From fc7011d988aa8a597592e6fbd805a527282ecff9 Mon Sep 17 00:00:00 2001 From: archivebox Date: Fri, 5 Jun 2026 00:04:37 +0000 Subject: [PATCH] fix(proxy): drop 0644 token fallback; chown 0600 (tunnel-init runs as root) The archivebox image starts as root (privilege drop happens in its entrypoint, which tunnel-init overrides), so chown to the cloudflared uid always succeeds and the world-readable 0644 fallback was dead code that could leak the token. Always write the connector token owned by 65532:65532 with 0600. --- docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 63815899..1573da3f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -150,8 +150,8 @@ services: tok = call("GET", f"/accounts/{acct}/cfd_tunnel/{tid}/token")["result"] os.makedirs(os.path.dirname(OUT) or ".", exist_ok=True) with open(OUT, "w") as f: f.write(tok) - try: os.chown(OUT, 65532, 65532); os.chmod(OUT, 0o600) # own it by the cloudflared (uid 65532) reader, keep private - except PermissionError: os.chmod(OUT, 0o644) # tunnel-init not root: stay readable to the connector + os.chown(OUT, 65532, 65532) # tunnel-init runs as root; own the token by the cloudflared (uid 65532) reader + os.chmod(OUT, 0o600) # private: never world-readable on the host bind-mount print(f"[tunnel-init] {NAME} ({tid}): *.{DOMAIN} + {DOMAIN} -> {SERVICE}; connector token -> {OUT}") cloudflared: