kami
755de34501
The entire admin surface of the SPA had been dead since auth landed (5ed8d9e/3bc9f2d). nginx.conf.template injected only `Authorization: Bearer ${MUZICK_API_KEY}` for all of /api, docker-compose passed only MUZICK_API_KEY to the frontend container, and app.ts requires token === adminKey for /api/admin/*. The two keys differ, and services/api.ts sets no headers of its own. All 10 admin call sites were affected: the Jobs page polled 403s every 3s/5s forever and rendered a blank Overview with no error state, and every Settings library action (Scan, Reindex, Reprocess artists, Re-enrich, Duplicates merge) silently failed. Three changes, each necessary: - a `location /api/admin/` block injecting the admin key - the Dockerfile envsubst list widened to include MUZICK_ADMIN_KEY, without which the new variable substitutes to empty and the header becomes a bare "Bearer" - MUZICK_ADMIN_KEY passed to the frontend service in docker-compose nginx selects the longest matching prefix regardless of block order; verified empirically in a throwaway nginx:stable-alpine running the real envsubst output against a stub that echoes $http_authorization: /api/admin/queue-stats -> Bearer ADMINKEY456 /api/admin/duplicates/merge -> Bearer ADMINKEY456 /api/tracks -> Bearer APIKEY123 /api/health -> Bearer APIKEY123 All 10 call sites use /admin/... under the axios /api baseURL and none request bare /api/admin without a trailing slash. Also gives the Jobs page an error state: a banner that names a 401/403 as a missing or wrong admin key, a Retry button, "Loading queue stats..." in place of a blank Overview, and refetchInterval returning false once the query has errored so it stops hammering a failing endpoint. Deletes frontend/nginx.conf — unreferenced by the Dockerfile (confirmed by grep) and the insecure variant of the template. Worth noting and not addressed here: the outer LAN-only proxy already forges credentials for everything reaching /api, so this key split buys no real security while having cost the whole admin surface. Collapsing to one key would be simpler. REVIEW-2026-07-30.md finding 2. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
79 lines
2.1 KiB
YAML
79 lines
2.1 KiB
YAML
services:
|
|
db:
|
|
image: postgres:16-alpine
|
|
restart: always
|
|
environment:
|
|
POSTGRES_USER: user
|
|
POSTGRES_PASSWORD: ${DB_PASSWORD}
|
|
POSTGRES_DB: muzick
|
|
ports:
|
|
- "127.0.0.1:5432:5432"
|
|
volumes:
|
|
- ./data/postgres:/var/lib/postgresql/data
|
|
- ./backend/src/db/schema.sql:/docker-entrypoint-initdb.d/schema.sql
|
|
|
|
search:
|
|
image: typesense/typesense:0.25.1
|
|
restart: always
|
|
ports:
|
|
- "127.0.0.1:8108:8108"
|
|
volumes:
|
|
- ./data/typesense:/data
|
|
command: --data-dir /data --api-key=${TYPESENSE_API_KEY}
|
|
|
|
backend:
|
|
build: ./backend
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:3000:3000"
|
|
environment:
|
|
DATABASE_URL: postgresql://user:${DB_PASSWORD}@db:5432/muzick
|
|
REDIS_URL: redis://:${REDIS_PASSWORD}@infra-redis:6379
|
|
TYPESENSE_API_KEY: ${TYPESENSE_API_KEY}
|
|
MUZICK_API_KEY: ${MUZICK_API_KEY}
|
|
MUZICK_ADMIN_KEY: ${MUZICK_ADMIN_KEY}
|
|
MUSIC_DIR: /music
|
|
volumes:
|
|
# READ-ONLY, deliberately. Nothing in the API request path may write to
|
|
# the library. Hard deletion of disliked files happens only in the worker,
|
|
# which is the sole service with an rw mount.
|
|
- /mnt/hdd1/media/Music:/music:ro
|
|
depends_on:
|
|
- db
|
|
- search
|
|
networks:
|
|
- default
|
|
- infra-net
|
|
|
|
frontend:
|
|
build: ./frontend
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:5174:80"
|
|
environment:
|
|
MUZICK_API_KEY: ${MUZICK_API_KEY}
|
|
MUZICK_ADMIN_KEY: ${MUZICK_ADMIN_KEY}
|
|
depends_on:
|
|
- backend
|
|
|
|
worker:
|
|
build: ./workers
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
environment:
|
|
DATABASE_URL: postgresql://user:${DB_PASSWORD}@127.0.0.1:5432/muzick
|
|
REDIS_URL: redis://:${REDIS_PASSWORD}@127.0.0.1:6379
|
|
MUSICBRAINZ_CONTACT: ${MUSICBRAINZ_CONTACT}
|
|
LASTFM_API_KEY: ${LASTFM_API_KEY}
|
|
LASTFM_SHARED_SECRET: ${LASTFM_SHARED_SECRET}
|
|
DISCOGS_TOKEN: ${DISCOGS_TOKEN}
|
|
SOCKS_PROXY_URL: ${SOCKS_PROXY_URL}
|
|
MUSIC_DIR: /music
|
|
volumes:
|
|
- /mnt/hdd1/media/Music:/music:ro
|
|
|
|
networks:
|
|
infra-net:
|
|
external: true
|
|
name: infra-net
|