Dymas/jarri-spooty
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Document Jarri Spooty hardening updates

Browse Source
This commit is contained in:
TorMatzAndren
2026-05-16 13:10:00 +02:00
parent d83b0e6e1e
commit a71a47f76a
2 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+6
View File
@@ -64,6 +64,12 @@ This project follows a practical chronological changelog rather than autogenerat
- Added isolated Spotify credential storage - Added isolated Spotify credential storage
- Added safer cookie handling flow - Added safer cookie handling flow
- Improved Docker secret isolation documentation - Improved Docker secret isolation documentation
- Removed unused downloader dependencies to reduce transitive attack surface
- Hardened download filename sanitization
- Hardened remote cover-art fetching with protocol, MIME, timeout, and size checks
- Added yt-dlp subprocess timeout and single-settlement handling
- Shaped track websocket payloads to avoid leaking internal entity fields
- Normalized visible project naming to Jarri Spooty
### Frontend ### Frontend
README.md
+9 -5
View File
@@ -21,6 +21,8 @@ This hardened branch focuses on:
- Persistent SQLite state across container restarts - Persistent SQLite state across container restarts
- Deterministic Docker config persistence - Deterministic Docker config persistence
- Improved operational observability - Improved operational observability
- Reduced unused dependency surface
- Hardened filename, cover-art, subprocess, and websocket boundaries
--- ---
@@ -40,6 +42,8 @@ This hardened branch focuses on:
- Automatic YouTube retry/fallback handling - Automatic YouTube retry/fallback handling
- Failed YouTube candidate rejection memory - Failed YouTube candidate rejection memory
- Deterministic yt-dlp error classification - Deterministic yt-dlp error classification
- Hardened cover-art validation and embedding
- Explicit client-facing websocket payload shaping
--- ---
@@ -136,7 +140,7 @@ docker run --rm -p 3000:3000 \
-v "$PWD/downloads:/spooty/backend/downloads" \ -v "$PWD/downloads:/spooty/backend/downloads" \
-v "$PWD/spooty-config:/spooty/backend/config" \ -v "$PWD/spooty-config:/spooty/backend/config" \
-v "/etc/tokens/youtube.cookies.txt:/spooty/config/youtube.cookies.txt:ro" \ -v "/etc/tokens/youtube.cookies.txt:/spooty/config/youtube.cookies.txt:ro" \
spootyfy-hardened:local jarri-spooty:local
``` ```
Open: Open:
@@ -158,8 +162,8 @@ Then:
```yaml ```yaml
services: services:
spooty: spooty:
image: spootyfy-hardened:local image: jarri-spooty:local
container_name: spooty container_name: jarri-spooty
restart: unless-stopped restart: unless-stopped
ports: ports:
@@ -204,7 +208,7 @@ services:
```bash ```bash
npm install npm install
npm run build npm run build
docker build -t spootyfy-hardened:local . docker build -t jarri-spooty:local .
``` ```
--- ---
@@ -493,7 +497,7 @@ docker run --rm -p 3000:3000 \
-v "$PWD/downloads:/spooty/backend/downloads" \ -v "$PWD/downloads:/spooty/backend/downloads" \
-v "$PWD/spooty-config:/spooty/backend/config" \ -v "$PWD/spooty-config:/spooty/backend/config" \
-v "/etc/tokens/youtube.cookies.txt:/spooty/config/youtube.cookies.txt:ro" \ -v "/etc/tokens/youtube.cookies.txt:/spooty/config/youtube.cookies.txt:ro" \
spootyfy-hardened:local jarri-spooty:local
``` ```
--- ---