Make fresh Docker setup pull and enable TLS

README.md

@@ -71,6 +71,7 @@ The goal is to sleep soundly knowing the part of the internet you care about wil
 <pre lang="bash"><code style="white-space: pre-line"># Option A: Get ArchiveBox with Docker Compose (recommended):
 mkdir -p ~/archivebox/data && cd ~/archivebox
 curl -fsSL 'https://docker-compose.archivebox.io' > docker-compose.yml   # edit options in this file as-needed
+docker compose pull
 docker compose run archivebox init
 docker compose run archivebox install
 docker compose run archivebox manage createsuperuser
@@ -185,9 +186,11 @@ ArchiveBox is free for everyone to self-host, but we also provide support, secur
 <pre lang="bash"><code style="white-space: pre-line">mkdir -p ~/archivebox/data && cd ~/archivebox
 # Read and edit docker-compose.yml options as-needed after downloading
 curl -fsSL 'https://docker-compose.archivebox.io' > docker-compose.yml
+docker compose pull
 </code></pre></li>
 <li>Initialize the collection, then create an admin user (or set ADMIN_USERNAME/ADMIN_PASSWORD in docker-compose.yml)
 <pre lang="bash"><code style="white-space: pre-line">docker compose run archivebox init
+docker compose run archivebox install
 docker compose run archivebox manage createsuperuser
 </code></pre></li>
 <li>Next steps: Start the server then login to the Web UI <a href="http://archivebox.localhost:8000">http://archivebox.localhost:8000</a> ⇢ Admin.
@@ -269,7 +272,7 @@ archivebox version
 </li>
 <li>Create a new empty directory and initialize your collection (can be anywhere).
 <pre lang="bash"><code style="white-space: pre-line">mkdir -p ~/archivebox/data && cd ~/archivebox/data   # for example
-archivebox init     # instantialize a new collection
+archivebox init     # initialize a new collection
 archivebox install  # install all the runtime dependencies (e.g. chrome, single-file, yt-dlp, etc.)
 </code></pre>
 </li>

archivebox/tests/test_server_security_browser.py

@@ -724,6 +724,7 @@ def test_unconfigured_public_host_superuser_can_reach_setup_wizard(tmp_path: Pat
     archivebox_environment = compose["services"]["archivebox"]["environment"]
     assert "BASE_URL" in archivebox_environment
     assert "SERVER_SECURITY_MODE" in archivebox_environment
+    assert "--entrypoints.websecure.http.tls=true" in compose["services"]["traefik"]["entrypoint"][-1]
 
 
 def _run_wacz_preview_probe(

docker-compose.yml

@@ -1,7 +1,9 @@
 # Usage:
 #     mkdir -p ~/archivebox/data && cd ~/archivebox
 #     curl -fsSL 'https://docker-compose.archivebox.io' > docker-compose.yml
+#     docker compose pull
 #     docker compose run archivebox init
+#     docker compose run archivebox install
 #     docker compose up -d && open 'http://admin.archivebox.localhost:8000'
 
 #     docker compose run archivebox add --depth=1 'https://news.ycombinator.com'
@@ -210,6 +212,7 @@ services:
               set -- --entrypoints.web.address=:80 --entrypoints.websecure.address=:443 \
                 --entrypoints.web.http.redirections.entrypoint.to=websecure \
                 --entrypoints.web.http.redirections.entrypoint.scheme=https \
+                --entrypoints.websecure.http.tls=true \
                 --providers.file.filename=/etc/traefik/dynamic.yml
               if [ -n "$${ARCHIVEBOX_ACME_DNS:-}" ]; then
                 echo "[traefik] wildcard cert for *.$$DOMAIN via $$ARCHIVEBOX_ACME_DNS DNS-01"

docs/Docker.md

@@ -63,8 +63,11 @@ mkdir -p ~/archivebox/data && cd ~/archivebox
 curl -fsSL 'https://docker-compose.archivebox.io' > docker-compose.yml
 # (shortcut for getting https://raw.githubusercontent.com/ArchiveBox/ArchiveBox/dev/docker-compose.yml)
 
-# initialize your collection, then create an admin user for the Web UI (or set ADMIN_USERNAME/ADMIN_PASSWORD env vars)
+# pull the current image, initialize the collection, install runtime dependencies,
+# then create an admin user for the Web UI (or set ADMIN_USERNAME/ADMIN_PASSWORD env vars)
+docker compose pull
 docker compose run archivebox init
+docker compose run archivebox install
 docker compose run archivebox manage createsuperuser
 ```
 

docs/Publishing-Your-Archive.md

@@ -70,9 +70,7 @@ Legacy timestamp URLs remain available through compatibility symlinks, for examp
 > [!CAUTION]
 > Re-hosting untrusted archived content on the same origin as an authenticated application can compromise that application.
 
-Make sure you understand the dangers of [hosting untrusted HTML/JS/CSS](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). The default `SERVER_SECURITY_MODE=safe-subdomains-fullreplay` separates the admin, web, and API control planes from replay content, and gives each Snapshot its own replay subdomain. Admin cookies are scoped away from those replay origins.
-
-This mode requires wildcard DNS and TLS for `*.archive.example.com`. If your deployment cannot provide wildcard subdomains, use `SERVER_SECURITY_MODE=safe-onedomain-nojsreplay`, which keeps one origin but disables JavaScript replay.
+Make sure you understand the dangers of [hosting untrusted HTML/JS/CSS](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). The default `SERVER_SECURITY_MODE=auto` uses isolated subdomains with full replay on `*.localhost`, and a one-domain no-JS replay policy on ordinary public or LAN hostnames. Choose `safe-subdomains-fullreplay` only when wildcard DNS and TLS for `*.archive.example.com` are configured; it separates the admin, web, and API control planes from replay content and gives each Snapshot its own replay subdomain.
 
 Do not serve ArchiveBox from a shared subdirectory such as `myapps.example.com/archivebox/`; it cannot provide the required origin isolation. If you do not need JavaScript-capable replay, you can also disable the relevant extractors with `WGET_ENABLED=False` and `DOM_ENABLED=False`.
 

docs/Security-Overview.md

@@ -79,9 +79,7 @@ If you're importing private links or authenticated content, you probably don't w
 > [!CAUTION]
 > Re-hosting untrusted archived content on the same origin as an authenticated application can compromise that application.
 
-Make sure you understand the dangers of [hosting untrusted HTML/JS/CSS](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). The default `SERVER_SECURITY_MODE=safe-subdomains-fullreplay` separates admin, web, and API control-plane origins from replay content, and gives each Snapshot its own replay subdomain so archived JavaScript cannot share admin cookies.
-
-This mode requires wildcard DNS and TLS for your configured `BASE_URL`. If your deployment cannot provide wildcard subdomains, use `SERVER_SECURITY_MODE=safe-onedomain-nojsreplay`, which keeps one origin but disables JavaScript replay.
+Make sure you understand the dangers of [hosting untrusted HTML/JS/CSS](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). The default `SERVER_SECURITY_MODE=auto` uses isolated subdomains with full replay on `*.localhost`, and a one-domain no-JS replay policy on ordinary public or LAN hostnames. Choose `safe-subdomains-fullreplay` only when wildcard DNS and TLS are configured; it separates admin, web, and API control-plane origins from replay content and gives each Snapshot its own replay subdomain.
 
 Do not serve ArchiveBox from a shared subdirectory such as `myapps.example.com/archivebox/`; it cannot provide the required origin isolation.
 
@@ -106,21 +104,8 @@ More info:
 
 <img src="https://imgur.zervice.io/yDqJc4I.jpg" width="150px" align="right"/>
 
-> [!WARNING]
-> **Did you run a command in Docker with `exec` instead of `run` by accident and end up here?**  
-> Make sure you use `docker run` instead of `docker exec` to run ArchiveBox commands.  
->   
-> *For example:*  
-> ✅ `docker compose run archivebox manage createsuperuser`  
-> ✅ `docker run -it -v $PWD:/data archivebox/archivebox manage createsuperuser`  
-> (`docker run` automatically uses the correct `archivebox` user & file permissions enforced via [`./bin/docker_entrypoint.sh`](https://github.com/ArchiveBox/ArchiveBox/blob/dev/bin/docker_entrypoint.sh))  
->   
-> *instead of:*  
-> ❌ `docker compose exec archivebox manage createsuperuser`  
-> ❌ `docker exec -it archivebox manage createsuperuser`  
-> (`docker exec` will skip the [entrypoint](https://github.com/ArchiveBox/ArchiveBox/blob/dev/bin/docker_entrypoint.sh) and attempt to run everything as root and fail)  
->   
-> If you must use `exec` for some reason (e.g. if you only have access to a live container shell), you can run `su archivebox` within the shell, or add the arg `--user=archivebox` after `exec`.
+> [!NOTE]
+> Use `docker compose run archivebox ...` for normal one-shot CLI commands. `docker compose exec archivebox ...` is also supported against a running container; if it starts as root, ArchiveBox drops to the dedicated `archivebox` account before operating on the collection.
 
 ArchiveBox drops privileges to the collection owner when it starts as root and can do so safely, including in the official Docker image. Do not bypass that boundary or force runtime dependencies to stay privileged:
  - Browser sandboxing cannot provide its normal protection when the browser itself runs as root
@@ -128,13 +113,12 @@ ArchiveBox drops privileges to the collection owner when it starts as root and c
  - ArchiveBox does lots of HTML parsing, filesystem access, and shell command execution.  A bug in any one of those subsystems could potentially lead to deleted/damaged data on your hard drive, or full system compromise unless restricted to a user that only has permissions to access the directories needed
  - Do you really trust a project created by a Github user called `@pirate` 😉? Why give a random program off the internet root access to your entire system? (I don't have malicious intent, I'm just saying in principle you should not be running random Github projects as root)
 
-**Instead, you should run ArchiveBox under a separate user account with less privileged access:**
+**ArchiveBox creates and drops privileges to a dedicated `archivebox` account when run as root on Linux. Existing non-root users can run it directly:**
 ```bash
-useradd -r -g archivebox -G audio,video archivebox  # the audio & video groups are used by chrome
-mkdir -p /home/archivebox/data
-chown -R archivebox:archivebox /home/archivebox
-...
-sudo -u archivebox archivebox add ...
+mkdir -p ~/archivebox/data
+cd ~/archivebox/data
+archivebox init
+archivebox install
 ```
 
 <img src="https://imgur.zervice.io/ca1he6I.png" width="40px" align="right"/>