7a314a92b1
- Create server/src/utils/ssrfGuard.ts with checkSsrf() and createPinnedAgent()
- Resolves DNS before allowing outbound requests to catch hostnames that
map to private IPs (closes the TOCTOU gap in the old inline checks)
- Always blocks loopback (127.x, ::1) and link-local/metadata (169.254.x)
- RFC-1918, CGNAT (100.64/10), and IPv6 ULA ranges blocked by default;
opt-in via ALLOW_INTERNAL_NETWORK=true for self-hosters running Immich
on a local network
- createPinnedAgent() pins node-fetch to the validated IP, preventing
DNS rebinding between the check and the actual connection
- Replace isValidImmichUrl() (hostname-string check, no DNS resolution)
with checkSsrf(); make PUT /integrations/immich/settings async
- Audit log entry (immich.private_ip_configured) written when a user
saves an Immich URL that resolves to a private IP
- Response includes a warning field surfaced as a toast in the UI
- Replace ~20 lines of duplicated inline SSRF logic in the link-preview
handler with a single checkSsrf() call + pinned agent
- Document ALLOW_INTERNAL_NETWORK in README, docker-compose.yml,
server/.env.example, chart/values.yaml, chart/templates/configmap.yaml,
and chart/README.md
35 lines
1.7 KiB
Markdown
35 lines
1.7 KiB
Markdown
# TREK Helm Chart
|
|
|
|
This is a minimal Helm chart for deploying the TREK app.
|
|
|
|
## Features
|
|
- Deploys the TREK container
|
|
- Exposes port 3000 via Service
|
|
- Optional persistent storage for `/app/data` and `/app/uploads`
|
|
- Configurable environment variables and secrets
|
|
- Optional generic Ingress support
|
|
- Health checks on `/api/health`
|
|
|
|
## Usage
|
|
|
|
```sh
|
|
helm install trek ./chart \
|
|
--set ingress.enabled=true \
|
|
--set ingress.hosts[0].host=yourdomain.com
|
|
```
|
|
|
|
See `values.yaml` for more options.
|
|
|
|
## Files
|
|
- `Chart.yaml` — chart metadata
|
|
- `values.yaml` — configuration values
|
|
- `templates/` — Kubernetes manifests
|
|
|
|
## Notes
|
|
- Ingress is off by default. Enable and configure hosts for your domain.
|
|
- PVCs require a default StorageClass or specify one as needed.
|
|
- `JWT_SECRET` is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
|
|
- `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Auto-generated and persisted to the data PVC if not provided. **Upgrading:** if a previous version used `JWT_SECRET`-derived encryption, set `secretEnv.ENCRYPTION_KEY` to your old `JWT_SECRET` value to keep existing encrypted data readable, then re-save credentials via the admin panel.
|
|
- If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
|
|
- Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.
|