dd3ec070f7
### Security-Fixes (K1–K6, W1–W4, W7, N1, N5–N6, V1, V5–V7)
- K1: CSRF-Schutz via Double-Submit-Cookie (httpapi/csrf.go + csrf_helpers.go)
- K2: requireScreenAccess() in allen manage-Handlern (Tenant-Isolation)
- K3: Tenant-Check bei DELETE /api/v1/media/{id}
- K4: requirePlaylistAccess() + GetByItemID() für JSON-API Playlist-Routen
- K5: Admin-Passwort nur noch als [gesetzt] geloggt
- K6: POST /api/v1/screens/register mit Pre-Shared-Secret (MORZ_INFOBOARD_REGISTER_SECRET)
- W1: Race Condition bei order_index behoben (atomare Subquery in AddItem)
- W2: Graceful Shutdown mit 15s Timeout auf SIGTERM/SIGINT
- W3: http.MaxBytesReader (512 MB) in allen Upload-Handlern
- W4: err.Error() nicht mehr an den Client
- W7: Template-Execution via bytes.Buffer (kein partial write bei Fehler)
- N1: Rate-Limiting auf /login (5 Versuche/Minute pro IP, httpapi/ratelimit.go)
- N5: Directory-Listing auf /uploads/ deaktiviert (neuteredFileSystem)
- N6: Uploads nach Tenant getrennt (uploads/{tenantSlug}/)
- V1: Upload-Logik konsolidiert in internal/fileutil/fileutil.go
- V5: Cookie-Name als Konstante reqcontext.SessionCookieName
- V6: Strukturiertes Logging mit log/slog + JSON-Handler
- V7: DB-Pool wird im Graceful-Shutdown geschlossen
### Phase 6: Screenshot-Erzeugung
- player/agent/internal/screenshot/screenshot.go erstellt
- Integration in app.go mit MORZ_INFOBOARD_SCREENSHOT_EVERY Config
### UX: PDF.js Integration
- pdf.min.js + pdf.worker.min.js als lokale Assets eingebettet
- Automatisches Seitendurchblättern im Player
### Ansible: Neue Rollen
- signage_base, signage_server, signage_provision erstellt
- inventory.yml und site.yml erweitert
### Konzept-Docs
- GRUPPEN-KONZEPT.md, KAMPAGNEN-AKTIVIERUNG.md, MONITORING-KONZEPT.md
- PROVISION-KONZEPT.md, TEMPLATE-EDITOR.md, WATCHDOG-KONZEPT.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
130 lines
3 KiB
YAML
130 lines
3 KiB
YAML
---
|
|
- name: Install Docker dependencies
|
|
ansible.builtin.apt:
|
|
name:
|
|
- ca-certificates
|
|
- curl
|
|
- gnupg
|
|
state: present
|
|
update_cache: true
|
|
become: true
|
|
|
|
- name: Create Docker apt keyring directory
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
become: true
|
|
|
|
- name: Add Docker GPG key
|
|
ansible.builtin.get_url:
|
|
url: https://download.docker.com/linux/debian/gpg
|
|
dest: /etc/apt/keyrings/docker.asc
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
|
|
- name: Add Docker apt repository
|
|
ansible.builtin.apt_repository:
|
|
repo: >-
|
|
deb [arch={{ ansible_architecture | replace('x86_64', 'amd64') | replace('aarch64', 'arm64') }}
|
|
signed-by=/etc/apt/keyrings/docker.asc]
|
|
https://download.docker.com/linux/debian
|
|
{{ ansible_distribution_release }} stable
|
|
state: present
|
|
filename: docker
|
|
become: true
|
|
|
|
- name: Install Docker Engine and Compose plugin
|
|
ansible.builtin.apt:
|
|
name:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
state: present
|
|
update_cache: true
|
|
become: true
|
|
|
|
- name: Ensure Docker service is enabled and running
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
enabled: true
|
|
state: started
|
|
become: true
|
|
|
|
- name: Create server deploy directory
|
|
ansible.builtin.file:
|
|
path: "{{ signage_server_deploy_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
become: true
|
|
|
|
- name: Create server data directory
|
|
ansible.builtin.file:
|
|
path: "{{ signage_server_data_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
become: true
|
|
|
|
- name: Create uploads directory
|
|
ansible.builtin.file:
|
|
path: "{{ signage_server_deploy_dir }}/uploads"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
become: true
|
|
|
|
- name: Deploy docker-compose.yml
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ signage_server_deploy_dir }}/docker-compose.yml"
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
become: true
|
|
notify: Restart morz-server stack
|
|
|
|
- name: Deploy server environment file
|
|
ansible.builtin.template:
|
|
src: env.j2
|
|
dest: "{{ signage_server_deploy_dir }}/.env"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
become: true
|
|
notify: Restart morz-server stack
|
|
|
|
- name: Allow HTTPS through ufw
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ signage_server_https_port }}"
|
|
proto: tcp
|
|
comment: morz-infoboard HTTPS
|
|
become: true
|
|
when: signage_server_ufw_enabled and signage_server_ufw_allow_https
|
|
|
|
- name: Allow MQTT through ufw
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ signage_server_mqtt_port }}"
|
|
proto: tcp
|
|
comment: morz-infoboard MQTT
|
|
become: true
|
|
when: signage_server_ufw_enabled and signage_server_ufw_allow_mqtt
|
|
|
|
- name: Pull and start morz-server stack
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ signage_server_deploy_dir }}"
|
|
state: present
|
|
pull: always
|
|
become: true
|