sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
178 Commits 25 Branches 12 Tags
v1.13.2
Commit Graph
5 Commits
Author SHA1 Message Date
Hermes 320f21c113 fix: credential-manager and crypto-utils auto-resolve data directory paths
CI / Security audit (push) Has been cancelled
Details
CI / Test & Lint (push) Has been cancelled
Details 
The CREDENTIALS_FILE and ENCRYPTION_KEY_FILE env vars defaulted to
__dirname/credentials.json and __dirname/.encryption-key, which works
for the standard install (where individual files are mounted to /app/)
but breaks for deployments using a consolidated data directory at
/app/data/.

Add resolveCredentialsFile() and resolveKeyFile() helpers that:
1. Honor explicit env var if set
2. Check /app/credentials.json and /app/data/credentials.json
3. Check /app/.encryption-key and /app/data/.encryption-key
4. Default to standard path for new installs

This makes DashCaddy deployable with either pattern without requiring
custom env var configuration, which is essential for general-public
reproducibility.
 2026-06-10 19:05:07 -07:00
SamiandClaude Opus 4.6 abd54d4b99 fix: prevent encryption key conflicts and add license backup 
- Remove eager key generation from crypto-utils module load (was baking
  keys into Docker images that conflicted with mounted production keys)
- Add license backup to config.json (survives credential store failures)
- LicenseManager.load() falls back to config.json backup if credential
  store decryption fails (e.g. after container rebuild with new key)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-23 14:17:25 -07:00
SamiandClaude Opus 4.6 75e2d7853e Unify backup/restore into single v2.0 file with full state capture 
Server export now includes encryption key, themes, and all config files.
Client export bundles all DashCaddy localStorage keys (19 named + dynamic
widget keys) as browserState. Restore handles both server and browser
state in one operation. Legacy v1.0 import format still supported.
Removed redundant Export/Import toolbar buttons — Backup modal is now
the single entry point.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-17 21:06:56 -07:00
SamiandClaude Opus 4.6 6979302fb7 Fix 7 critical security bugs and 1 high-severity data loss bug 
- CSRF: HMAC-signed double-submit cookie (server-bound, not raw compare)
- Keychain: execFileSync with arg arrays to prevent command injection
- Caddy config: always use structured generation, never accept raw config
- Templates: replace {{GENERATED_SECRET}} with crypto.randomBytes
- Caddyfile removal: move regex inside ctx.caddy.modify() to fix TOCTOU race
- Credentials: proper-lockfile for all file operations, fix key rotation
  to decrypt with old key before generating new key
- Service removal: filter by ID only, not AND with appTemplate

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 23:08:30 -08:00
Sami f61e85d9a7 Initial commit: DashCaddy v1.0 
Full codebase including API server (32 modules + routes), dashboard frontend,
DashCA certificate distribution, installer script, and deployment skills.
 2026-03-05 02:26:12 -08:00