28d346d0f5
All checks were successful
Build and Push Docker Image / build-and-push (push) Successful in 54m48s
Admin → Backup: Ziel (SFTP oder Nextcloud/WebDAV) konfigurieren, Verbindung testen, Jetzt sichern,
Zeitplan (aus/täglich/wöchentlich) + Aufbewahrung. Best Practice: verschlüsselt + off-site.
- Verschlüsselung: Backup als tar.gz (database.dump + MinIO-Dateien) → AES-256-GCM mit Passphrase.
Zugangsdaten + Passphrase verschlüsselt in DB (src/lib/crypto-secret.ts, Schlüssel aus Server-Secret)
- Engine (src/lib/backup): pg_dump + archiver-Stream aus MinIO + Stream-Verschlüsselung + Upload + Prune
- Ziel-Adapter: SFTP (ssh2-sftp-client) + WebDAV (webdav), je test/upload/list/delete
- API (SERVER_ADMIN): /api/admin/backup/{config,test,run}; öffentlich per CRON_SECRET: /api/cron/backup
- Scheduler in server-custom.js (stündliche Fälligkeitsprüfung)
- Dockerfile: postgresql16-client (pg_dump) + runtime-Libs; next.config serverExternalPackages
- scripts/decrypt-backup.js + docs/BACKUP.md (Restore-Anleitung), .env.example (CRON_SECRET, BACKUP_ENC_KEY)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
95 lines
2.8 KiB
JavaScript
95 lines
2.8 KiB
JavaScript
const packageJson = require('./package.json')
|
|
|
|
/** @type {import('next').NextConfig} */
|
|
const nextConfig = {
|
|
env: {
|
|
APP_VERSION: packageJson.version,
|
|
},
|
|
output: 'standalone',
|
|
// Node-Libs für das Backup nicht bundeln, sondern zur Laufzeit aus node_modules laden
|
|
// (ssh2 hat optionale native Module; webdav/archiver sind reine Server-Abhängigkeiten).
|
|
serverExternalPackages: ['ssh2', 'ssh2-sftp-client', 'archiver', 'webdav'],
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: '/(.*)',
|
|
headers: [
|
|
{
|
|
key: 'X-Frame-Options',
|
|
value: 'SAMEORIGIN',
|
|
},
|
|
{
|
|
key: 'X-Content-Type-Options',
|
|
value: 'nosniff',
|
|
},
|
|
{
|
|
key: 'Referrer-Policy',
|
|
value: 'strict-origin-when-cross-origin',
|
|
},
|
|
{
|
|
key: 'Permissions-Policy',
|
|
value: 'camera=(), microphone=(), geolocation=(self)',
|
|
},
|
|
{
|
|
key: 'Cross-Origin-Opener-Policy',
|
|
value: 'same-origin',
|
|
},
|
|
{
|
|
key: 'Strict-Transport-Security',
|
|
value: 'max-age=63072000; includeSubDomains; preload',
|
|
},
|
|
{
|
|
key: 'X-DNS-Prefetch-Control',
|
|
value: 'on',
|
|
},
|
|
{
|
|
key: 'X-XSS-Protection',
|
|
value: '1; mode=block',
|
|
},
|
|
{
|
|
key: 'Content-Security-Policy',
|
|
value: [
|
|
"default-src 'self'",
|
|
"script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:",
|
|
"style-src 'self' 'unsafe-inline'",
|
|
"img-src 'self' data: blob: https://*.tile.openstreetmap.org https://api.maptiler.com https://server.arcgisonline.com https://*.geo.admin.ch http://localhost:9000 http://minio:9000",
|
|
"font-src 'self' data:",
|
|
"connect-src 'self' ws: wss: https://api.maptiler.com https://*.tile.openstreetmap.org https://nominatim.openstreetmap.org https://api.open-meteo.com https://server.arcgisonline.com https://*.geo.admin.ch",
|
|
"frame-ancestors 'self'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
].join('; '),
|
|
},
|
|
],
|
|
},
|
|
]
|
|
},
|
|
serverExternalPackages: ['minio', 'stripe', '@react-pdf/renderer', '@react-pdf/layout', '@react-pdf/pdfkit', '@react-pdf/font'],
|
|
typescript: {
|
|
ignoreBuildErrors: true,
|
|
},
|
|
images: {
|
|
remotePatterns: [
|
|
{
|
|
protocol: 'http',
|
|
hostname: 'localhost',
|
|
port: '9000',
|
|
pathname: '/**',
|
|
},
|
|
{
|
|
protocol: 'http',
|
|
hostname: 'minio',
|
|
port: '9000',
|
|
pathname: '/**',
|
|
},
|
|
],
|
|
},
|
|
experimental: {
|
|
serverActions: {
|
|
bodySizeLimit: '16mb',
|
|
},
|
|
},
|
|
}
|
|
|
|
module.exports = nextConfig
|