Spaces:

Jishnupg
/

Opencode-Cli

Running

App Files Files Community

Hermes Agent commited on Aug 14

Commit

42fc0fd

1 Parent(s): 20a21f0

security(hardening): enforce api key auth, dynamic secret fallbacks, and error log sanitization

Browse files

Files changed (4) hide show

entrypoint.sh +11 -11
gateway/omniroute.py +14 -29
gateway/utils.py +2 -21
tg_streamer.py +7 -0

entrypoint.sh CHANGED Viewed

@@ -29,22 +29,22 @@ chmod -R 777 /root/.cache /data/cache /data/hermes 2>/dev/null || true
 # ── STEP 1: Master Secret Validation ──────────────────────────────────────────
 if [ -z "$STORAGE_ENCRYPTION_KEY" ]; then
-    echo "[WARN] STORAGE_ENCRYPTION_KEY is not set in secrets; using local fallback."
-    export STORAGE_ENCRYPTION_KEY="omniroute_default_storage_key_32bytes"
 fi
 if [ -z "$JWT_SECRET" ]; then
-    echo "[WARN] JWT_SECRET is not set in secrets; using local fallback."
-    export JWT_SECRET="omniroute_default_jwt_secret_key_32bytes"
 fi
 if [ -z "$API_KEY_SECRET" ]; then
-    echo "[WARN] API_KEY_SECRET is not set in secrets; using local fallback."
-    export API_KEY_SECRET="omniroute_default_api_key_secret_32bytes"
 fi
 if [ -z "$INITIAL_PASSWORD" ]; then
-    echo "[WARN] INITIAL_PASSWORD is not set in secrets; using local fallback."
     export INITIAL_PASSWORD="admin123"
 fi
@@ -332,10 +332,10 @@ echo "[BOOT] Background services starting asynchronously..."
     export CLI_COMPAT_CURSOR=1
     export CLI_COMPAT_QWEN=1
     export OMNIROUTE_AUTO_FREE_FALLBACK_TO_FULL_POOL=true
-    export OMNIROUTE_ALLOW_UNAUTHENTICATED=true
-    export REQUIRE_API_KEY=false
-    export OMNIROUTE_REQUIRE_API_KEY=false
-    export OMNIROUTE_AUTH_REQUIRED=false
     if [ -d "/omniroute" ]; then
         cd /omniroute

 # ── STEP 1: Master Secret Validation ──────────────────────────────────────────
 if [ -z "$STORAGE_ENCRYPTION_KEY" ]; then
+    echo "[WARN] STORAGE_ENCRYPTION_KEY is not set in secrets; generating dynamic 32-hex key."
+    export STORAGE_ENCRYPTION_KEY=$(python3 -c "import secrets; print(secrets.token_hex(16))" 2>/dev/null || echo "omniroute_default_storage_key_32bytes")
 fi
 if [ -z "$JWT_SECRET" ]; then
+    echo "[WARN] JWT_SECRET is not set in secrets; generating dynamic 32-hex key."
+    export JWT_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(16))" 2>/dev/null || echo "omniroute_default_jwt_secret_key_32bytes")
 fi
 if [ -z "$API_KEY_SECRET" ]; then
+    echo "[WARN] API_KEY_SECRET is not set in secrets; generating dynamic 32-hex key."
+    export API_KEY_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(16))" 2>/dev/null || echo "omniroute_default_api_key_secret_32bytes")
 fi
 if [ -z "$INITIAL_PASSWORD" ]; then
+    echo "[WARN] INITIAL_PASSWORD is not set in secrets; using default admin password."
     export INITIAL_PASSWORD="admin123"
 fi
     export CLI_COMPAT_CURSOR=1
     export CLI_COMPAT_QWEN=1
     export OMNIROUTE_AUTO_FREE_FALLBACK_TO_FULL_POOL=true
+    export OMNIROUTE_ALLOW_UNAUTHENTICATED=false
+    export REQUIRE_API_KEY=true
+    export OMNIROUTE_REQUIRE_API_KEY=true
+    export OMNIROUTE_AUTH_REQUIRED=true
     if [ -d "/omniroute" ]; then
         cd /omniroute

gateway/omniroute.py CHANGED Viewed

@@ -77,43 +77,28 @@ async def handle_omniroute_proxy(target: str, request: Request, default_prefix:
     }
     res = await proxy_http_request(target, request, default_prefix=default_prefix, extra_headers=extra_auth, html_fixup=html_fixup)
     if res.status_code in (500, 502, 503) and request.method == "GET" and "html" in request.headers.get("accept", "").lower():
-        log_content = ""
-        for log_file in ["/data/omniroute/omniroute.log", "/root/.omniroute/omniroute.log"]:
-            try:
-                if os.path.exists(log_file):
-                    with open(log_file, "r", encoding="utf-8", errors="ignore") as f:
-                        lines = f.readlines()
-                        log_content = "".join(lines[-120:])
-                    if log_content:
-                        break
-            except Exception:
-                pass
-        if log_content:
-            print(f"[OMNIROUTE SERVER LOGS]\n{log_content}")
-            safe_logs = log_content.replace("\\", "\\\\").replace("`", "\\`").replace("$", "\\$")
-            diagnostic_html = f"""<!DOCTYPE html>
 <html>
 <head>
-    <title>OmniRoute Server Log Diagnostic</title>
     <style>
-        body {{ font-family: system-ui, monospace; background: #0f172a; color: #f8fafc; padding: 24px; max-width: 1000px; margin: 0 auto; }}
-        h1 {{ color: #f87171; font-size: 1.4rem; margin-top: 0; }}
-        p {{ color: #94a3b8; font-size: 0.95rem; }}
-        pre {{ background: #1e293b; padding: 16px; border-radius: 8px; overflow-x: auto; color: #38bdf8; border: 1px solid #334155; font-size: 0.85rem; line-height: 1.5; }}
     </style>
-    <script>
-        console.error("=== OMNIROUTE BACKEND LOGS ===");
-        console.error(`{safe_logs}`);
-    </script>
 </head>
 <body>
-    <h1>⚠️ OmniRoute Server Diagnostic ({res.status_code})</h1>
-    <p>Captured backend process logs for <code>{request.url.path}</code>:</p>
-    <pre>{log_content}</pre>
 </body>
 </html>"""
-            return HTMLResponse(content=diagnostic_html, status_code=res.status_code)
     return res
 # ── Dashboard & Admin UI Routes (20128) ──────────────────────────────────────

     }
     res = await proxy_http_request(target, request, default_prefix=default_prefix, extra_headers=extra_auth, html_fixup=html_fixup)
     if res.status_code in (500, 502, 503) and request.method == "GET" and "html" in request.headers.get("accept", "").lower():
+        diagnostic_html = f"""<!DOCTYPE html>
 <html>
 <head>
+    <title>OmniRoute Server Status</title>
     <style>
+        body {{ font-family: system-ui, -apple-system, sans-serif; background: #0f172a; color: #f8fafc; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; padding: 24px; }}
+        .card {{ background: #1e293b; border: 1px solid #334155; padding: 32px; border-radius: 12px; max-width: 500px; text-align: center; shadow: 0 10px 25px rgba(0,0,0,0.5); }}
+        h1 {{ color: #f87171; font-size: 1.4rem; margin: 0 0 12px; }}
+        p {{ color: #94a3b8; font-size: 0.95rem; line-height: 1.5; margin: 0 0 20px; }}
+        a {{ color: #38bdf8; text-decoration: none; font-weight: 600; }}
+        a:hover {{ text-decoration: underline; }}
     </style>
 </head>
 <body>
+    <div class="card">
+        <h1>⚠️ OmniRoute Service Temporarily Unavailable</h1>
+        <p>OmniRoute backend is currently initializing or completing a background task. Status code: {res.status_code}.</p>
+        <p><a href="/dashboard">Reload Dashboard &rarr;</a></p>
+    </div>
 </body>
 </html>"""
+        return HTMLResponse(content=diagnostic_html, status_code=res.status_code)
     return res
 # ── Dashboard & Admin UI Routes (20128) ──────────────────────────────────────

gateway/utils.py CHANGED Viewed

@@ -179,23 +179,6 @@ async def proxy_http_request(
                 continue
             if method in ("GET", "HEAD") and ("html" in request.headers.get("accept", "").lower() or request.url.path in ("/", "/index.html", "/healthz", "/health", "/omniroute", "/dashboard", "/jellyfin") or request.url.path.startswith("/dashboard") or request.url.path.startswith("/omniroute") or request.url.path.startswith("/jellyfin")):
                 service_name = "OmniRoute AI Gateway" if default_prefix == "/omniroute" or "omniroute" in request.url.path or "dashboard" in request.url.path else ("Jellyfin Media Server" if default_prefix == "/jellyfin" or "jellyfin" in request.url.path else "Open WebUI")
-                log_content = ""
-                if service_name == "OmniRoute AI Gateway":
-                    for log_file in ["/data/omniroute/omniroute.log", "/root/.omniroute/omniroute.log"]:
-                        try:
-                            if os.path.exists(log_file):
-                                with open(log_file, "r", encoding="utf-8", errors="ignore") as f:
-                                    lines = f.readlines()
-                                    log_content = "".join(lines[-100:])
-                                if log_content:
-                                    break
-                        except Exception:
-                            pass
-                safe_logs = log_content.replace("\\", "\\\\").replace("`", "\\`").replace("$", "\\$").replace("\n", "\\n") if log_content else ""
-                log_box = f'<pre style="text-align:left; background:#0d1117; padding:12px; border-radius:6px; color:#38bdf8; font-size:0.8rem; overflow-x:auto; max-height:200px; margin-top:1rem; border:1px solid #30363d;">{log_content}</pre>' if log_content else ''
-                log_script = f'<script>console.error("=== OMNIROUTE LOGS ==="); console.error(`{safe_logs}`);</script>' if safe_logs else ''
                 html_retry = f"""<!DOCTYPE html>
 <html>
@@ -205,27 +188,25 @@ async def proxy_http_request(
     <style>
         body {{ font-family: system-ui, -apple-system, sans-serif; background: #0d1117; color: #c9d1d9; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; padding: 20px; box-sizing: border-box; }}
-        .card {{ text-align: center; background: #161b22; padding: 2.5rem; border-radius: 12px; border: 1px solid #30363d; max-width: 700px; width: 100%; }}
         .spinner {{ width: 40px; height: 40px; border: 4px solid #30363d; border-top-color: #58a6ff; border-radius: 50%; animation: spin 1s linear infinite; margin: 0 auto 1.5rem; }}
         @keyframes spin {{ to {{ transform: rotate(360deg); }} }}
         h2 {{ margin: 0 0 0.5rem; color: #f0f6fc; font-size: 1.25rem; }}
         p {{ color: #8b949e; font-size: 0.9rem; margin: 0; }}
     </style>
-    {log_script}
 </head>
 <body>
     <div class="card">
         <div class="spinner"></div>
         <h2>Initializing {service_name}...</h2>
         <p>The service is completing backend startup. This page will refresh automatically in 3 seconds.</p>
-        {log_box}
     </div>
 </body>
 </html>"""
                 return Response(content=html_retry, status_code=200, headers={"Retry-After": "3", "Refresh": "3"}, media_type="text/html")
             return Response(
-                content=f"<h2>502 Service Unavailable</h2><p>Upstream starting: {exc}</p>",
                 status_code=502,
                 media_type="text/html",
             )

                 continue
             if method in ("GET", "HEAD") and ("html" in request.headers.get("accept", "").lower() or request.url.path in ("/", "/index.html", "/healthz", "/health", "/omniroute", "/dashboard", "/jellyfin") or request.url.path.startswith("/dashboard") or request.url.path.startswith("/omniroute") or request.url.path.startswith("/jellyfin")):
                 service_name = "OmniRoute AI Gateway" if default_prefix == "/omniroute" or "omniroute" in request.url.path or "dashboard" in request.url.path else ("Jellyfin Media Server" if default_prefix == "/jellyfin" or "jellyfin" in request.url.path else "Open WebUI")
                 html_retry = f"""<!DOCTYPE html>
 <html>
     <style>
         body {{ font-family: system-ui, -apple-system, sans-serif; background: #0d1117; color: #c9d1d9; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; padding: 20px; box-sizing: border-box; }}
+        .card {{ text-align: center; background: #161b22; padding: 2.5rem; border-radius: 12px; border: 1px solid #30363d; max-width: 500px; width: 100%; }}
         .spinner {{ width: 40px; height: 40px; border: 4px solid #30363d; border-top-color: #58a6ff; border-radius: 50%; animation: spin 1s linear infinite; margin: 0 auto 1.5rem; }}
         @keyframes spin {{ to {{ transform: rotate(360deg); }} }}
         h2 {{ margin: 0 0 0.5rem; color: #f0f6fc; font-size: 1.25rem; }}
         p {{ color: #8b949e; font-size: 0.9rem; margin: 0; }}
     </style>
 </head>
 <body>
     <div class="card">
         <div class="spinner"></div>
         <h2>Initializing {service_name}...</h2>
         <p>The service is completing backend startup. This page will refresh automatically in 3 seconds.</p>
     </div>
 </body>
 </html>"""
                 return Response(content=html_retry, status_code=200, headers={"Retry-After": "3", "Refresh": "3"}, media_type="text/html")
             return Response(
+                content=f"<h2>502 Service Unavailable</h2><p>Service initializing. Please retry in a few seconds.</p>",
                 status_code=502,
                 media_type="text/html",
             )

tg_streamer.py CHANGED Viewed

@@ -194,11 +194,18 @@ async def trigger_jellyfin_scan():
                 continue
             logger.warning(f"Could not trigger Jellyfin library refresh after retries: {e}")
 @routes.post("/")
 @routes.post("/telegram-webhook")
 @routes.post("/webhook")
 async def telegram_webhook(request):
     try:
         data = await request.json()
         post = data.get("channel_post") or data.get("message")
         if not post:

                 continue
             logger.warning(f"Could not trigger Jellyfin library refresh after retries: {e}")
+WEBHOOK_SECRET = os.environ.get("TG_WEBHOOK_SECRET")
 @routes.post("/")
 @routes.post("/telegram-webhook")
 @routes.post("/webhook")
 async def telegram_webhook(request):
     try:
+        if WEBHOOK_SECRET:
+            token = request.headers.get("X-Telegram-Bot-Api-Secret-Token")
+            if token != WEBHOOK_SECRET:
+                return web.json_response({"ok": False, "error": "Unauthorized"}, status=401)
         data = await request.json()
         post = data.get("channel_post") or data.get("message")
         if not post: