mirror of
https://github.com/sysadminsmedia/homebox.git
synced 2025-12-21 13:23:14 +01:00
Fix Windows build and re-apply unix socket support (#906)
* Reapply "Support listening on unix sockets and systemd sockets (#878)"
This reverts commit 2f51ba419b.
* Fix windows build
Upgrade anyhttp to v0.5.2
This commit is contained in:
Balki
@@ -2,6 +2,7 @@ package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"github.com/go-chi/chi/v5"
|
||||
"github.com/go-chi/chi/v5/middleware"
|
||||
@@ -24,6 +25,7 @@ import (
|
||||
"github.com/sysadminsmedia/homebox/backend/internal/data/repo"
|
||||
"github.com/sysadminsmedia/homebox/backend/internal/sys/config"
|
||||
"github.com/sysadminsmedia/homebox/backend/internal/web/mid"
|
||||
"go.balki.me/anyhttp"
|
||||
|
||||
_ "github.com/lib/pq"
|
||||
_ "github.com/sysadminsmedia/homebox/backend/internal/data/migrations/postgres"
|
||||
@@ -190,6 +192,23 @@ func run(cfg *config.Config) error {
|
||||
_ = httpserver.Shutdown(context.Background())
|
||||
}()
|
||||
|
||||
listener, addrType, addrCfg, err := anyhttp.GetListener(cfg.Web.Host)
|
||||
if err == nil {
|
||||
switch addrType {
|
||||
case anyhttp.SystemdFD:
|
||||
sysdCfg := addrCfg.(*anyhttp.SysdConfig)
|
||||
if sysdCfg.IdleTimeout != nil {
|
||||
log.Error().Msg("idle timeout not yet supported. Please remove and try again")
|
||||
return errors.New("idle timeout not yet supported. Please remove and try again")
|
||||
}
|
||||
fallthrough
|
||||
case anyhttp.UnixSocket:
|
||||
log.Info().Msgf("Server is running on %s", cfg.Web.Host)
|
||||
return httpserver.Serve(listener)
|
||||
}
|
||||
} else {
|
||||
log.Debug().Msgf("anyhttp error: %v", err)
|
||||
}
|
||||
log.Info().Msgf("Server is running on %s:%s", cfg.Web.Host, cfg.Web.Port)
|
||||
return httpserver.ListenAndServe()
|
||||
})
|
||||
|
||||
@@ -34,6 +34,7 @@ require (
|
||||
github.com/yeqown/go-qrcode/v2 v2.2.5
|
||||
github.com/yeqown/go-qrcode/writer/standard v1.3.0
|
||||
github.com/zeebo/blake3 v0.2.4
|
||||
go.balki.me/anyhttp v0.5.2
|
||||
gocloud.dev v0.41.0
|
||||
gocloud.dev/pubsub/kafkapubsub v0.41.0
|
||||
gocloud.dev/pubsub/natspubsub v0.41.0
|
||||
|
||||
@@ -469,6 +469,8 @@ github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
|
||||
github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
|
||||
github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
|
||||
github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
|
||||
go.balki.me/anyhttp v0.5.2 h1:et4tCDXLeXpWfMNvRKG7ojfrnlr3du7cEaG966MLSpA=
|
||||
go.balki.me/anyhttp v0.5.2/go.mod h1:JhfekOIjgVODoVqUCficjpIgmB3wwlB7jhN0eN2EZ/s=
|
||||
go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
|
||||
go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
|
||||
go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
|
||||
|
||||
@@ -11,7 +11,7 @@ aside: false
|
||||
|-----------------------------------------|----------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| HBOX_MODE | `production` | application mode used for runtime behavior can be one of: `development`, `production` |
|
||||
| HBOX_WEB_PORT | 7745 | port to run the web server on, if you're using docker do not change this |
|
||||
| HBOX_WEB_HOST | | host to run the web server on, if you're using docker do not change this |
|
||||
| HBOX_WEB_HOST | | host to run the web server on, if you're using docker do not change this. see below for examples |
|
||||
| HBOX_OPTIONS_ALLOW_REGISTRATION | true | allow users to register themselves |
|
||||
| HBOX_OPTIONS_AUTO_INCREMENT_ASSET_ID | true | auto-increments the asset_id field for new items |
|
||||
| HBOX_OPTIONS_CURRENCY_CONFIG | | json configuration file containing additional currencie |
|
||||
@@ -54,6 +54,84 @@ aside: false
|
||||
| HBOX_THUMBNAIL_WIDTH | 500 | width for generated thumbnails in pixels |
|
||||
| HBOX_THUMBNAIL_HEIGHT | 500 | height for generated thumbnails in pixels |
|
||||
|
||||
### HBOX_WEB_HOST examples
|
||||
|
||||
| Value | Notes |
|
||||
|-----------------------------|------------------------------------------------------------|
|
||||
| 0.0.0.0 | Visible all interfaces (default behaviour) |
|
||||
| 127.0.0.1 | Only visible on same host |
|
||||
| 100.64.0.1 | Only visible on a specific interface (e.g., VPN in a VPS). |
|
||||
| unix?path=/run/homebox.sock | Listen on unix socket at specified path |
|
||||
| sysd?name=homebox.socket | Listen on systemd socket |
|
||||
|
||||
For unix and systemd socket address syntax and available options, see the [anyhttp address-syntax documentation](https://pkg.go.dev/go.balki.me/anyhttp#readme-address-syntax).
|
||||
|
||||
#### Private network example
|
||||
|
||||
Below example starts homebox in an isolated network. The process cannot make
|
||||
any external requests (including check for newer release) and thus more secure.
|
||||
|
||||
```bash
|
||||
❯ sudo systemd-run --property=PrivateNetwork=yes --uid $UID --pty --same-dir --wait --collect homebox --web-host "unix?path=/run/user/$UID/homebox.sock"
|
||||
Running as unit: run-p74482-i74483.service
|
||||
Press ^] three times within 1s to disconnect TTY.
|
||||
2025/07/11 22:33:29 goose: no migrations to run. current version: 20250706190000
|
||||
10:33PM INF ../../../go/src/app/app/api/handlers/v1/v1_ctrl_auth.go:98 > registering auth provider name=local
|
||||
10:33PM INF ../../../go/src/app/app/api/main.go:275 > Server is running on unix?path=/run/user/1000/homebox.sock
|
||||
10:33PM ERR ../../../go/src/app/app/api/main.go:403 > failed to get latest github release error="failed to make latest version request: Get \"https://api.github.com/repos/sysadminsmedia/homebox/releases/l
|
||||
atest\": dial tcp: lookup api.github.com on [::1]:53: read udp [::1]:50951->[::1]:53: read: connection refused"
|
||||
10:33PM INF ../../../go/src/app/internal/web/mid/logger.go:36 > request received method=GET path=/ rid=hname/PoXyRgt6ol-000001
|
||||
10:33PM INF ../../../go/src/app/internal/web/mid/logger.go:41 > request finished method=GET path=/ rid=hname/PoXyRgt6ol-000001 status=0
|
||||
```
|
||||
|
||||
#### Systemd socket example
|
||||
|
||||
In the example below, Homebox listens on a systemd socket securely so that only
|
||||
the webserver (Caddy) can access it. Other processes/containers on the host
|
||||
cannot connect to Homebox directly, bypassing the webserver.
|
||||
|
||||
File: homebox.socket
|
||||
```systemd
|
||||
# /usr/local/lib/systemd/system/homebox.socket
|
||||
[Unit]
|
||||
Description=Homebox socket
|
||||
|
||||
[Socket]
|
||||
ListenStream=/run/homebox.sock
|
||||
SocketGroup=caddy
|
||||
SocketMode=0660
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
```
|
||||
|
||||
File: homebox.service
|
||||
```systemd
|
||||
# /usr/local/lib/systemd/system/homebox.service
|
||||
[Unit]
|
||||
Description=Homebox
|
||||
After=network.target
|
||||
Documentation=https://homebox.software
|
||||
|
||||
[Service]
|
||||
DynamicUser=yes
|
||||
StateDirectory=homebox
|
||||
Environment=HBOX_WEB_HOST=sysd?name=homebox.socket
|
||||
WorkingDirectory=/var/lib/homebox
|
||||
|
||||
ExecStart=/usr/local/bin/homebox
|
||||
|
||||
NoNewPrivileges=yes
|
||||
CapabilityBoundingSet=
|
||||
RestrictNamespaces=true
|
||||
SystemCallFilter=@system-service
|
||||
```
|
||||
Usage:
|
||||
|
||||
```bash
|
||||
systemctl start homebox.socket
|
||||
```
|
||||
|
||||
::: warning Security Considerations
|
||||
For postgreSQL in production:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user