f1f7a143 · permissionBRICK/SillyTavern

default/config.yaml+2 -0 Viewed

 whitelist:
   - ::1
   - 127.0.0.1
+# Automatically whitelist Docker host and gateway IPs
+whitelistDockerHosts: true
 # Toggle basic authentication for endpoints
 basicAuthMode: false
 # Basic authentication credentials

docker/docker-compose.yml+3 -1 Viewed

-version: "3"
 services:
   sillytavern:
     build: ..
     container_name: sillytavern
     hostname: sillytavern
     image: ghcr.io/sillytavern/sillytavern:latest
+    environment:
+      - NODE_ENV=production
+      - FORCE_COLOR=1
     ports:
       - "8000:8000"
     volumes:

docker/docker-entrypoint.sh+3 -0 Viewed

     cp -r "default/config.yaml" "config/config.yaml"
 fi
+# Execute postinstall to auto-populate config.yaml with missing values
+npm run postinstall
 # Start the server
 exec node server.js --listen "$@"

server.js+7 -4 Viewed

 import getWebpackServeMiddleware from './src/middleware/webpack-serve.js';
 import basicAuthMiddleware from './src/middleware/basicAuth.js';
-import whitelistMiddleware from './src/middleware/whitelist.js';
+import getWhitelistMiddleware from './src/middleware/whitelist.js';
 import accessLoggerMiddleware, { getAccessLogPath, migrateAccessLog } from './src/middleware/accessLogWriter.js';
 import multerMonkeyPatch from './src/middleware/multerMonkeyPatch.js';
 import initRequestProxy from './src/request-proxy.js';

@@ -125,7 +125,8 @@ if (cliArgs.listen && cliArgs.basicAuthMode) {
125	}	125	}
126		126
127	if (cliArgs.whitelistMode) {	127	if (cliArgs.whitelistMode) {
128	app.use(whitelistMiddleware());	128	const whitelistMiddleware = await getWhitelistMiddleware();
		129	app.use(whitelistMiddleware);
129	}	130	}
130		131
131	if (cliArgs.listen) {	132	if (cliArgs.listen) {

     // Print formatted header
     console.log();
     console.log(`SillyTavern ${version.pkgVersion}`);
-    console.log(version.gitBranch ? `Running '${version.gitBranch}' (${version.gitRevision}) - ${version.commitDate}` : '');
+    if (version.gitBranch) {
-    if (version.gitBranch && !version.isLatest && ['staging', 'release'].includes(version.gitBranch)) {
+        console.log(`Running '${version.gitBranch}' (${version.gitRevision}) - ${version.commitDate}`);
+        if (!version.isLatest && ['staging', 'release'].includes(version.gitBranch)) {
             console.log('INFO: Currently not on the latest commit.');
             console.log('      Run \'git pull\' to update. If you have any merge conflicts, run \'git reset --hard\' and \'git pull\' to reset your branch.');
+        }
+    }
     console.log();
     const directories = await getUserDirectoriesList();

src/middleware/whitelist.js+31 -3 Viewed

 import path from 'node:path';
 import fs from 'node:fs';
 import process from 'node:process';
+import dns from 'node:dns';
 import Handlebars from 'handlebars';
 import ipMatching from 'ip-matching';
+import isDocker from 'is-docker';
 import { getIpFromRequest } from '../express-common.js';
 import { color, getConfigValue, safeReadFileSync } from '../util.js';
 const whitelistPath = path.join(process.cwd(), './whitelist.txt');
-const enableForwardedWhitelist = getConfigValue('enableForwardedWhitelist', false, 'boolean');
+const enableForwardedWhitelist = !!getConfigValue('enableForwardedWhitelist', false, 'boolean');
+const whitelistDockerHosts = !!getConfigValue('whitelistDockerHosts', true, 'boolean');
+/** @type {string[]} */
 let whitelist = getConfigValue('whitelist', []);
 if (fs.existsSync(whitelistPath)) {

+}
 /**
+ * Resolves the IP addresses of Docker hostnames and adds them to the whitelist.
+ * @returns {Promise<void>} Promise that resolves when the Docker hostnames are resolved
+ */
+async function addDockerHostsToWhitelist() {
+    if (!whitelistDockerHosts || !isDocker()) {
+        return;
+    }
+    const whitelistHosts = ['host.docker.internal', 'gateway.docker.internal'];
+    for (const entry of whitelistHosts) {
+        try {
+            const result = await dns.promises.lookup(entry);
+            console.info(`Resolved whitelist hostname ${color.green(entry)} to IPv${result.family} address ${color.green(result.address)}`);
+            whitelist.push(result.address);
+        } catch (e) {
+            console.warn(`Failed to resolve whitelist hostname ${color.red(entry)}: ${e.message}`);
+        }
+    }
+}
+/**
  * Returns a middleware function that checks if the client IP is in the whitelist.
- * @returns {import('express').RequestHandler} The middleware function
+ * @returns {Promise<import('express').RequestHandler>} Promise that resolves to the middleware function
  */
-export default function whitelistMiddleware() {
+export default async function getWhitelistMiddleware() {
     const forbiddenWebpage = Handlebars.compile(
         safeReadFileSync('./public/error/forbidden-by-whitelist.html') ?? '',
     );

         '/favicon.ico',
     ];
+    await addDockerHostsToWhitelist();
     return function (req, res, next) {
         const clientIp = getIpFromRequest(req);
         const forwardedIp = getForwardedIp(req);

src/users.js+0 -1 Viewed

  */
 export async function initUserStorage(dataRoot) {
     console.log('Using data root:', color.green(dataRoot));
-    console.log();
     await storage.init({
         dir: path.join(dataRoot, '_storage'),
         ttl: false, // Never expire

Merge pull request #3578 from SillyTavern/whitelist-hosts Whitelist Docker hosts