mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
308470f229
Every configured key id now has a canary in encryption_key_canaries, checked at boot. A key that cannot open its canary, or existing data written before the canary existed, puts the process in a refusal state: every API route answers 503 encryption.key_mismatch, /api/health reports reason encryption_key_mismatch, the pages render one explanation, and neither the queue producer nor the worker starts. The process stays up so the reason is visible instead of hiding in a crash loop. The admin Encryption page gains a "Back up your encryption key" step: key id and fingerprint (never the key), where the key lives per platform, a check of a pasted copy that is compared and discarded, and a confirmation bound to the active key id and fingerprint. The overview gets a tile and admins get a dashboard banner while it is due. HEALTHLOG_PLATFORM picks the platform the step opens on. Adds the TrueNAS self-hosting page and key backup sections in the docs.
61 lines
2.6 KiB
JSON
61 lines
2.6 KiB
JSON
{
|
|
"version": "3",
|
|
"templates": [
|
|
{
|
|
"type": 3,
|
|
"title": "HealthLog",
|
|
"name": "healthlog",
|
|
"description": "Self-hosted personal health tracker (PWA + native iOS client): weight, blood pressure, pulse, blood glucose, body composition, sleep, mood, menstrual cycle, and medications on one encrypted timeline. AES-256-GCM at rest, no vendor cloud, no telemetry. Ships app + PostgreSQL 16 as one stack.",
|
|
"note": "Generate each secret with: openssl rand -hex 32 (a 64-char hex string). For plain-HTTP / LAN access set SESSION_COOKIE_SECURE to false, or login fails. Set NEXT_PUBLIC_APP_URL and APP_URL to how you reach the app. Full guide: https://github.com/MBombeck/HealthLog/blob/main/docs/self-hosting/getting-started.md",
|
|
"categories": ["Tools", "Other"],
|
|
"platform": "linux",
|
|
"logo": "https://raw.githubusercontent.com/MBombeck/HealthLog/main/public/logo-512.png",
|
|
"repository": {
|
|
"url": "https://github.com/MBombeck/HealthLog",
|
|
"stackfile": "docker-compose.yml"
|
|
},
|
|
"env": [
|
|
{
|
|
"name": "POSTGRES_PASSWORD",
|
|
"label": "PostgreSQL password",
|
|
"description": "Database password. Generate with: openssl rand -hex 32"
|
|
},
|
|
{
|
|
"name": "ENCRYPTION_KEY",
|
|
"label": "Encryption key (data at rest)",
|
|
"description": "AES-256-GCM key. Generate with: openssl rand -hex 32. Back this up — losing it makes encrypted data unrecoverable."
|
|
},
|
|
{
|
|
"name": "API_TOKEN_HMAC_KEY",
|
|
"label": "API token HMAC key",
|
|
"description": "Generate with: openssl rand -hex 32"
|
|
},
|
|
{
|
|
"name": "HEALTHLOG_PLATFORM",
|
|
"label": "Platform hint",
|
|
"description": "Opens the admin's encryption key backup step on the Portainer instructions.",
|
|
"default": "portainer"
|
|
},
|
|
{
|
|
"name": "SESSION_COOKIE_SECURE",
|
|
"label": "Session cookie Secure flag",
|
|
"description": "Set to false for plain-HTTP / LAN access, or login fails. Set to true only behind an HTTPS reverse proxy.",
|
|
"default": "false"
|
|
},
|
|
{
|
|
"name": "NEXT_PUBLIC_APP_URL",
|
|
"label": "Public app URL",
|
|
"description": "How users reach HealthLog, e.g. http://nas:3000 or https://healthlog.example.com",
|
|
"default": "http://localhost:3000"
|
|
},
|
|
{
|
|
"name": "APP_URL",
|
|
"label": "Internal app URL",
|
|
"description": "Normally identical to the public app URL.",
|
|
"default": "http://localhost:3000"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|