Merge pull request #3578 from SillyTavern/whitelist-hosts Whitelist Docker hosts

f1f7a14349fa14b25d488d570deb8f19bb5f0354

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

default/config.yaml+2 -0 Viewed

 whitelist:
   - ::1
   - 127.0.0.1
 +# Automatically whitelist Docker host and gateway IPs
 +whitelistDockerHosts: true
 # Toggle basic authentication for endpoints
 basicAuthMode: false
 # Basic authentication credentials

docker/docker-compose.yml+3 -1 Viewed

 -version: "3"
 services:
   sillytavern:
     build: ..
     container_name: sillytavern
     hostname: sillytavern
     image: ghcr.io/sillytavern/sillytavern:latest
 +    environment:
 +      - NODE_ENV=production
 +      - FORCE_COLOR=1
     ports:
       - "8000:8000"
     volumes:

docker/docker-entrypoint.sh+3 -0 Viewed

     cp -r "default/config.yaml" "config/config.yaml"
 fi
 +# Execute postinstall to auto-populate config.yaml with missing values
 +npm run postinstall
++
 # Start the server
 exec node server.js --listen "$@"

server.js+9 -6 Viewed

 import getWebpackServeMiddleware from './src/middleware/webpack-serve.js';
 import basicAuthMiddleware from './src/middleware/basicAuth.js';
 import whitelistMiddlewaregetWhitelistMiddleware from './src/middleware/whitelist.js';
 import accessLoggerMiddleware, { getAccessLogPath, migrateAccessLog } from './src/middleware/accessLogWriter.js';
 import multerMonkeyPatch from './src/middleware/multerMonkeyPatch.js';
 import initRequestProxy from './src/request-proxy.js';

@@ -125,7 +125,8 @@ if (cliArgs.listen && cliArgs.basicAuthMode) {
125	125	}
126	126
127	127	if (cliArgs.whitelistMode) {
128		- app.use(whitelistMiddleware());
	128	+ const whitelistMiddleware = await getWhitelistMiddleware();
	129	+ app.use(whitelistMiddleware);
129	130	}
130	131
131	132	if (cliArgs.listen) {

     // Print formatted header
     console.log();
     console.log(`SillyTavern ${version.pkgVersion}`);
 -    console.log(version.gitBranch ? `Running '${version.gitBranch}' (${version.gitRevision}) - ${version.commitDate}` : '');
 +    if (version.gitBranch) {
 -    if (version.gitBranch && !version.isLatest && ['staging', 'release'].includes(version.gitBranch)) {
 +        console.log(`Running '${version.gitBranch}' (${version.gitRevision}) - ${version.commitDate}`);
 -        console.log('INFO: Currently not on the latest commit.');
 +        if (!version.isLatest && ['staging', 'release'].includes(version.gitBranch)) {
 -        console.log('      Run \'git pull\' to update. If you have any merge conflicts, run \'git reset --hard\' and \'git pull\' to reset your branch.');
 +            console.log('INFO: Currently not on the latest commit.');
 +            console.log('      Run \'git pull\' to update. If you have any merge conflicts, run \'git reset --hard\' and \'git pull\' to reset your branch.');
 +        }
+    }
     console.log();

src/middleware/whitelist.js+31 -3 Viewed

 import path from 'node:path';
 import fs from 'node:fs';
 import process from 'node:process';
 +import dns from 'node:dns';
 import Handlebars from 'handlebars';
 import ipMatching from 'ip-matching';
 +import isDocker from 'is-docker';
 import { getIpFromRequest } from '../express-common.js';
 import { color, getConfigValue, safeReadFileSync } from '../util.js';
 const whitelistPath = path.join(process.cwd(), './whitelist.txt');
 const enableForwardedWhitelist = !!getConfigValue('enableForwardedWhitelist', false, 'boolean');
 +const whitelistDockerHosts = !!getConfigValue('whitelistDockerHosts', true, 'boolean');
 +/** @type {string[]} */
 let whitelist = getConfigValue('whitelist', []);
 if (fs.existsSync(whitelistPath)) {

+}
 /**
 + * Resolves the IP addresses of Docker hostnames and adds them to the whitelist.
 + * @returns {Promise<void>} Promise that resolves when the Docker hostnames are resolved
 + */
 +async function addDockerHostsToWhitelist() {
 +    if (!whitelistDockerHosts || !isDocker()) {
 +        return;
 +    }
++
 +    const whitelistHosts = ['host.docker.internal', 'gateway.docker.internal'];
++
 +    for (const entry of whitelistHosts) {
 +        try {
 +            const result = await dns.promises.lookup(entry);
 +            console.info(`Resolved whitelist hostname ${color.green(entry)} to IPv${result.family} address ${color.green(result.address)}`);
 +            whitelist.push(result.address);
 +        } catch (e) {
 +            console.warn(`Failed to resolve whitelist hostname ${color.red(entry)}: ${e.message}`);
 +        }
 +    }
 +}
++
 +/**
  * Returns a middleware function that checks if the client IP is in the whitelist.
  * @returns {Promise<import('express').RequestHandler>} ThePromise that resolves to the middleware function
  */
 export default async function whitelistMiddlewaregetWhitelistMiddleware() {
     const forbiddenWebpage = Handlebars.compile(
         safeReadFileSync('./public/error/forbidden-by-whitelist.html') ?? '',
     );

         '/favicon.ico',
     ];
 +    await addDockerHostsToWhitelist();
++
     return function (req, res, next) {
         const clientIp = getIpFromRequest(req);
         const forwardedIp = getForwardedIp(req);

src/users.js+0 -1 Viewed

  */
 export async function initUserStorage(dataRoot) {
     console.log('Using data root:', color.green(dataRoot));
 -    console.log();
     await storage.init({
         dir: path.join(dataRoot, '_storage'),
         ttl: false, // Never expire