From 07d2b07fab0e5c237008e20f208c4afbb2fc4857 Mon Sep 17 00:00:00 2001 From: John Cardinal Date: Sat, 24 Oct 2026 22:30:31 -0700 Subject: [PATCH] case 4727 - remove the unused Docker option dist/docker (a runtime dockerfile and a compose file that published PostgreSQL with a fixed password) was from early development and never offered. Removed with its commented-out lines in build-release.bat and the BUILD.md mention; the build-environment Dockerfiles for the docs and the client stay. F38 (4727 step 7, the last step). Co-Authored-By: Claude Opus 5.5 --- build-release.bat | 11 ----- devdocs/build/BUILD.md | 3 +- devdocs/modernization/NET10-PORT.md | 2 +- devdocs/modernization/SECURITY-REVIEW.md | 2 +- .../docker/linux-x64/ayanovadocker/dockerfile | 15 ------- dist/docker/linux-x64/docker-compose.yml | 44 ------------------- 6 files changed, 3 insertions(+), 74 deletions(-) delete mode 100644 dist/docker/linux-x64/ayanovadocker/dockerfile delete mode 100644 dist/docker/linux-x64/docker-compose.yml diff --git a/build-release.bat b/build-release.bat index 3d074803..aa1c6a2e 100644 --- a/build-release.bat +++ b/build-release.bat @@ -79,17 +79,6 @@ set m=BUILD PERPETUAL LINUX x64 FAILED goto FAIL ) -@REM ### DISCONTINUED INDEFINITELY ### -@REM rem LINUX DOCKER -@REM rmdir C:\data\code\raven\dist\docker\linux-x64\ayanovadocker\files /s/q -@REM mkdir C:\data\code\raven\dist\docker\linux-x64\ayanovadocker\files -@REM xcopy C:\data\code\raven\dist\linux-x64\* C:\data\code\raven\dist\docker\linux-x64\ayanovadocker\files /s /e -@REM "C:\Program Files\7-Zip\7z.exe" a -tzip "C:\data\code\raven\dist\installers\ayanova-linux-docker-x64-server.zip" "C:\data\code\raven\dist\docker\linux-x64\*" -r -@REM IF %ERRORLEVEL% NEQ 0 ( -@REM set m=BUILD LINUX x64 DOCKER ZIP FAILED -@REM goto FAIL -@REM ) - rem LINUX DESKTOP "C:\Program Files\7-Zip\7z.exe" a -tzip "C:\data\code\raven\dist\installers\ayanova-linux-x64-desktop.zip" "C:\data\code\raven\dist\linux-x64\*" -r "C:\Program Files\7-Zip\7z.exe" a -tzip "C:\data\code\raven\dist\installers\ayanova-linux-x64-desktop.zip" "C:\data\code\raven\dist\assets\linux-desktop\config.json" diff --git a/devdocs/build/BUILD.md b/devdocs/build/BUILD.md index f70dcbec..e5e79720 100644 --- a/devdocs/build/BUILD.md +++ b/devdocs/build/BUILD.md @@ -131,8 +131,7 @@ Set in five places for every release: ## Docker builds `raven-client\ayanova\Dockerfile.frontend` and `raven\Dockerfile.docs` build the front end -and the manual in containers. A runtime image and compose file for the Linux server are in -`raven\dist\docker\linux-x64\`. The Linux server packages and the Windows +and the manual in containers. The Linux server packages and the Windows framework-dependent build could also build in Docker. Windows self-contained builds, Inno Setup, QBI and the embedded PostgreSQL need Windows. diff --git a/devdocs/modernization/NET10-PORT.md b/devdocs/modernization/NET10-PORT.md index 3395f7b3..2c270057 100644 --- a/devdocs/modernization/NET10-PORT.md +++ b/devdocs/modernization/NET10-PORT.md @@ -193,7 +193,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s | 4724 | SMTP: certificate checked, password never returned | F30, F31. **Done** (certificate checked, opt-out config setting `AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE` with manual page; password masked as `********` and kept on save; test `SmtpPasswordHidden`; self-signed listener proof; changelog lines for both) | | 4725 | Sessions: password change ends sessions, exact-path token exemption, default SuperUser refused when licensed | F7, F8, F9. **Done** (sessions end on reset, administrator password change and login disabled; exact route exemption, inactive users refused; default-password SuperUser limited to changing it on a purchased licence, option A; test `Sessions`; John's click-through with a temporary licence override; manual and changelog) | | 4726 | Login throttling/lockout (raven and sockeye) | F6. **Done** (10 failures per login or 50 per address in 15 minutes, then 429 for the rest of the window; same in Sockeye, whose login is public; test `LoginLockout`; per-address limit proved with a forwarded documentation address) | -| 4727 | Low severity hardening | F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously). In steps: 1 logo (F23) **done**; 2 API root page (F11, F39) **done**; 3 `server-info` (F29) **done**; 4 template export (F22) **done**, job owner check accepted; 5 `OverrideUserId` and export download (F25) **done**; 6 safe headers (F35) **done**; 7 remove `dist/docker` (F38) | +| 4727 | Low severity hardening | F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously). In steps: 1 logo (F23) **done**; 2 API root page (F11, F39) **done**; 3 `server-info` (F29) **done**; 4 template export (F22) **done**, job owner check accepted; 5 `OverrideUserId` and export download (F25) **done**; 6 safe headers (F35) **done**; 7 remove `dist/docker` (F38) **done**. All steps done; outside this repo, for `sockeye-client`: bind `127.0.0.1`, the `chmod`, the systemd options (F36, F38) | | 4681 | Sockeye: licence/trial request hardening (tagged sockeye, rockfish) | F40. **Done** (sockeye `cd3ebed`: rate limits, email check, cryptographic codes; rvf unchanged) | **From the port and earlier triage** diff --git a/devdocs/modernization/SECURITY-REVIEW.md b/devdocs/modernization/SECURITY-REVIEW.md index a62decc8..b74b33f0 100644 --- a/devdocs/modernization/SECURITY-REVIEW.md +++ b/devdocs/modernization/SECURITY-REVIEW.md @@ -780,7 +780,7 @@ prepared database, so it is not that short: accepted. superuser password. It is not built (`build-release.bat` lines are commented out) or documented; delete it or fix it before anyone uses it. -**John, 2026-10-24:** the `chmod` and the systemd sandboxing options go into the `sockeye-client` setup script (to do there; the systemd options need testing on a droplet so nothing that writes, such as logs, backups or the report browser download, is blocked). `dist/docker`: early development option, never offered: removed in case 4727. +**John, 2026-10-24:** the `chmod` and the systemd sandboxing options go into the `sockeye-client` setup script (to do there; the systemd options need testing on a droplet so nothing that writes, such as logs, backups or the report browser download, is blocked). `dist/docker`: early development option, never offered: removed in case 4727, step 7 (2026-10-24; with its commented-out lines in `build-release.bat`; git history keeps it). OK in pass 10: the setup script generates a unique database password and JWT secret per droplet, stores them in `/root/ayanova-secrets.txt` (600), makes `config.json` 640 `root:www-data`, diff --git a/dist/docker/linux-x64/ayanovadocker/dockerfile b/dist/docker/linux-x64/ayanovadocker/dockerfile deleted file mode 100644 index c89094ba..00000000 --- a/dist/docker/linux-x64/ayanovadocker/dockerfile +++ /dev/null @@ -1,15 +0,0 @@ -FROM mcr.microsoft.com/dotnet/aspnet:6.0-alpine -WORKDIR /app -COPY ./files . -RUN apk add libgdiplus --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing/ -RUN apk add postgresql-client -RUN apk add --no-cache \ - chromium \ - nss \ - freetype \ - freetype-dev \ - harfbuzz \ - ca-certificates \ - ttf-freefont - -ENTRYPOINT ["dotnet", "AyaNova.dll"] diff --git a/dist/docker/linux-x64/docker-compose.yml b/dist/docker/linux-x64/docker-compose.yml deleted file mode 100644 index f1bcbb83..00000000 --- a/dist/docker/linux-x64/docker-compose.yml +++ /dev/null @@ -1,44 +0,0 @@ -version: '2' - -services: - - - postgresserver: - image: postgres:alpine - restart: always - ports: - - 5432:5432 - environment: - POSTGRES_PASSWORD: letmein - volumes: - - /var/lib/ayanova/db:/var/lib/postgresql/data - - ayanova: - image: gztw/ayanova:v8.0.0 - init: true - restart: always - ports: - - 7575:7575 - volumes: - - /var/lib:/var/lib - environment: - AYANOVA_USE_URLS: http://*:7575 - AYANOVA_DB_CONNECTION: User ID=postgres;Password=letmein;Host=postgresserver;Port=5432;Database=AyaNova;Pooling=true;CommandTimeout=90; - AYANOVA_ATTACHMENT_FILES_PATH: /var/lib/ayanova/files/user - AYANOVA_BACKUP_FILES_PATH: /var/lib/ayanova/files/backup - AYANOVA_TEMP_FILES_PATH: /var/lib/ayanova/files/temp - AYANOVA_LOG_PATH: /var/lib/ayanova - AYANOVA_LOG_LEVEL: Info - AYANOVA_REPORT_RENDER_BROWSER_PATH: /usr/bin/chromium-browser - build: - context: ./ayanovadocker - dockerfile: Dockerfile - links: - - postgresserver - depends_on: - - "postgresserver" - -networks: - default: - external: - name: docker-network