diff --git a/README.md b/README.md index 348db0b2..51343efa 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,7 @@ The goal is to sleep soundly knowing the part of the internet you care about wil 
# Option A: Get ArchiveBox with Docker Compose (recommended):
 mkdir -p ~/archivebox/data && cd ~/archivebox
 curl -fsSL 'https://docker-compose.archivebox.io' > docker-compose.yml   # edit options in this file as-needed
+docker compose pull
 docker compose run archivebox init
 docker compose run archivebox install
 docker compose run archivebox manage createsuperuser
@@ -185,9 +186,11 @@ ArchiveBox is free for everyone to self-host, but we also provide support, secur
 
mkdir -p ~/archivebox/data && cd ~/archivebox
 # Read and edit docker-compose.yml options as-needed after downloading
 curl -fsSL 'https://docker-compose.archivebox.io' > docker-compose.yml
+docker compose pull
 

 
  • Initialize the collection, then create an admin user (or set ADMIN_USERNAME/ADMIN_PASSWORD in docker-compose.yml)
 
    docker compose run archivebox init
+docker compose run archivebox install
 docker compose run archivebox manage createsuperuser
 
    • 
 
  • Next steps: Start the server then login to the Web UI http://archivebox.localhost:8000 ⇢ Admin.
@@ -269,7 +272,7 @@ archivebox version
 
    • 
 
  • Create a new empty directory and initialize your collection (can be anywhere).
 
    mkdir -p ~/archivebox/data && cd ~/archivebox/data   # for example
-archivebox init     # instantialize a new collection
+archivebox init     # initialize a new collection
 archivebox install  # install all the runtime dependencies (e.g. chrome, single-file, yt-dlp, etc.)
 
    
 
    • 
diff --git a/archivebox/tests/test_server_security_browser.py b/archivebox/tests/test_server_security_browser.py
index 6cf5a5b3..f23ee591 100644
--- a/archivebox/tests/test_server_security_browser.py
+++ b/archivebox/tests/test_server_security_browser.py
@@ -724,6 +724,7 @@ def test_unconfigured_public_host_superuser_can_reach_setup_wizard(tmp_path: Pat
     archivebox_environment = compose["services"]["archivebox"]["environment"]
     assert "BASE_URL" in archivebox_environment
     assert "SERVER_SECURITY_MODE" in archivebox_environment
+    assert "--entrypoints.websecure.http.tls=true" in compose["services"]["traefik"]["entrypoint"][-1]
 
 
 def _run_wacz_preview_probe(
diff --git a/docker-compose.yml b/docker-compose.yml
index 7ecc765f..442f24cb 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,9 @@
 # Usage:
 #     mkdir -p ~/archivebox/data && cd ~/archivebox
 #     curl -fsSL 'https://docker-compose.archivebox.io' > docker-compose.yml
+#     docker compose pull
 #     docker compose run archivebox init
+#     docker compose run archivebox install
 #     docker compose up -d && open 'http://admin.archivebox.localhost:8000'
 
 #     docker compose run archivebox add --depth=1 'https://news.ycombinator.com'
@@ -210,6 +212,7 @@ services:
               set -- --entrypoints.web.address=:80 --entrypoints.websecure.address=:443 \
                 --entrypoints.web.http.redirections.entrypoint.to=websecure \
                 --entrypoints.web.http.redirections.entrypoint.scheme=https \
+                --entrypoints.websecure.http.tls=true \
                 --providers.file.filename=/etc/traefik/dynamic.yml
               if [ -n "$${ARCHIVEBOX_ACME_DNS:-}" ]; then
                 echo "[traefik] wildcard cert for *.$$DOMAIN via $$ARCHIVEBOX_ACME_DNS DNS-01"
diff --git a/docs/Docker.md b/docs/Docker.md
index 71ed4a98..967804e5 100644
--- a/docs/Docker.md
+++ b/docs/Docker.md
@@ -63,8 +63,11 @@ mkdir -p ~/archivebox/data && cd ~/archivebox
 curl -fsSL 'https://docker-compose.archivebox.io' > docker-compose.yml
 # (shortcut for getting https://raw.githubusercontent.com/ArchiveBox/ArchiveBox/dev/docker-compose.yml)
 
-# initialize your collection, then create an admin user for the Web UI (or set ADMIN_USERNAME/ADMIN_PASSWORD env vars)
+# pull the current image, initialize the collection, install runtime dependencies,
+# then create an admin user for the Web UI (or set ADMIN_USERNAME/ADMIN_PASSWORD env vars)
+docker compose pull
 docker compose run archivebox init
+docker compose run archivebox install
 docker compose run archivebox manage createsuperuser
 ```
 
diff --git a/docs/Publishing-Your-Archive.md b/docs/Publishing-Your-Archive.md
index 2df75896..138a9329 100644
--- a/docs/Publishing-Your-Archive.md
+++ b/docs/Publishing-Your-Archive.md
@@ -70,9 +70,7 @@ Legacy timestamp URLs remain available through compatibility symlinks, for examp
 > [!CAUTION]
 > Re-hosting untrusted archived content on the same origin as an authenticated application can compromise that application.
 
-Make sure you understand the dangers of [hosting untrusted HTML/JS/CSS](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). The default `SERVER_SECURITY_MODE=safe-subdomains-fullreplay` separates the admin, web, and API control planes from replay content, and gives each Snapshot its own replay subdomain. Admin cookies are scoped away from those replay origins.
-
-This mode requires wildcard DNS and TLS for `*.archive.example.com`. If your deployment cannot provide wildcard subdomains, use `SERVER_SECURITY_MODE=safe-onedomain-nojsreplay`, which keeps one origin but disables JavaScript replay.
+Make sure you understand the dangers of [hosting untrusted HTML/JS/CSS](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). The default `SERVER_SECURITY_MODE=auto` uses isolated subdomains with full replay on `*.localhost`, and a one-domain no-JS replay policy on ordinary public or LAN hostnames. Choose `safe-subdomains-fullreplay` only when wildcard DNS and TLS for `*.archive.example.com` are configured; it separates the admin, web, and API control planes from replay content and gives each Snapshot its own replay subdomain.
 
 Do not serve ArchiveBox from a shared subdirectory such as `myapps.example.com/archivebox/`; it cannot provide the required origin isolation. If you do not need JavaScript-capable replay, you can also disable the relevant extractors with `WGET_ENABLED=False` and `DOM_ENABLED=False`.
 
diff --git a/docs/Security-Overview.md b/docs/Security-Overview.md
index 014ec8c8..e3476ee2 100644
--- a/docs/Security-Overview.md
+++ b/docs/Security-Overview.md
@@ -79,9 +79,7 @@ If you're importing private links or authenticated content, you probably don't w
 > [!CAUTION]
 > Re-hosting untrusted archived content on the same origin as an authenticated application can compromise that application.
 
-Make sure you understand the dangers of [hosting untrusted HTML/JS/CSS](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). The default `SERVER_SECURITY_MODE=safe-subdomains-fullreplay` separates admin, web, and API control-plane origins from replay content, and gives each Snapshot its own replay subdomain so archived JavaScript cannot share admin cookies.
-
-This mode requires wildcard DNS and TLS for your configured `BASE_URL`. If your deployment cannot provide wildcard subdomains, use `SERVER_SECURITY_MODE=safe-onedomain-nojsreplay`, which keeps one origin but disables JavaScript replay.
+Make sure you understand the dangers of [hosting untrusted HTML/JS/CSS](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). The default `SERVER_SECURITY_MODE=auto` uses isolated subdomains with full replay on `*.localhost`, and a one-domain no-JS replay policy on ordinary public or LAN hostnames. Choose `safe-subdomains-fullreplay` only when wildcard DNS and TLS are configured; it separates admin, web, and API control-plane origins from replay content and gives each Snapshot its own replay subdomain.
 
 Do not serve ArchiveBox from a shared subdirectory such as `myapps.example.com/archivebox/`; it cannot provide the required origin isolation.
 
@@ -106,21 +104,8 @@ More info:
 
 
 
-> [!WARNING]
-> **Did you run a command in Docker with `exec` instead of `run` by accident and end up here?**  
-> Make sure you use `docker run` instead of `docker exec` to run ArchiveBox commands.  
->   
-> *For example:*  
-> ✅ `docker compose run archivebox manage createsuperuser`  
-> ✅ `docker run -it -v $PWD:/data archivebox/archivebox manage createsuperuser`  
-> (`docker run` automatically uses the correct `archivebox` user & file permissions enforced via [`./bin/docker_entrypoint.sh`](https://github.com/ArchiveBox/ArchiveBox/blob/dev/bin/docker_entrypoint.sh))  
->   
-> *instead of:*  
-> ❌ `docker compose exec archivebox manage createsuperuser`  
-> ❌ `docker exec -it archivebox manage createsuperuser`  
-> (`docker exec` will skip the [entrypoint](https://github.com/ArchiveBox/ArchiveBox/blob/dev/bin/docker_entrypoint.sh) and attempt to run everything as root and fail)  
->   
-> If you must use `exec` for some reason (e.g. if you only have access to a live container shell), you can run `su archivebox` within the shell, or add the arg `--user=archivebox` after `exec`.
+> [!NOTE]
+> Use `docker compose run archivebox ...` for normal one-shot CLI commands. `docker compose exec archivebox ...` is also supported against a running container; if it starts as root, ArchiveBox drops to the dedicated `archivebox` account before operating on the collection.
 
 ArchiveBox drops privileges to the collection owner when it starts as root and can do so safely, including in the official Docker image. Do not bypass that boundary or force runtime dependencies to stay privileged:
  - Browser sandboxing cannot provide its normal protection when the browser itself runs as root
@@ -128,13 +113,12 @@ ArchiveBox drops privileges to the collection owner when it starts as root and c
  - ArchiveBox does lots of HTML parsing, filesystem access, and shell command execution.  A bug in any one of those subsystems could potentially lead to deleted/damaged data on your hard drive, or full system compromise unless restricted to a user that only has permissions to access the directories needed
  - Do you really trust a project created by a Github user called `@pirate` 😉? Why give a random program off the internet root access to your entire system? (I don't have malicious intent, I'm just saying in principle you should not be running random Github projects as root)
 
-**Instead, you should run ArchiveBox under a separate user account with less privileged access:**
+**ArchiveBox creates and drops privileges to a dedicated `archivebox` account when run as root on Linux. Existing non-root users can run it directly:**
 ```bash
-useradd -r -g archivebox -G audio,video archivebox  # the audio & video groups are used by chrome
-mkdir -p /home/archivebox/data
-chown -R archivebox:archivebox /home/archivebox
-...
-sudo -u archivebox archivebox add ...
+mkdir -p ~/archivebox/data
+cd ~/archivebox/data
+archivebox init
+archivebox install
 ```