owenandClaude Sonnet 5
789bf91eed
Security: - New internal/netguard package: podcast feed/enclosure fetching now refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud metadata/CGNAT), validated per-connection including across redirects, closing an SSRF gap where a malicious or compromised feed URL could probe the server's internal network. Configurable via VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds. - Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk) - Cover art decoding now rejects images above a 40-megapixel budget before full decode (decompression-bomb guard) - HTTP server sets ReadHeaderTimeout (slowloris hardening) - Admin folder-scan redirect now validated as same-site instead of trusting the raw Referer header (open-redirect fix) - Legacy Subsonic token/salt auth now uses a constant-time comparison Web UI completion: - Persistent player: shuffle and repeat (off/all/one) controls, wired into queue advance/prev logic and persisted like other player state - Admin user-permissions form: adminRole toggle (with a guard against demoting the last remaining admin) and per-user music-folder access checkboxes, backed by existing schema/enforcement that was previously unreachable from the UI - Playlist M3U8 import/export Docs: added docs/client-compatibility.md (honest tracking template — no client testing has been performed), docs/deployment.md, docs/security.md, docs/backup.md; refreshed README and cross-links; added a footnote in docs/subsonic-compatibility.md distinguishing spec-standard from VibeSonic-original OpenSubsonic extensions. Also added Go fuzz tests for the external-auth CIDR/IP parser and the LRC lyrics parser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv
3.0 KiB
3.0 KiB
Configuration
VibeSonic is configured entirely through environment variables. There is
no separate config file — everything needed to run the server is
available via VIBESONIC_* variables, with sane defaults for everything
except the session secret.
| Variable | Default | Description |
|---|---|---|
VIBESONIC_LISTEN_ADDR |
:8080 |
HTTP listen address |
VIBESONIC_DATA_DIR |
/var/lib/vibesonic |
Directory for the database, resized cover-art cache, etc. |
VIBESONIC_DB |
<DATA_DIR>/vibesonic.db |
Path to the SQLite database file |
VIBESONIC_MUSIC_DIRS |
(none) | Colon-separated list of music folders to import on startup, e.g. /music:/music-lossless:/audiobooks. Additional folders can also be added later from the admin UI. |
VIBESONIC_FFMPEG_PATH |
ffmpeg (from PATH) |
Path to the ffmpeg binary |
VIBESONIC_FFPROBE_PATH |
ffprobe (from PATH) |
Path to the ffprobe binary |
VIBESONIC_MPV_PATH |
mpv (from PATH) |
Path to the mpv binary, used as the Subsonic jukebox's playback backend. If not found, the jukebox is administratively unavailable and jukeboxControl returns a clear error instead of a fake success. |
VIBESONIC_SCAN_INTERVAL |
1h |
How often to rescan enabled music folders, as a Go duration (30m, 6h, ...). A startup scan always runs regardless of this value. |
VIBESONIC_SESSION_SECRET |
(none) | Reserved for future use hardening session cookies beyond their database-backed random IDs. Not required to run, but recommended to set (e.g. openssl rand -hex 32) — VibeSonic logs a warning at startup if it's empty. |
VIBESONIC_COOKIE_SECURE |
true |
Whether session/CSRF cookies get the Secure attribute. Set to false only for local development over plain HTTP. |
VIBESONIC_ENABLE_EXTERNAL_METADATA |
false |
Enable optional MusicBrainz/Cover Art Archive lookups for songs/albums that already carry a locally-tagged MusicBrainz ID. VibeSonic works fully offline with this off; it's the only feature that makes outbound Internet requests. |
VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS |
false |
Allow podcast feed/enclosure URLs to resolve to loopback/LAN/link-local addresses. Leave this off unless you intentionally host podcast feeds on a private network — see docs/security.md. |
External authentication
See docs/external-auth.md for the full
VIBESONIC_EXTAUTH_* reference.
First run
On a database with no users yet, every request redirects to /setup,
which walks you through creating the administrator account and your
first music folder, detects ffmpeg/ffprobe, and kicks off the first
scan. VibeSonic never ships default credentials — the administrator
account only exists once you create it through this wizard.
Migrations
Schema migrations are embedded in the binary (migrations/*.sql) and
applied automatically on startup, tracked in a schema_migrations table.
There is nothing to run manually.