mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
69bae8bdb4
At a first start there is no recorded key yet, so an operator facing a refusal they are certain is false has no row to delete. With ENCRYPTION_KEY_CHECK=warn (default enforce) the check still runs and logs its full outcome, /api/health names a mismatch as a warning field without failing, requests are served, and no key is recorded unless every key id passes. The variable is on the compose whitelist, in both example files, the env manifest, the Unraid and Portainer templates and the published-env guard. The log block, the mismatch page and the self-hosting pages offer it as the last resort after the three real fixes, and say that it disables a safety check.
67 lines
5.2 KiB
XML
67 lines
5.2 KiB
XML
<?xml version="1.0"?>
|
|
<!--
|
|
HealthLog — Unraid Community Applications template.
|
|
|
|
CA templates describe ONE container. HealthLog needs PostgreSQL 16, so
|
|
install a PostgreSQL container FIRST (CA has community PostgreSQL templates),
|
|
create a `healthlog` database + user, then point DATABASE_URL below at it.
|
|
Full walkthrough: docs/self-hosting/unraid.md.
|
|
|
|
LAN installs serve plain HTTP (http://tower:3000). Keep SESSION_COOKIE_SECURE
|
|
set to false (the default in this template) or login will silently fail.
|
|
-->
|
|
<Container version="2">
|
|
<Name>HealthLog</Name>
|
|
<Repository>ghcr.io/mbombeck/healthlog:latest</Repository>
|
|
<Registry>https://github.com/MBombeck/HealthLog/pkgs/container/healthlog</Registry>
|
|
<Network>bridge</Network>
|
|
<MyIP/>
|
|
<Shell>sh</Shell>
|
|
<Privileged>false</Privileged>
|
|
<Support>https://github.com/MBombeck/HealthLog/issues</Support>
|
|
<Project>https://github.com/MBombeck/HealthLog</Project>
|
|
<Overview>
|
|
Self-hosted personal health tracker (PWA + native iOS client): weight, blood
|
|
pressure, pulse, blood glucose, body composition, sleep, mood, menstrual
|
|
cycle, and medications on one encrypted timeline. AES-256-GCM at rest, no
|
|
vendor cloud, no telemetry.
|
|
|
|
REQUIRES a separate PostgreSQL 16 container — install one first (CA has
|
|
community PostgreSQL templates), create a database and user, then set
|
|
DATABASE_URL below. Step-by-step guide:
|
|
https://github.com/MBombeck/HealthLog/blob/main/docs/self-hosting/unraid.md
|
|
|
|
Generate each required secret with: openssl rand -hex 32
|
|
|
|
LAN / plain-HTTP installs MUST keep SESSION_COOKIE_SECURE set to false,
|
|
otherwise the session cookie carries the Secure flag, the browser drops it
|
|
over HTTP, and login silently fails.
|
|
</Overview>
|
|
<Category>Tools: Productivity: Other:</Category>
|
|
<WebUI>http://[IP]:[PORT:3000]/</WebUI>
|
|
<Icon>https://raw.githubusercontent.com/MBombeck/HealthLog/main/public/logo-512.png</Icon>
|
|
<ExtraParams>--security-opt no-new-privileges:true</ExtraParams>
|
|
<DonateText/>
|
|
<DonateLink/>
|
|
|
|
<Config Name="WebUI Port" Target="3000" Default="3000" Mode="tcp" Description="HTTP port HealthLog listens on." Type="Port" Display="always" Required="true" Mask="false">3000</Config>
|
|
|
|
<Config Name="DATABASE_URL" Target="DATABASE_URL" Default="postgresql://healthlog:CHANGE-ME@POSTGRES-HOST:5432/healthlog?schema=public" Mode="" Description="Connection string for your separately-installed PostgreSQL 16. Replace CHANGE-ME with the DB password and POSTGRES-HOST with the Postgres container IP or name." Type="Variable" Display="always" Required="true" Mask="true"/>
|
|
|
|
<Config Name="ENCRYPTION_KEY" Target="ENCRYPTION_KEY" Default="" Mode="" Description="AES-256-GCM key for data at rest. Generate with: openssl rand -hex 32 (64-char hex). Back this up — losing it makes encrypted data unrecoverable." Type="Variable" Display="always" Required="true" Mask="true"/>
|
|
|
|
<Config Name="API_TOKEN_HMAC_KEY" Target="API_TOKEN_HMAC_KEY" Default="" Mode="" Description="HMAC key for API token hashing. Generate with: openssl rand -hex 32 (64-char hex)." Type="Variable" Display="always" Required="true" Mask="true"/>
|
|
|
|
<Config Name="SESSION_COOKIE_SECURE" Target="SESSION_COOKIE_SECURE" Default="false" Mode="" Description="Set to false for LAN / plain-HTTP installs (http://tower:3000) or login fails. Set to true only behind an HTTPS reverse proxy." Type="Variable" Display="always" Required="true" Mask="false">false</Config>
|
|
<Config Name="HEALTHLOG_PLATFORM" Target="HEALTHLOG_PLATFORM" Default="unraid" Mode="" Description="Where this server is configured. Opens the admin's encryption key backup step on the Unraid instructions." Type="Variable" Display="advanced" Required="false" Mask="false">unraid</Config>
|
|
<Config Name="ENCRYPTION_KEY_CHECK" Target="ENCRYPTION_KEY_CHECK" Default="enforce" Mode="" Description="Start-up encryption key check. enforce refuses to serve when the key does not open the stored data. warn only logs it: a last resort for a refusal you are certain is false, and it disables a safety check." Type="Variable" Display="advanced" Required="false" Mask="false">enforce</Config>
|
|
|
|
<Config Name="NEXT_PUBLIC_APP_URL" Target="NEXT_PUBLIC_APP_URL" Default="http://tower:3000" Mode="" Description="Public URL users reach HealthLog at. Use the LAN URL (e.g. http://tower:3000) or your HTTPS domain behind a reverse proxy." Type="Variable" Display="always" Required="true" Mask="false"/>
|
|
|
|
<Config Name="APP_URL" Target="APP_URL" Default="http://tower:3000" Mode="" Description="Internal app base URL. Normally identical to NEXT_PUBLIC_APP_URL." Type="Variable" Display="always" Required="true" Mask="false"/>
|
|
|
|
<Config Name="ENCRYPTION_KEYS" Target="ENCRYPTION_KEYS" Default="" Mode="" Description="Optional. Key-rotation map, e.g. {"v1":"<hex>","v2":"<hex>"}. Leave empty unless rotating; use ENCRYPTION_KEY instead." Type="Variable" Display="advanced" Required="false" Mask="true"/>
|
|
|
|
<Config Name="ENCRYPTION_ACTIVE_KEY_ID" Target="ENCRYPTION_ACTIVE_KEY_ID" Default="" Mode="" Description="Optional. Active key id for the ENCRYPTION_KEYS map (e.g. v2). Leave empty when using ENCRYPTION_KEY." Type="Variable" Display="advanced" Required="false" Mask="false"/>
|
|
</Container>
|