jimmy/nas-tools
1
0
Fork 0
Code Issues Pull Requests 2 Actions 3 Packages Projects Releases Wiki Activity
185 Commits 15 Branches 0 Tags
bab7fddb9049c5461d00722b2a392c5cb21fa192
Commit Graph

28 Commits

Author SHA1 Message Date
Gan, Jimmy 44f0ed5d04 fix: harden dashboard auth and terminal flows
Deploy Dashboard (Dev) / deploy-dev (push) Successful in 3m29s
Details 
Tighten terminal websocket auth and proxy trust handling while making file-backed auth/RBAC writes atomic to reduce high-impact security and persistence risks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-06 23:53:58 +08:00
Gan, Jimmy 4f95f0249d feat: add Mac host to dashboard terminal
Deploy Dashboard (Dev) / deploy-dev (push) Successful in 2m15s
Details 
Add a dedicated Mac terminal target with separate SSH host/user/key settings and mount a dedicated Mac key file for dashboard containers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-06 08:32:54 +08:00
Gan, Jimmy a91a1132c9 feat: add info engine MVP pipeline and dashboard page
Deploy Dashboard (Dev) / deploy-dev (push) Successful in 2m10s
Details 
Introduce a standalone scheduled info-engine worker with SQLite persistence and expose read-only dashboard APIs/UI so curated intelligence items can be collected and viewed with minimal architecture changes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-02 23:35:10 +08:00
Gan, Jimmy 14965c7e03 feat: add cc-connect dashboard health integration
Deploy Dashboard (Dev) / deploy-dev (push) Successful in 2m49s
Details 
Add a protected backend health endpoint and a new dashboard page/sidebar entry so cc-connect operational status is visible in the UI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-02 23:24:03 +08:00
Gan, Jimmy 56743d1cf4 fix: make LiteLLM health probe auth-aware
Deploy Dashboard (Dev) / deploy-dev (push) Successful in 3m4s
Details 
Allow the dashboard health check to include optional LiteLLM auth headers and treat unauthenticated 401 responses as an auth-required healthy state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-02 03:38:25 +08:00
Gan, Jimmy ed4090a910 feat: add LiteLLM gateway scaffold and dashboard health probe
Deploy Dashboard (Dev) / deploy-dev (push) Successful in 2m11s
Details 
Introduce a localhost-only LiteLLM service template and expose a protected dashboard health endpoint for operational visibility, while adding cc-connect mobile bridge templates with conservative defaults.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-02 01:08:12 +08:00
Gan, Jimmy 72bb37ffe5 fix: correct sidebar LAN detection for public access
Deploy Dashboard (Dev) / deploy-dev (push) Successful in 2m27s
Details 
Separate Tailscale IP detection from true LAN detection so public internet users routed through VPS no longer get non-routable port links in the sidebar.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-01 22:46:05 +08:00
Gan, Jimmy 3fd045aacb feat: security hardening and HTTPS/SSO infrastructure configs
Deploy Dashboard / deploy (push) Successful in 1m28s
Details 
- Narrow trusted proxies, remove overly broad 10.0.0.0/8
- Fail closed on missing SSH known_hosts in terminal proxy
- Add Navidrome reverse proxy headers for Authelia SSO
- Add Gitea docker-compose definition
- Add Caddy configs for NAS and VPS edge proxies
- Add dnsmasq split-horizon DNS config
- Add security execution plan document
 2026-02-28 22:25:39 +08:00
Gan, Jimmy a0354c335b fix: trust docker gateway IP for reverse proxy auth
Deploy Dashboard / deploy (push) Successful in 1m35s
Details
2026-02-27 23:48:34 +08:00
Gan, Jimmy 3888a57642 chore: secure dashboard proxy endpoint and decouple lan checks
Deploy Dashboard / deploy (push) Successful in 1m48s
Details
2026-02-27 23:41:36 +08:00
Gan, Jimmy c676c84bc1 feat: add chat group daily summarizer
Deploy Dashboard / deploy (push) Failing after 38s
Details 
- Telegram collector (Telethon MTProto) with checkpoint-based message fetching
- Claude API summarization via proxy (haiku model)
- Dashboard page with date picker, markdown summary, raw message drill-down
- Separate container lifecycle from dashboard for stable Telethon sessions
- Shared SQLite DB mounted read-only into dashboard
 2026-02-27 02:51:52 +08:00
Gan, Jimmy 7f94013bf9 feat: add Caddy VPS terminal connection
Deploy Dashboard / deploy (push) Successful in 1m44s
Details
2026-02-27 00:26:01 +08:00
Gan, Jimmy 394a1aa367 security: harden dashboard (SSH keys, auth, uploads, CORS, non-root) 
Remove SSH private keys from git, add SECRET_KEY validation, move WS
auth from query string to first message, add session limits/idle timeout,
PBKDF2 Fernet key, refresh token rotation, TOTP replay protection,
file upload size limit + filename sanitization, symlink safety check,
restrict CORS methods, IP-gate OpenClaw token, run container as non-root,
rate-limit refresh/passkey endpoints, sanitize Gitea path params.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-02-26 17:22:25 +08:00
Gan, Jimmy 332696689a fix: support port 8443 origin for WebAuthn passkeys and CORS 2026-02-26 02:00:29 +08:00
Gan, Jimmy 87fdabcd50 Fix OpenClaw: auto-include gateway token in dashboard link 2026-02-22 18:30:34 +08:00
Gan, Jimmy be1f3b3ad6 Add security improvements: refresh tokens, passkeys, CSP, audit logging, TOTP encryption 
- Shorten access token to 30min with 7-day refresh token flow
- Add WebAuthn passkey registration and login with TOTP fallback
- Add Content-Security-Policy header
- Add audit logging middleware to /volume1/docker/nas-dashboard/audit.log
- Block /volume1/docker/ in files endpoint
- Encrypt TOTP secret at rest with Fernet (derived from SECRET_KEY)
- New deps: py_webauthn, cryptography
 2026-02-22 11:04:40 +08:00
Gan, Jimmy b1dee47126 Add CORS, rate limiting, security headers, and files endpoint protection 2026-02-21 11:18:29 +08:00
Gan, Jimmy dd3e8e0d2c security: remove hardcoded secrets, add health endpoint, add security headers 2026-02-20 22:04:01 +08:00
Gan, Jimmy b063382085 feat: add container monitor & telegram alerts 
Added asyncio monitoring task to main.py to watch Docker container state transitions and send Telegram notifications on failures.
 2026-02-20 10:31:18 +08:00
Gan, Jimmy a882f45f2e Add multi-host terminal: NAS + VPS side-by-side 2026-02-20 00:53:29 +08:00
Gan, Jimmy 197b7c1cbb Fix session expiry: use config value, increase to 7 days 
- LOGIN was ignoring ACCESS_TOKEN_EXPIRE_MINUTES (hardcoded 15min default)
- Pass expires_delta from config in login route
- Increase token lifetime from 30min to 7 days
 2026-02-19 19:44:30 +08:00
Gan, Jimmy ee2e5dcb3c Terminal: SSH to NAS host instead of container shell 
- Rewrite terminal.py to use asyncssh instead of pty/fork
- Add SSH key pair for dashboard container auth
- Mount SSH key and add SSH config vars in docker-compose
- Install openssh-client in Dockerfile
- Add asyncssh to requirements.txt
 2026-02-19 19:24:38 +08:00
Gan, Jimmy 4036292273 Bump version to v1.3 — runner DNS fixed
Deploy Dashboard / deploy (push) Successful in 3m39s
Details
2026-02-19 10:26:40 +08:00
Gan, Jimmy 91c8d1b775 Bump version to v1.2 — CI/CD pipeline test
Deploy Dashboard / deploy (push) Failing after 2m6s
Details
2026-02-19 10:18:32 +08:00
Gan, Jimmy 7aeabe1839 Test CI/CD: add version comment
Deploy Dashboard / deploy (push) Failing after 17s
Details
2026-02-19 10:15:14 +08:00
Gan, Jimmy 75c89b1ef9 Fix auth crashes + add CI/CD workflow
Deploy Dashboard / deploy (push) Failing after 6m59s
Details 
- Fix jose->pyjwt import mismatch
- Fix bcrypt->pbkdf2 password hashing
- Fix Sidebar logout prop (ReferenceError)
- Add .gitea/workflows/deploy.yml for automated deployment
 2026-02-19 10:04:38 +08:00
Gan, Jimmy 651bc0580e Phase 7: Auth & Security upgrade (JWT, 2FA, Login UI) 2026-02-19 03:47:48 +08:00
Gan, Jimmy 70aa421d7f Add NAS dashboard MVP: Docker mgmt, Gitea, Files, Terminal 2026-02-19 01:59:50 +08:00