Skip to content

Commit f68a4dc

Browse files
NeunerleiNeunerlei
authored
Merge pull request #274 from hawk-digital-environments/development
Update to 2.4.0
2 parents c02be36 + ee44848 commit f68a4dc

209 files changed

Lines changed: 14353 additions & 3508 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.dockerignore‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,9 @@
55
/vendor
66
/public/build
77
/public/hot
8+
/hot
89
/public/storage
9-
/storage/*.key
10-
/storage/logs/laravel.log#
11-
/storage/framework/views/*.php
12-
/storage/app/test_users.json
10+
/storage
1311
/.env
1412
/.env.private
1513
/.gitattributes

‎.env.example‎

Lines changed: 54 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@
3030
# - PROJECT_NAME: Application name, can be anything you like
3131
# - APP_ENV: Deployment type: "local", "statiging" or "production"
3232
# - APP_URL: Public URL to access the web interface
33+
# - APP_TRUSTED_PROXIES: Comma separated list of trusted proxy IP addresses (e.g. "10.0.1.11", or "10.0.1.11,10.0.1.12" for multiple proxies).
34+
# This is important if you are using a reverse proxy in front of HAWKI, to ensure that the application can correctly determine the client's IP address and other request information.
3335
# - APP_DEBUG: Enable debug output: "true" or "false"
3436
# - APP_TIMEZONE: Timezone of the web server
3537
# - APP_LOCALE: Language of the user interface
@@ -44,6 +46,7 @@ APP_NAME="HAWKI2"
4446
PROJECT_NAME="HAWKI2"
4547

4648
APP_URL="http://127.0.0.1:8000"
49+
#APP_TRUSTED_PROXIES=
4750
APP_ENV="local"
4851
APP_DEBUG="false"
4952
APP_TIMEZONE="CET"
@@ -118,6 +121,27 @@ HAWKI_NAME='HAWKI'
118121
HAWKI_USERNAME='HAWKI'
119122
HAWKI_AVATAR='hawkiAvatar.jpg'
120123

124+
# ==========================
125+
# SECURITY SETTINGS
126+
# ==========================
127+
#
128+
# Application-level security configuration.
129+
#
130+
# APP_SECURITY_PASSKEY_ALLOW_PASTE
131+
# Controls clipboard operations for passkey input fields.
132+
# When true (default): Allows paste from password managers and enables copy/cut to clipboard.
133+
# When false: Blocks all clipboard operations (paste, copy, and cut) for maximum security.
134+
# Note: Passkeys are used as direct cryptographic input, so clipboard behavior affects key derivation.
135+
#
136+
# APP_SECURITY_PASSKEY_CHAR_LIMITATION
137+
# Restricts allowed characters for passkey input.
138+
# When true (default): Only allows [A-Za-z0-9!@#$%^&*()_+-] to ensure deterministic
139+
# cryptographic key derivation across browsers, devices, and language runtimes.
140+
# When false: Allows any characters (use with caution as this may affect key compatibility).
141+
142+
APP_SECURITY_PASSKEY_ALLOW_PASTE=true
143+
APP_SECURITY_PASSKEY_CHAR_LIMITATION=true
144+
121145
# ==========================
122146
# AI CONNECTION
123147
# ==========================
@@ -161,20 +185,36 @@ GWDG_FILE_CONVERTER_API_URL='https://chat-ai.academiccloud.de/v1/documents/conve
161185
# Because the default value in config/database.php is "lavarel" which is less clear and
162186
# could at least in theory already be in use by other applications.
163187
#
164-
# - DB_CONNECTION: Database server type: "mysql", "sqlite", "mariadb", "pgsql", "sqlsrv" (see config/database.php)
165-
# - DB_BACKUP_INTERVAL Interval in which the database in being backed up: "daily", "weekly", "monthly", etc.
166-
# - DB_URL: Database connection URL (instead of host and port)
167-
# - DB_HOST: Database server host name
168-
# - DB_PORT: Database server port number
169-
# - DB_SOCKET: Unix domain socket instead of URL, host and port (MySQL and MariaDB only)
170-
# - DB_DATABASE: Database name (please change!)
171-
# - DB_USERNAME: Username to access the database server
172-
# - DB_PASSWORD: Password to access the database server
173-
# - DB_CHARSET: Character encoding of the database
174-
# - DB_COLLATION: Database collation (MySQL and MariaDB only)
188+
# A WORD ON BACKUPS: For various reasons, if you are running in a Docker environment,
189+
# the DB_BACKUP feature is disabled and will throw an error if you try to enable it.
190+
# Use the dump solution of your database container instead, and make sure to back up the database volume regularly.
191+
#
192+
# - DB_CONNECTION: Database server type: "mysql", "sqlite", "mariadb", "pgsql", "sqlsrv" (see config/database.php)
193+
# - DB_BACKUP_INTERVAL Interval in which the database in being backed up: "daily", "weekly", "monthly", etc. Can be "never" to disable automatic backups.
194+
# - DB_BACKUP_INTERVAL_ARGS Some intervals accept additional constraints, e.g. "20:00" for "dailyAt" or "sunday" and "12:31" for "weeklyOn"
195+
# See more details at: \Illuminate\Console\Scheduling\ManagesFrequencies
196+
# As value you can pass either a single string value, or a single numeric value (e.g. "20:00" or "20")
197+
# Or an JSON array to pass multiple values (e.g. ["sunday", "12:31"] or ["20:00", "wednesday", "15:00"])
198+
# Example: DB_BACKUP_INTERVAL="cron", DB_BACKUP_INTERVAL_ARGS="0 0 * * *" for daily backup at midnight,
199+
# or DB_BACKUP_INTERVAL="dailyAt", DB_BACKUP_INTERVAL_ARGS="20:00" for daily backup at 8pm,
200+
# or DB_BACKUP_INTERVAL="daysOfMonth", DB_BACKUP_INTERVAL_ARGS="[1, 13, 28]" for backup on the 1st, 13th and 28th of each month, etc.
201+
# - DB_BACKUP_DUMPER_BINARY_DIR By Default we are using "mysqldump" for MySQL/MariaDB, however if, on your machine the binary is not in the PATH,
202+
# you can specify the path to the directory containing the binary here.
203+
# - DB_URL: Database connection URL (instead of host and port)
204+
# - DB_HOST: Database server host name
205+
# - DB_PORT: Database server port number
206+
# - DB_SOCKET: Unix domain socket instead of URL, host and port (MySQL and MariaDB only)
207+
# - DB_DATABASE: Database name (please change!)
208+
# - DB_USERNAME: Username to access the database server
209+
# - DB_PASSWORD: Password to access the database server
210+
# - DB_ROOT_PASSWORD: The password of the root user of the database server.
211+
# - DB_CHARSET: Character encoding of the database
212+
# - DB_COLLATION: Database collation (MySQL and MariaDB only)
175213

176214
DB_CONNECTION="mysql"
177215
DB_BACKUP_INTERVAL="daily"
216+
DB_BACKUP_INTERVAL_ARGS=
217+
DB_BACKUP_DUMPER_BINARY_DIR=
178218

179219
## SQlite
180220
#DB_URL =
@@ -189,6 +229,7 @@ DB_SOCKET=
189229
DB_DATABASE=
190230
DB_USERNAME="root"
191231
DB_PASSWORD="root"
232+
DB_ROOT_PASSWORD="root"
192233
#DB_CHARSET = utf8mb4
193234
#DB_COLLATION = utf8mb4_unicode_ci
194235
#MYSQL_ATTR_SSL_CA =
@@ -504,6 +545,7 @@ TEST_USER_LOGIN="true"
504545
# OIDC_CLIENT_SECRET: Client secret for the OIDC application
505546
# OIDC_LOGOUT_URI: URI for OIDC logout
506547
# OIDC_SCOPES: Scopes define the level of access that the client is requesting from the authorization server.
548+
# OIDC_PKCE_METHOD: The code challenge method for PKCE (Proof Key for Code Exchange). Set to 'S256' to enable PKCE with SHA-256, or leave empty/null to disable.
507549
# OIDC_FIRSTNAME_VAR="firstname"
508550
# OIDC_LASTNAME_VAR="lastname"
509551
# OIDC_EMAIL_VAR="email"
@@ -514,6 +556,7 @@ TEST_USER_LOGIN="true"
514556
# OIDC_CLIENT_SECRET="xxx"
515557
# OIDC_LOGOUT_URI=""
516558
# OIDC_SCOPES=profile,email
559+
# OIDC_PKCE_METHOD=
517560

518561
# OIDC_FIRSTNAME_VAR="firstname"
519562
# OIDC_LASTNAME_VAR="lastname"

‎.github/workflows/deploy-hawk-prod.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: Deploy to Production
2+
on:
3+
workflow_dispatch:
4+
push:
5+
branches:
6+
- 'hawk/prod'
7+
8+
jobs:
9+
build-and-push:
10+
runs-on: ubuntu-latest
11+
12+
permissions:
13+
contents: read
14+
id-token: write
15+
packages: write
16+
17+
steps:
18+
- name: Check out the repo
19+
uses: actions/checkout@v4
20+
21+
- name: Log in to the Container registry
22+
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
23+
with:
24+
registry: ghcr.io
25+
username: ${{ github.actor }}
26+
password: ${{ secrets.GITHUB_TOKEN }}
27+
28+
- name: Extract metadata (tags, labels) for Docker
29+
id: meta
30+
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
31+
with:
32+
images: ghcr.io/${{ github.repository }}
33+
tags: |
34+
type=raw,value=prod-${{ github.sha }}
35+
type=raw,value=prod-latest
36+
37+
- name: Build and push Docker image
38+
id: push
39+
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
40+
with:
41+
context: .
42+
file: ./Dockerfile
43+
push: true
44+
target: app_prod
45+
tags: ${{ steps.meta.outputs.tags }}
46+
labels: ${{ steps.meta.outputs.labels }}
47+
48+
deploy:
49+
runs-on: ubuntu-latest
50+
needs: build-and-push
51+
steps:
52+
- name: Trigger Dokploy webhook
53+
uses: fjogeleit/http-request-action@v1
54+
with:
55+
url: ${{ secrets.DOKPLOY_DEPLOYMENT_WEBHOOK_PROD }}
56+
method: 'GET'
57+
58+
remove-old-images:
59+
permissions:
60+
contents: write
61+
packages: write
62+
runs-on: ubuntu-latest
63+
steps:
64+
- uses: snok/container-retention-policy@v3.0.0
65+
with:
66+
account: user
67+
token: ${{secrets.GITHUB_TOKEN}}
68+
image-names: "${{github.event.repository.name}}"
69+
image-tags: "prod-* !prod-latest"
70+
keep-n-most-recent: 5
71+
cut-off: 1h

‎.github/workflows/deploy-hawk-testing.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Deploy to Testing
2+
on:
3+
workflow_dispatch:
4+
push:
5+
branches:
6+
- 'hawk/testing'
7+
8+
jobs:
9+
build-and-push:
10+
runs-on: ubuntu-latest
11+
12+
permissions:
13+
contents: read
14+
id-token: write
15+
packages: write
16+
17+
steps:
18+
- name: Check out the repo
19+
uses: actions/checkout@v4
20+
21+
- name: Log in to the Container registry
22+
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
23+
with:
24+
registry: ghcr.io
25+
username: ${{ github.actor }}
26+
password: ${{ secrets.GITHUB_TOKEN }}
27+
28+
- name: Extract metadata (tags, labels) for Docker
29+
id: meta
30+
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
31+
with:
32+
images: ghcr.io/${{ github.repository }}
33+
tags: |
34+
type=raw,value=testing-${{ github.sha }}
35+
type=raw,value=testing-latest
36+
37+
- name: Build and push Docker image
38+
id: push
39+
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
40+
with:
41+
context: .
42+
file: ./Dockerfile
43+
push: true
44+
target: app_prod
45+
tags: ${{ steps.meta.outputs.tags }}
46+
labels: ${{ steps.meta.outputs.labels }}
47+
build-args: |
48+
CACHE_BUSTER=${{ github.sha }}
49+
50+
deploy:
51+
runs-on: ubuntu-latest
52+
needs: build-and-push
53+
steps:
54+
- name: Trigger Dokploy webhook
55+
uses: fjogeleit/http-request-action@v1
56+
with:
57+
url: ${{ secrets.DOKPLOY_DEPLOYMENT_WEBHOOK_TESTING }}
58+
method: 'GET'
59+
60+
remove-old-images:
61+
permissions:
62+
contents: write
63+
packages: write
64+
runs-on: ubuntu-latest
65+
steps:
66+
- uses: snok/container-retention-policy@v3.0.0
67+
with:
68+
account: user
69+
token: ${{secrets.GITHUB_TOKEN}}
70+
image-names: "${{github.event.repository.name}}"
71+
image-tags: "testing-* !testing-latest"
72+
keep-n-most-recent: 5
73+
cut-off: 1h

‎.github/workflows/rebuild-latest-image.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ jobs:
2727
- name: Read version from config
2828
id: get_version
2929
run: |
30-
# distinct from the node script, we use jq for a quick read without dependency install
3130
VERSION=$(jq -r .version config/hawki_version.json)
3231
3332
if [ -z "$VERSION" ] || [ "$VERSION" == "null" ]; then
@@ -72,13 +71,17 @@ jobs:
7271
subject-digest: ${{ steps.push.outputs.digest }}
7372
push-to-registry: true
7473

74+
- name: Setup release environment
75+
uses: ./.github/actions/setup-release-environment
76+
7577
- name: Notify Discord (Rebuild)
7678
if: success()
7779
uses: ./.github/actions/setup-release-environment
80+
81+
- name: Send Discord Notification
7882
working-directory: .github/.release
7983
env:
8084
INPUT_WEBHOOK_URL: ${{ secrets.DISCORD_UPDATE_WEBHOOK_URL }}
81-
# We pass dummy values for release info as there is no new Github Release
8285
INPUT_RELEASE_NAME: "Hotfix Rebuild: v${{ steps.get_version.outputs.version }}"
8386
INPUT_RELEASE_BODY: "Manual rebuild triggering by workflow dispatch. Reason: ${{ inputs.reason }}"
8487
INPUT_RELEASE_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"

0 commit comments

Comments
 (0)