Comment on Tuvix - Self-Hosted RSS Aggregator

glizzyguzzler@piefed.blahaj.zone ⁨2⁩ ⁨months⁩ ago

• TechSquidTV@lemmy.world ⁨2⁩ ⁨months⁩ ago

  OIDC, maybe? I haven’t thought about that, but super open to input. I haven’t published the containers yet because I want to get to a more secure/optimized spot there first. I’m not actually sure if a read only container is possible? There’s SQLite DB writes at a minimum, though that could be externalized. I wouldn’t mind getting to that point.

  source

  • glizzyguzzler@piefed.blahaj.zone ⁨2⁩ ⁨months⁩ ago

    I am loving OIDC giving a single login for all the things I’ve got going, I see it as a near-essential for adding new services!

    Read-only is easy! You just need to confine where the writes happen. You use volumes for stuff you want to remember were written and tmpfs for stuff you don’t want to remember. Tmpfs for /tmp if needed, volume for the DB, good to go. It is super useful for security since only what is included in the container can be executed greatly reducing the attack area. No way to introduce a new excutable to the container! (you set noexec for tmpfs/volumes)

    I’ve seen difficult setups like a “work directory” where key files, executables, and temp files go. That structure can’t be secured, avoid that. Basically the temp files go in somewhere that’s not a big pile of a “work directory” - like /tmp - and then that structure once again works!

    Of course I wouldn’t say no to an LCARS theme either…

    source