goyban
b7a0a86be2
Audit fixes: - Wallet names were used unvalidated as file paths, so a name like "../<other-id>/x" reached another user's wallet directory or overwrote bot_settings.json. Names are now validated and every path is resolved and confirmed to sit inside the caller's own directory, which also blocks a planted symlink from escaping. - Tor mode leaked: the mempool.space fee check opened a direct clear-net connection, tying the server's IP to its Bitcoin activity. It now goes through Tor's SOCKS proxy to mempool's onion service, DNS included. - The xpub message was left in the chat forever. It reveals the wallet's whole address and balance history, so it is now deleted like the password is. - Inline buttons stay live on old messages, so a user removed from the allow-list could keep using them. Callbacks re-check authorisation, and auth_check now works for callback queries instead of raising on a null message. - Wallet names echoed back in callback_data are confirmed against the user's real wallet list. - Settings are written via temp file + atomic rename; a crash mid-write used to truncate the file and lose every user's wallet selection. - Replies were sent against messages that had just been deleted; deletion is now best-effort and cannot abort the flow. Deployment: - Allow-list can come from ALLOWED_USERS instead of a bind-mounted file, so a deployment needs no files on disk. Both sources merge when both are present. - A missing bind-mounted allowed_users.txt made Docker create a directory in its place and silently lock everyone out; the entrypoint now detects that and stops with an explanation. - Standard mode honours ELECTRUM_SERVER, which previously only worked in Tor mode despite being documented. - Added VERSION, push.sh, docker-compose.deploy.yml and .env.deploy.example for a two-file deploy off the published image. Docs rewritten in English and Persian around the name Telegtrum, leading with the security model and what it does not protect against. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
32 lines
1.2 KiB
YAML
32 lines
1.2 KiB
YAML
# Ready-to-deploy Telegtrum. Pulls the published image — no source checkout,
|
|
# no build, no bind mounts.
|
|
#
|
|
# curl -O https://git.goyban.com/goyban/telegtrum_bot/raw/branch/main/docker-compose.deploy.yml
|
|
# curl -O https://git.goyban.com/goyban/telegtrum_bot/raw/branch/main/.env.deploy.example
|
|
# mv .env.deploy.example .env && nano .env
|
|
# docker compose -f docker-compose.deploy.yml up -d
|
|
services:
|
|
telegtrum:
|
|
container_name: telegtrum
|
|
image: git.goyban.com/goyban/telegtrum:latest
|
|
env_file: .env
|
|
environment:
|
|
# Allow-list comes from .env, so there is no file to create or mount.
|
|
ALLOWED_USERS: ${ALLOWED_USERS:?set ALLOWED_USERS in .env - comma separated Telegram user IDs}
|
|
ALLOWED_USERS_FILE: /nonexistent
|
|
volumes:
|
|
# Wallets, Electrum config and the blockchain headers live here.
|
|
# Back this up: docker run --rm -v telegtrum-data:/d -v "$PWD":/b \
|
|
# debian:bookworm-slim tar czf /b/telegtrum-backup.tar.gz -C /d .
|
|
- telegtrum-data:/root/.electrum
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "electrum", "getinfo"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 30s
|
|
|
|
volumes:
|
|
telegtrum-data:
|