi
+
+# Install Docker Compose if not present
+if ! command_exists docker-compose; then
+    echo "Installing Docker Compose..."
+    curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+    chmod +x /usr/local/bin/docker-compose
+fi
+
+# Create necessary directories
+echo "Creating directory structure..."
+mkdir -p storage/events/{active,archived}
+mkdir -p storage/thumbnails
+mkdir -p data
+mkdir -p logs
+mkdir -p nginx/sites-enabled
+mkdir -p certbot/{conf,www}
+
+# Set permissions
+chmod -R 755 storage
+chmod -R 755 data
+chmod -R 755 logs
+
+# Copy environment file
+if [ ! -f .env ]; then
+    cp .env.example .env
+    echo "Created .env file. Please edit it with your configuration."
+fi
+
+# Generate secure passwords
+echo "Generating secure passwords..."
+JWT_SECRET=$(openssl rand -base64 32)
+DB_PASSWORD=$(openssl rand -base64 32)
+UMAMI_HASH_SALT=$(openssl rand -base64 32)
+
+# Update .env file with generated values
+sed -i "s/JWT_SECRET=.*/JWT_SECRET=$JWT_SECRET/" .env
+sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$DB_PASSWORD/" .env
+sed -i "s/UMAMI_HASH_SALT=.*/UMAMI_HASH_SALT=$UMAMI_HASH_SALT/" .env
+
+echo ""
+echo "Installation complete!"
+echo "Next steps:"
+echo "1. Edit .env file with your domain names and SMTP settings"
+echo "2. Run: ./scripts/setup-ssl.sh to configure SSL certificates"
+echo "3. Run: docker-compose -f docker-compose.prod.yml up -d"
+echo "4. Run: docker-compose -f docker-compose.prod.yml exec backend npm run migrate"