The_Great_Archive/ArchiveBox
1
0
Fork 0
mirror of https://github.com/ArchiveBox/ArchiveBox.git synced 2026-09-14 11:06:13 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(proxy): make tunnel token readable by the cloudflared connector

Browse Source 
The cloudflared image runs as non-root (uid 65532), so a root-owned 0600 token
was unreadable by the connector. chown the token to 65532:65532 and keep 0600;
if tunnel-init isn't root (can't chown), fall back to 0644 so it stays readable.
This commit is contained in:
archivebox 2026-06-05 00:01:10 +00:00
parent 102a3ab4bc
commit d719fb6916
No known key found for this signature in database
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
docker-compose.yml
View File

@ -148,7 +148,10 @@ services:
desired = {"type": "CNAME", "name": name, "content": target, "proxied": True, "ttl": 1}
call("PUT", f"/zones/{zone}/dns_records/{cname[0]['id']}", desired) if cname else call("POST", f"/zones/{zone}/dns_records", desired)
tok = call("GET", f"/accounts/{acct}/cfd_tunnel/{tid}/token")["result"]
os.makedirs(os.path.dirname(OUT) or ".", exist_ok=True); open(OUT, "w").write(tok); os.chmod(OUT, 0o600)
os.makedirs(os.path.dirname(OUT) or ".", exist_ok=True)
with open(OUT, "w") as f: f.write(tok)
try: os.chown(OUT, 65532, 65532); os.chmod(OUT, 0o600) # own it by the cloudflared (uid 65532) reader, keep private
except PermissionError: os.chmod(OUT, 0o644) # tunnel-init not root: stay readable to the connector
print(f"[tunnel-init] {NAME} ({tid}): *.{DOMAIN} + {DOMAIN} -> {SERVICE}; connector token -> {OUT}")
cloudflared: