Skip to content

Conversation

@randshell
Copy link

@randshell randshell commented Jan 15, 2026

This work has been done as part of @BeDefended.

This is an attempt to revive the project by fixing a few known issues. Summary of updates:

  • The missing env vars are added from Is there a dev.env template missing? #36 (comment).
  • Fixed local storage for screenshots, similar to Update api.js and docker-compose.yml #47 (comment).
  • The google OAuth was disabled to make it easier to deploy this in a single user scenario with no need to rely on a google account. Just click on login button and the session will be automatically created.
  • Due to the previous point, the admin control panel and the public XSS API are now running on separate ports, so that it's possible to firewall the control panel off.
  • The new env file to edit is .env and is, as such, hidden.
  • Email sending switched back from SendGrid to SMTP

Compared to the last MR #62, a few more fixes have been done. Moreover, I've tested the whole MR in a production environment, thus with TLS certificate and email sending functionality, and it should work. The README however needs updating, but reading the comments in the ENV files and Docker compose should already hint at what needs to be adjusted before deploying. Also, these changes are meant for a rootless Docker install, which is the only scenario where this has been tested.

Known bugs / todos:

  • The login page is still present, even though it's not needed now.
  • TLS certificate needs to be already present as there's no scripts to facilitate that (yet?).
  • Vanilla install: no cloud storage tested.

- fix volumes tag
- increase healthcheck interval
- pin postgres to v16
- remove version tag
- fix volumes tag
- increase healthcheck interval
- pin postgres to v16
- remove version tag
# Conflicts:
#	config.env
#	docker-compose.yml
shouldn't be needed since we have the control panel on a different port
Also add file access permissions
@randshell randshell requested a review from a team as a code owner January 15, 2026 14:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant