Merge branch 'actions'

Signed-off-by: Arian Nasr <arian@2ari.ca>

.gitea/workflows/build-deb.yml

@@ -0,0 +1,31 @@
+name: Build Debian Package
+
+on:
+  push:
+    branches:
+      - '**'
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Make scripts executable
+        run: |
+          chmod +x release/build-docker.sh
+          chmod +x release/build-deb.sh
+
+      - name: Build Debian Package
+        run: ./release/build-docker.sh
+
+      - name: Upload Build Artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: navidrome-uploader-deb
+          path: output/*.deb
+          retention-days: 5

Dockerfile.build

@@ -14,6 +14,8 @@ RUN apt-get update && apt-get install -y \
     fakeroot \
     python3 \
     python3-venv \
+    python3-pip \
+    python3-wheel \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build/src
@@ -24,4 +26,4 @@ COPY . .
 
 RUN chmod +x release/build-deb.sh
 
-CMD ["sh", "-c", "./release/build-deb.sh && mv ../*.deb /dist/"]
+CMD ["sh", "-c", "./release/build-deb.sh && mv ../*.deb /dist/"]

LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Arian Nasr (arian-nasr) - arian@2ari.ca
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

debian/changelog

@@ -1,3 +1,22 @@
+navidrome-uploader (0.2.0) unstable; urgency=medium
+
+  * Packaging:
+    - Bundle pip wheels during build for offline host installation
+    - Ensure debian build environment includes pip and wheel modules
+  * Docker:
+    - Implement containerized debian packaging automation scripts
+  * Security:
+    - Add MAX_CONTENT_LENGTH to prevent upload DoS vectors
+  * Bug Fixes:
+    - Fix apt purge leaving pycache and systemd directory remnants
+  * Frontend:
+    - Change Dropzone.js upstream source location
+  * Maintenance:
+    - Add the open source software MIT license
+    - Upstream package & dependency updates
+
+ -- Arian Nasr <arian@2ari.ca>  Mon, 25 May 2026 18:31:00 -0400
+
 navidrome-uploader (0.1.0-2) unstable; urgency=high
 
   * Run pip install stage as navidrome-uploader user instead of root

debian/control

@@ -8,5 +8,5 @@ Rules-Requires-Root: no
 
 Package: navidrome-uploader
 Architecture: all
-Depends: ${misc:Depends}, adduser, python3, python3-venv
-Description: Navidrome Web Upload Utility
+Depends: ${misc:Depends}, adduser, python3, python3-venv, python3-pip, python3-wheel
+Description: Navidrome Web Upload Utility

debian/navidrome-uploader.install

@@ -5,5 +5,5 @@ requirements.txt opt/navidrome-uploader/
 templates/* opt/navidrome-uploader/templates/
 static/css/* opt/navidrome-uploader/static/css/
 static/js/* opt/navidrome-uploader/static/js/
-contrib/navidrome-uploader.service lib/systemd/system/navidrome-uploader.service
-
+contrib/navidrome-uploader.service lib/systemd/system/
+debian/wheels/* opt/navidrome-uploader/wheels/

debian/navidrome-uploader.postinst

@@ -10,8 +10,8 @@ case "$1" in
     chown -R "$APP_USER:$APP_USER" "$APP_DIR"
 
     runuser -u "$APP_USER" -- python3 -m venv "$VENV_DIR"
-    runuser -u "$APP_USER" -- "$VENV_DIR/bin/pip" install --no-cache-dir --upgrade pip
-    runuser -u "$APP_USER" -- "$VENV_DIR/bin/pip" install --no-cache-dir -r "$APP_DIR/requirements.txt"
+
+    runuser -u "$APP_USER" -- "$VENV_DIR/bin/pip" install --no-cache-dir --no-index --find-links="$APP_DIR/wheels" -r "$APP_DIR/requirements.txt"
 
     if command -v systemctl >/dev/null 2>&1; then
       systemctl daemon-reload || true

debian/rules

@@ -3,6 +3,11 @@
 %:
 	dh $@
 
+override_dh_auto_build:
+	dh_auto_build
+	mkdir -p debian/wheels
+	python3 -m pip wheel --no-cache-dir -r requirements.txt pip -w debian/wheels
+
 override_dh_install:
 	dh_install
 	install -d debian/navidrome-uploader/etc/default/navidrome-uploader

main.py

@@ -3,7 +3,7 @@
 # March 6, 2026
 
 import os
-from flask import Flask, request, render_template
+from flask import Flask, request, render_template, jsonify
 from werkzeug.utils import secure_filename
 
 UPLOAD_FOLDER = os.environ.get('NAVIDROME_MUSIC_FOLDER', '/opt/navidrome/music')
@@ -25,13 +25,15 @@ def ping():
 @app.route('/', methods=['GET', 'POST'])
 def upload_file():
     if request.method == 'POST':
+        uploaded_count = 0
         for key, file in request.files.items():
             if key.startswith('file') and file and allowed_file(file.filename) and file.filename != '':
                 filename = secure_filename(file.filename)
                 file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename))
+                uploaded_count += 1
             else:
-                return render_template('error.html', error_message=f'File is not allowed.'), 400
+                return jsonify({"error": f"File '{file.filename}' is not allowed or is empty."}), 400
 
-        return render_template('success.html', success_message=f'{len(request.files)} file(s) uploaded successfully!'), 200
+        return jsonify({"message": f"{uploaded_count} file(s) uploaded successfully!"}), 200
 
     return render_template('index.html'), 200

release/build-docker.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -eu
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+PROJECT_ROOT="$(CDPATH= cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+cd "${PROJECT_ROOT}"
+
+docker build --platform linux/amd64 -t uploader-builder -f Dockerfile.build .
+
+docker run --name uploader-builder-container --platform linux/amd64 uploader-builder
+
+docker cp uploader-builder-container:/dist/. output/
+
+docker rm uploader-builder-container

requirements.txt

@@ -1,5 +1,5 @@
 blinker==1.9.0
-click==8.3.3
+click==8.4.1
 Flask==3.1.3
 itsdangerous==2.2.0
 Jinja2==3.1.6

templates/error.html

@@ -1,14 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Error - Upload Music</title>
-    <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}" type="text/css" />
-</head>
-<body>
-    <h1>Error</h1>
-    <p>{{ error_message }}</p>
-    <a href="/"><button>Upload another file</button></a>
-</body>
-</html>

templates/success.html

@@ -1,14 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Success - Upload Music</title>
-    <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}" type="text/css" />
-</head>
-<body>
-    <h1>Success</h1>
-    <p>{{ success_message }}</p>
-    <a href="/"><button>Upload another file</button></a>
-</body>
-</html>