Merge pull request #117 from djmitche/security-scan-weekly

run the security scan weekly, not daily

.github/workflows/security.yml

@@ -2,7 +2,7 @@ name: security
 
 on:
   schedule:
-    - cron: '0 0 * * *'
+    - cron: '33 0 * * THU'
   push:
     paths:
       - '**/Cargo.toml'

Cargo.toml

@@ -8,8 +8,8 @@ members = [
 rust-version = "1.81.0" # MSRV
 
 [workspace.dependencies]
-uuid = { version = "^1.15.1", features = ["serde", "v4"] }
-actix-web = "^4.9.0"
+uuid = { version = "^1.17.0", features = ["serde", "v4"] }
+actix-web = "^4.11.0"
 anyhow = "1.0"
 thiserror = "2.0"
 futures = "^0.3.25"
@@ -17,7 +17,7 @@ serde_json = "^1.0"
 serde = { version = "^1.0.147", features = ["derive"] }
 clap = { version = "^4.5.6", features = ["string", "env"] }
 log = "^0.4.17"
-env_logger = "^0.11.5"
+env_logger = "^0.11.7"
 rusqlite = { version = "0.32", features = ["bundled"] }
 chrono = { version = "^0.4.38", features = ["serde"] }
 actix-rt = "2"

Dockerfile

@@ -19,7 +19,7 @@ RUN apk add --no-cache su-exec && \
   -g taskchampion taskchampion && \
   install -d -m1755 -o1092 -g1092 "/var/lib/taskchampion-sync-server"
 EXPOSE 8080
-VOLUME /var/lib/task-champion-sync-server/data
+VOLUME /var/lib/taskchampion-sync-server/data
 COPY docker-entrypoint.sh /bin
 ENTRYPOINT [ "/bin/docker-entrypoint.sh" ]
 CMD [ "/bin/taskchampion-sync-server" ]

README.md

@@ -33,7 +33,7 @@ Every release of the server generates a Docker image in
 and `0.5.1`.
 
 The
-[`docker-compose.yml`](https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/refs/tags/v0.6.0/docker-compose.yml)
+[`docker-compose.yml`](https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/refs/tags/v0.6.1/docker-compose.yml)
 file in this repository is sufficient to run taskchampion-sync-server,
 including setting up TLS certificates using Lets Encrypt, thanks to
 [Caddy](https://caddyserver.com/).
@@ -46,9 +46,14 @@ On that server, download `docker-compose.yml` from the link above (it is pinned
 to the latest release) into the current directory. Then run
 
 ```sh
-TASKCHAMPION_SYNC_SERVER_HOSTNAME=taskwarrior.example.com docker compose up
+TASKCHAMPION_SYNC_SERVER_HOSTNAME=taskwarrior.example.com \
+TASKCHAMPION_SYNC_SERVER_CLIENT_ID=your-client-id \
+docker compose up
 ```
 
+The `TASKCHAMPION_SYNC_SERVER_CLIENT_ID` limits the server to the given client
+ID; omit it to allow all client IDs.
+
 It can take a few minutes to obtain the certificate; the caddy container will
 log a message "certificate obtained successfully" when this is complete, or
 error messages if the process fails. Once this process is complete, configure
@@ -56,8 +61,8 @@ your `.taskrc`'s to point to the server:
 
 ```
 sync.server.url=https://taskwarrior.example.com
-sync.server.client_id=[your client-id]
-sync.encryption_secret=[your encryption secret]
+sync.server.client_id=your-client-id
+sync.encryption_secret=your-encryption-secret
 ```
 
 The docker-compose images store data in a docker volume named
@@ -149,4 +154,12 @@ docker run -t -d \
 
 This start TaskChampion Sync-Server and publish the port to host. Please
 note that this is a basic run, all data will be destroyed after stop and
-delete container.
+delete container. You may also set `DATA_DIR`, `CLIENT_ID`, or `LISTEN` with `-e`, e.g.,
+
+```sh
+docker run -t -d \
+  --name=taskchampion \
+  -e LISTEN=0.0.0.0:9000 \
+  -p 9000:9000 \
+  taskchampion-sync-server
+```

core/Cargo.toml

@@ -1,9 +1,11 @@
 [package]
 name = "taskchampion-sync-server-core"
-version = "0.6.0"
+version = "0.6.2-pre"
 authors = ["Dustin J. Mitchell <dustin@mozilla.com>"]
 edition = "2021"
 description = "Core of sync protocol for TaskChampion"
+homepage = "https://github.com/GothenburgBitFactory/taskchampion"
+repository = "https://github.com/GothenburgBitFactory/taskchampion-sync-server"
 license = "MIT"
 
 [dependencies]

docker-compose.yml

@@ -43,12 +43,13 @@ services:
         condition: service_completed_successfully
 
   tss:
-    image: ghcr.io/gothenburgbitfactory/taskchampion-sync-server:0.6.0
+    image: ghcr.io/gothenburgbitfactory/taskchampion-sync-server:0.6.1
     restart: unless-stopped
     environment:
       - "RUST_LOG=info"
       - "DATA_DIR=/var/lib/taskchampion-sync-server/data"
       - "LISTEN=0.0.0.0:8080"
+      - "CLIENT_ID=${TASKCHAMPION_SYNC_SERVER_CLIENT_ID}"
     volumes:
       - type: volume
         source: data

docker-entrypoint.sh

@@ -2,12 +2,28 @@
 set -e
 echo "starting entrypoint script..."
 if [ "$1" = "/bin/taskchampion-sync-server" ]; then
-    echo "setting data directories"
-    mkdir -p "/var/lib/taskchampion-sync-server/data"
-    chown -R 1092:1092 "/var/lib/taskchampion-sync-server/data"
-    chmod -R 700 "/var/lib/taskchampion-sync-server/data"
+    : ${DATA_DIR:=/var/lib/taskchampion-sync-server}
+    export DATA_DIR
+    echo "setting up data directory ${DATA_DIR}"
+    mkdir -p "${DATA_DIR}"
+    chown -R taskchampion:users "${DATA_DIR}"
+    chmod -R 700 "${DATA_DIR}"
+
+    : ${LISTEN:=0.0.0.0:8080}
+    export LISTEN
+    echo "Listen set to ${LISTEN}"
+
+    if [ -n "${CLIENT_ID}" ]; then
+        export CLIENT_ID
+        echo "Limiting to client ID ${CLIENT_ID}"
+    else
+        unset CLIENT_ID
+    fi
+
     if [ "$(id -u)" = "0" ]; then
-        echo "switching to user 'taskchampion'"
+        echo "Running server as user 'taskchampion'"
         exec su-exec taskchampion "$@"
     fi
+else
+    eval "${@}"
 fi

server/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "taskchampion-sync-server"
-version = "0.6.0"
+version = "0.6.2-pre"
 authors = ["Dustin J. Mitchell <dustin@mozilla.com>"]
 edition = "2021"
 publish = false

sqlite/Cargo.toml

@@ -1,13 +1,15 @@
 [package]
 name = "taskchampion-sync-server-storage-sqlite"
-version = "0.6.0"
+version = "0.6.2-pre"
 authors = ["Dustin J. Mitchell <dustin@mozilla.com>"]
 edition = "2021"
 description = "SQLite backend for TaskChampion-sync-server"
+homepage = "https://github.com/GothenburgBitFactory/taskchampion"
+repository = "https://github.com/GothenburgBitFactory/taskchampion-sync-server"
 license = "MIT"
 
 [dependencies]
-taskchampion-sync-server-core = { path = "../core", version = "0.6.0" }
+taskchampion-sync-server-core = { path = "../core", version = "0.6.2-pre" }
 uuid.workspace = true
 anyhow.workspace = true
 thiserror.workspace = true