Martin Dvorak
8822baf4b7
Audit pass with the threats that actually apply to a self-hosted, account-less app: getting the Ollama key throttled or banned, and someone grinding the app down. Per-route windows already existed; these are the missing layers. - lib/model-guard.ts: every route that spends a model call now takes a slot — 60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight per IP, 6 in total — and the slot is released when the call finishes, on errors and on client disconnects. Over the concurrency cap answers 429 kind=busy, not a punishment. Slots are taken after every cheap rejection so a malformed request cannot hold one (found by the new suite: early 400s were leaking slots). - Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL in an images field made Ollama fetch an arbitrary address on our behalf. - Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored. - The rate-limit identity is the LAST x-forwarded-for hop. Reading the first let a client spoof its own IP and dodge every per-IP limit. - Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder devices cap at PUSH_MAX_SUBSCRIPTIONS (50). - Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a referrer policy and a Permissions-Policy without camera/mic/geo/payment. New tests/security-test.mjs (13 checks, registered in run-all) proves each guard against a slow stub Ollama with deliberately tiny limits. README: security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.
57 lines
2 KiB
TypeScript
57 lines
2 KiB
TypeScript
import type { NextConfig } from "next";
|
|
|
|
/**
|
|
* Freezmo is meant to be opened from a phone on the same network, so the dev
|
|
* server should accept dev-asset requests coming from private hostnames.
|
|
* Production builds are not affected by this option.
|
|
*
|
|
* Add your own hostname here if Next still warns about a cross-origin request.
|
|
*/
|
|
const nextConfig: NextConfig = {
|
|
/**
|
|
* Dev and production never share a build folder: the dev service runs with
|
|
* NEXT_DIST_DIR=.next-dev (see deploy/freezmo-dev.service), while a manual
|
|
* `npm run build` keeps producing .next for the test suites. A production
|
|
* build can therefore never clobber the running dev server, and the other
|
|
* way around.
|
|
*/
|
|
distDir: process.env.NEXT_DIST_DIR || ".next",
|
|
/**
|
|
* Releases ship as self-contained standalone output: scripts/deploy.sh
|
|
* copies public/ and .next/static next to `.next/standalone/server.js` and
|
|
* runs that. `next start` keeps working too, so the existing workflows and
|
|
* the e2e suites are unaffected.
|
|
*/
|
|
output: "standalone",
|
|
/**
|
|
* Security headers. The app has no accounts, so these are about containment:
|
|
* never framed (clickjacking), never sniffed into a script, and no camera,
|
|
* microphone or location access it does not need (the camera button uses a
|
|
* file input with `capture`, which is not gated by Permissions-Policy).
|
|
*/
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: "/(.*)",
|
|
headers: [
|
|
{ key: "X-Frame-Options", value: "DENY" },
|
|
{ key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
|
|
{ key: "X-Content-Type-Options", value: "nosniff" },
|
|
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
|
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), payment=()" },
|
|
],
|
|
},
|
|
];
|
|
},
|
|
allowedDevOrigins: [
|
|
"127.0.0.1",
|
|
"localhost",
|
|
"*.local",
|
|
"**.local",
|
|
"192.168.*.*",
|
|
"10.*.*.*",
|
|
"*.ts.net", // Tailscale
|
|
],
|
|
};
|
|
|
|
export default nextConfig;
|