Foundation: config, schema/migrations, auth, stable IDs, metadata probing
This commit is contained in:
@@ -0,0 +1,137 @@
|
||||
// Package config loads VibeSonic's process configuration from
|
||||
// VIBESONIC_* environment variables. There is no config file: everything
|
||||
// needed to run the server is available via the environment so the same
|
||||
// binary works under systemd or Docker without a wrapper script.
|
||||
package config
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/netip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
type Config struct {
|
||||
ListenAddr string
|
||||
DataDir string
|
||||
DBPath string
|
||||
MusicDirs []string
|
||||
FFmpegPath string
|
||||
FFprobePath string
|
||||
ScanInterval time.Duration
|
||||
SessionSecret string
|
||||
CookieSecure bool
|
||||
|
||||
ExtAuth ExtAuthConfig
|
||||
}
|
||||
|
||||
// ExtAuthConfig configures optional Navidrome-style externalized
|
||||
// authentication: a trusted reverse proxy authenticates the browser user
|
||||
// and passes their identity in a header. VibeSonic never talks to an
|
||||
// identity provider itself.
|
||||
type ExtAuthConfig struct {
|
||||
Enabled bool
|
||||
TrustedSources []netip.Prefix
|
||||
UserHeader string
|
||||
LogoutURL string
|
||||
AutoCreateUsers bool
|
||||
}
|
||||
|
||||
// Load reads configuration from the environment, applying defaults for
|
||||
// anything unset. It returns an error only for values that are set but
|
||||
// invalid (e.g. an unparsable duration or CIDR).
|
||||
func Load() (Config, error) {
|
||||
cfg := Config{
|
||||
ListenAddr: envOr("VIBESONIC_LISTEN_ADDR", ":8080"),
|
||||
DataDir: envOr("VIBESONIC_DATA_DIR", "/var/lib/vibesonic"),
|
||||
FFmpegPath: envOr("VIBESONIC_FFMPEG_PATH", "ffmpeg"),
|
||||
FFprobePath: envOr("VIBESONIC_FFPROBE_PATH", "ffprobe"),
|
||||
SessionSecret: os.Getenv("VIBESONIC_SESSION_SECRET"),
|
||||
CookieSecure: envBool("VIBESONIC_COOKIE_SECURE", true),
|
||||
}
|
||||
cfg.DBPath = envOr("VIBESONIC_DB", filepath.Join(cfg.DataDir, "vibesonic.db"))
|
||||
|
||||
if dirs := os.Getenv("VIBESONIC_MUSIC_DIRS"); dirs != "" {
|
||||
for _, d := range strings.Split(dirs, ":") {
|
||||
d = strings.TrimSpace(d)
|
||||
if d != "" {
|
||||
cfg.MusicDirs = append(cfg.MusicDirs, d)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
interval := envOr("VIBESONIC_SCAN_INTERVAL", "1h")
|
||||
d, err := time.ParseDuration(interval)
|
||||
if err != nil {
|
||||
return cfg, fmt.Errorf("VIBESONIC_SCAN_INTERVAL: %w", err)
|
||||
}
|
||||
cfg.ScanInterval = d
|
||||
|
||||
extauth, err := loadExtAuth()
|
||||
if err != nil {
|
||||
return cfg, err
|
||||
}
|
||||
cfg.ExtAuth = extauth
|
||||
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func loadExtAuth() (ExtAuthConfig, error) {
|
||||
e := ExtAuthConfig{
|
||||
Enabled: envBool("VIBESONIC_EXTAUTH_ENABLED", false),
|
||||
UserHeader: envOr("VIBESONIC_EXTAUTH_USER_HEADER", "Remote-User"),
|
||||
LogoutURL: os.Getenv("VIBESONIC_EXTAUTH_LOGOUT_URL"),
|
||||
AutoCreateUsers: envBool("VIBESONIC_EXTAUTH_AUTO_CREATE_USERS", true),
|
||||
}
|
||||
raw := os.Getenv("VIBESONIC_EXTAUTH_TRUSTED_SOURCES")
|
||||
if raw == "" {
|
||||
// No default trusted network: external auth must be explicitly
|
||||
// scoped to a real network before it can trust anything.
|
||||
return e, nil
|
||||
}
|
||||
for _, part := range strings.Split(raw, ",") {
|
||||
part = strings.TrimSpace(part)
|
||||
if part == "" {
|
||||
continue
|
||||
}
|
||||
prefix, err := parseCIDROrIP(part)
|
||||
if err != nil {
|
||||
return e, fmt.Errorf("VIBESONIC_EXTAUTH_TRUSTED_SOURCES: %w", err)
|
||||
}
|
||||
e.TrustedSources = append(e.TrustedSources, prefix)
|
||||
}
|
||||
return e, nil
|
||||
}
|
||||
|
||||
func parseCIDROrIP(s string) (netip.Prefix, error) {
|
||||
if p, err := netip.ParsePrefix(s); err == nil {
|
||||
return p, nil
|
||||
}
|
||||
addr, err := netip.ParseAddr(s)
|
||||
if err != nil {
|
||||
return netip.Prefix{}, fmt.Errorf("invalid CIDR or IP %q: %w", s, err)
|
||||
}
|
||||
return netip.PrefixFrom(addr, addr.BitLen()), nil
|
||||
}
|
||||
|
||||
func envOr(key, def string) string {
|
||||
if v := os.Getenv(key); v != "" {
|
||||
return v
|
||||
}
|
||||
return def
|
||||
}
|
||||
|
||||
func envBool(key string, def bool) bool {
|
||||
v := os.Getenv(key)
|
||||
if v == "" {
|
||||
return def
|
||||
}
|
||||
b, err := strconv.ParseBool(v)
|
||||
if err != nil {
|
||||
return def
|
||||
}
|
||||
return b
|
||||
}
|
||||
@@ -0,0 +1,95 @@
|
||||
package config
|
||||
|
||||
import (
|
||||
"testing"
|
||||
)
|
||||
|
||||
func withEnv(t *testing.T, kv map[string]string) {
|
||||
t.Helper()
|
||||
for k, v := range kv {
|
||||
t.Setenv(k, v)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadDefaults(t *testing.T) {
|
||||
cfg, err := Load()
|
||||
if err != nil {
|
||||
t.Fatalf("Load: %v", err)
|
||||
}
|
||||
if cfg.ListenAddr != ":8080" {
|
||||
t.Errorf("ListenAddr = %q, want :8080", cfg.ListenAddr)
|
||||
}
|
||||
if cfg.ScanInterval.String() != "1h0m0s" {
|
||||
t.Errorf("ScanInterval = %v, want 1h", cfg.ScanInterval)
|
||||
}
|
||||
if cfg.DBPath != "/var/lib/vibesonic/vibesonic.db" {
|
||||
t.Errorf("DBPath = %q, want default under DataDir", cfg.DBPath)
|
||||
}
|
||||
if cfg.ExtAuth.Enabled {
|
||||
t.Errorf("ExtAuth.Enabled = true, want false by default")
|
||||
}
|
||||
if len(cfg.ExtAuth.TrustedSources) != 0 {
|
||||
t.Errorf("ExtAuth.TrustedSources should be empty by default, got %v", cfg.ExtAuth.TrustedSources)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadMusicDirs(t *testing.T) {
|
||||
withEnv(t, map[string]string{"VIBESONIC_MUSIC_DIRS": "/music:/music-lossless: /audiobooks "})
|
||||
cfg, err := Load()
|
||||
if err != nil {
|
||||
t.Fatalf("Load: %v", err)
|
||||
}
|
||||
want := []string{"/music", "/music-lossless", "/audiobooks"}
|
||||
if len(cfg.MusicDirs) != len(want) {
|
||||
t.Fatalf("MusicDirs = %v, want %v", cfg.MusicDirs, want)
|
||||
}
|
||||
for i, w := range want {
|
||||
if cfg.MusicDirs[i] != w {
|
||||
t.Errorf("MusicDirs[%d] = %q, want %q", i, cfg.MusicDirs[i], w)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadInvalidScanInterval(t *testing.T) {
|
||||
withEnv(t, map[string]string{"VIBESONIC_SCAN_INTERVAL": "not-a-duration"})
|
||||
if _, err := Load(); err == nil {
|
||||
t.Fatal("expected error for invalid VIBESONIC_SCAN_INTERVAL")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadExtAuthTrustedSources(t *testing.T) {
|
||||
withEnv(t, map[string]string{
|
||||
"VIBESONIC_EXTAUTH_ENABLED": "true",
|
||||
"VIBESONIC_EXTAUTH_TRUSTED_SOURCES": "127.0.0.1/32, 10.0.0.0/8, ::1",
|
||||
})
|
||||
cfg, err := Load()
|
||||
if err != nil {
|
||||
t.Fatalf("Load: %v", err)
|
||||
}
|
||||
if !cfg.ExtAuth.Enabled {
|
||||
t.Fatal("ExtAuth.Enabled should be true")
|
||||
}
|
||||
if len(cfg.ExtAuth.TrustedSources) != 3 {
|
||||
t.Fatalf("TrustedSources = %v, want 3 entries", cfg.ExtAuth.TrustedSources)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadExtAuthInvalidCIDR(t *testing.T) {
|
||||
withEnv(t, map[string]string{"VIBESONIC_EXTAUTH_TRUSTED_SOURCES": "not-a-cidr"})
|
||||
if _, err := Load(); err == nil {
|
||||
t.Fatal("expected error for invalid VIBESONIC_EXTAUTH_TRUSTED_SOURCES")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadExtAuthNoDefaultTrust(t *testing.T) {
|
||||
// Regression guard: external auth must never trust anything unless a
|
||||
// network is explicitly configured. In particular it must not default
|
||||
// to 0.0.0.0/0 or RFC1918 ranges.
|
||||
cfg, err := Load()
|
||||
if err != nil {
|
||||
t.Fatalf("Load: %v", err)
|
||||
}
|
||||
if len(cfg.ExtAuth.TrustedSources) != 0 {
|
||||
t.Fatalf("expected no default trusted sources, got %v", cfg.ExtAuth.TrustedSources)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user