pushed new svg

added configuration over https / http
2025-12-01 06:55:45 +01:00 · 2025-11-01 18:25:36 +01:00 · 2025-11-01 17:54:12 +01:00
7 changed files with 288 additions and 26 deletions
--- a/.env.template
+++ b/.env.template
@@ -1,27 +1,29 @@
-# === SCHICHTPLANER DOCKER COMPOSE ENVIRONMENT VARIABLES ===
+# .env.template
-# Diese Datei wird von docker-compose automatisch geladen
+# ============================================
 # DOCKER COMPOSE ENVIRONMENT TEMPLATE
 # Copy this file to .env and adjust values
 # ============================================
-# Security
+# Application settings
-JWT_SECRET=${JWT_SECRET:-your-secret-key-please-change}
+NODE_ENV=production
-NODE_ENV=${NODE_ENV:-production}
+JWT_SECRET=your-secret-key-please-change
 HOSTNAME=localhost
 # Security & Network
 TRUST_PROXY_ENABLED=false
 TRUSTED_PROXY_IPS=127.0.0.1,::1
 FORCE_HTTPS=false
 # Database
-DB_PATH=${DB_PATH:-/app/data/database.db}
+DATABASE_PATH=/app/data/schichtplaner.db
-# Server
+# Optional features
-PORT=${PORT:-3002}
+ENABLE_PRO=false
 DEBUG=false
-# App Configuration
+# Port configuration
-APP_TITLE="Shift Planning App"
+APP_PORT=3002
 ENABLE_PRO=${ENABLE_PRO:-false}
-# Trust Proxy Configuration
+# ============================================
-TRUST_PROXY_ENABLED=false
+# END OF TEMPLATE
-TRUSTED_PROXY_IPS=  # Your load balancer/reverse proxy IPs
+# ============================================
 TRUSTED_PROXY_HEADER=x-forwarded-for
 # Rate Limiting Configuration  
 RATE_LIMIT_WINDOW_MS=900000
 RATE_LIMIT_MAX_REQUESTS=100
 RATE_LIMIT_SKIP_PATHS=/api/health,/api/status
 RATE_LIMIT_WHITELIST=127.0.0.1,::1
--- a/backend/src/server.ts
+++ b/backend/src/server.ts
@@ -113,6 +113,21 @@ const configureTrustProxy = (): string | string[] | boolean | number => {
 app.set('trust proxy', configureTrustProxy());
 app.use((req, res, next) => {
  const protocol = req.headers['x-forwarded-proto'] || req.protocol;
  const isHttps = protocol === 'https';
  // Add security warning for HTTP requests
  if (!isHttps && process.env.NODE_ENV === 'production') {
    res.setHeader('X-Security-Warning', 'This application is being accessed over HTTP. For secure communication, please use HTTPS.');
    // Log HTTP access in production
    console.warn(`⚠️  HTTP access detected: ${req.method} ${req.path} from ${req.ip}`);
  }
  next();
 });
 // Security headers
 app.use(helmet({
  contentSecurityPolicy: {
@@ -126,6 +141,7 @@ app.use(helmet({
      objectSrc: ["'none'"],
      mediaSrc: ["'self'"],
      frameSrc: ["'none'"],
      upgradeInsecureRequests: process.env.FORCE_HTTPS === 'true' ? [] : null
    },
  },
  hsts: {
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,17 +6,22 @@ services:
    image: ghcr.io/donpat1to/schichtenplaner:v1.0.0
    environment:
      - NODE_ENV=production
-      - JWT_SECRET=${JWT_SECRET:-your-secret-key-please-change}
+      - JWT_SECRET=${JWT_SECRET}
-    ports:
+      - TRUST_PROXY_ENABLED=true
-      - "3002:3002"
+      - TRUSTED_PROXY_IPS=nginx-proxy,172.0.0.0/8,10.0.0.0/8,192.168.0.0/16
      - FORCE_HTTPS=${FORCE_HTTPS:-false}
    networks:
      - app-network
    volumes:
      - app_data:/app/data
    restart: unless-stopped
    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3002/api/health"]
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3002/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    expose:
      - "3002"
 volumes:
  app_data:
--- a/frontend/donpat1to.svg
+++ b/frontend/donpat1to.svg
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -2,7 +2,7 @@
 <html lang="en">
  <head>
    <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
+    <link rel="icon" type="image/svg+xml" href="/donpat1to.svg" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Shift Planning App</title>
  </head>
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -16,6 +16,7 @@ import Settings from './pages/Settings/Settings';
 import Help from './pages/Help/Help';
 import Setup from './pages/Setup/Setup';
 import ErrorBoundary from './components/ErrorBoundary/ErrorBoundary';
 import SecurityWarning from './components/SecurityWarning/SecurityWarning';
 // Free Footer Link Pages (always available)
 import FAQ from './components/Layout/FooterLinks/FAQ/FAQ';
@@ -165,6 +166,7 @@ function App() {
      <NotificationProvider>
        <AuthProvider>
          <Router>
            <SecurityWarning />
            <NotificationContainer />
            <AppContent />
          </Router>
--- a/frontend/src/components/SecurityWarning/SecurityWarning.tsx
+++ b/frontend/src/components/SecurityWarning/SecurityWarning.tsx
@@ -0,0 +1,59 @@
 // src/components/SecurityWarning/SecurityWarning.tsx
 import React, { useState, useEffect } from 'react';
 const SecurityWarning: React.FC = () => {
  const [isHttp, setIsHttp] = useState(false);
  const [isDismissed, setIsDismissed] = useState(false);
  useEffect(() => {
    // Check if current protocol is HTTP
    const checkProtocol = () => {
      setIsHttp(window.location.protocol === 'http:');
    };
    checkProtocol();
    window.addEventListener('load', checkProtocol);
    return () => window.removeEventListener('load', checkProtocol);
  }, []);
  if (!isHttp || isDismissed) {
    return null;
  }
  return (
    <div style={{
      position: 'fixed',
      top: 0,
      left: 0,
      right: 0,
      backgroundColor: '#ff6b35',
      color: 'white',
      padding: '10px 20px',
      textAlign: 'center',
      zIndex: 10000,
      fontSize: '14px',
      fontWeight: 'bold',
      boxShadow: '0 2px 4px rgba(0,0,0,0.2)'
    }}>
      ⚠️ SECURITY WARNING: This site is being accessed over HTTP. 
      For secure communication, please use HTTPS.
      <button 
        onClick={() => setIsDismissed(true)}
        style={{
          marginLeft: '15px',
          background: 'rgba(255,255,255,0.2)',
          border: '1px solid white',
          color: 'white',
          padding: '2px 8px',
          borderRadius: '3px',
          cursor: 'pointer'
        }}
      >
        Dismiss
      </button>
    </div>
  );
 };
 export default SecurityWarning;
Author	SHA1	Message	Date
donpat1to	da2b3b0126	pushed new svg	2025-11-01 18:25:36 +01:00
donpat1to	7a87c49703	added configuration over https / http	2025-11-01 17:54:12 +01:00