Merge branch 'deb-packaging'

Signed-off-by: Arian Nasr <arian@2ari.ca>

.env.example

@@ -0,0 +1,3 @@
+NAVIDROME_MUSIC_FOLDER="/opt/navidrome/music"
+BIND_ADDRESS="0.0.0.0"
+BIND_PORT="5001"

.gitignore

@@ -2,3 +2,7 @@ venv/
 setup.sh
 navidrome-upload.service
 .idea/
+.env
+/README.md
+__pycache__/
+*.deb

Dockerfile.build

@@ -0,0 +1,29 @@
+# Navidome-Uploader Dockerfile for building .deb packages
+# Arian Nasr
+# May 9, 2026
+
+FROM debian:13-slim
+
+# Prevent interactive prompts
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    debhelper \
+    devscripts \
+    fakeroot \
+    python3 \
+    python3-venv \
+    python3-pip \
+    python3-wheel \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build/src
+
+RUN mkdir -p /dist
+
+COPY . .
+
+RUN chmod +x release/build-deb.sh
+
+CMD ["sh", "-c", "./release/build-deb.sh && mv ../*.deb /dist/"]

LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Arian Nasr (arian-nasr) - arian@2ari.ca
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

contrib/navidrome-uploader.service

@@ -0,0 +1,47 @@
+[Unit]
+Description=Navidrome Music Uploader Service
+After=network.target,navidrome.service
+
+[Service]
+Type=simple
+User=navidrome-uploader
+Group=navidrome-uploader
+WorkingDirectory=/opt/navidrome-uploader
+Environment="PATH=/opt/navidrome-uploader/venv/bin"
+EnvironmentFile=/etc/default/navidrome-uploader/.env
+ExecStart=/opt/navidrome-uploader/venv/bin/gunicorn --no-control-socket -c gunicorn.conf.py main:app
+Restart=on-failure
+RestartSec=30
+
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadWritePaths=/opt/navidrome-uploader /opt/navidrome/music
+InaccessiblePaths=/boot /mnt /media
+
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+PrivateNetwork=no
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+UMask=0027
+
+
+[Install]
+WantedBy=multi-user.target

debian/changelog

@@ -0,0 +1,37 @@
+navidrome-uploader (0.2.0) unstable; urgency=medium
+
+  * Packaging:
+    - Bundle pip wheels during build for offline host installation
+    - Ensure debian build environment includes pip and wheel modules
+  * Docker:
+    - Implement containerized debian packaging automation scripts
+  * Security:
+    - Add MAX_CONTENT_LENGTH to prevent upload DoS vectors
+  * Bug Fixes:
+    - Fix apt purge leaving pycache and systemd directory remnants
+  * Frontend:
+    - Change Dropzone.js upstream source location
+  * Maintenance:
+    - Add the open source software MIT license
+    - Upstream package & dependency updates
+
+ -- Arian Nasr <arian@2ari.ca>  Mon, 25 May 2026 18:31:00 -0400
+
+navidrome-uploader (0.1.0-2) unstable; urgency=high
+
+  * Run pip install stage as navidrome-uploader user instead of root
+
+ -- Arian Nasr <arian@2ari.ca>  Tue, 14 Apr 2026 12:11:00 -0400
+
+navidrome-uploader (0.1.0-1) unstable; urgency=medium
+
+  * Disable gunicorn control socket in systemd service unit
+
+ -- Arian Nasr <arian@2ari.ca>  Thu, 09 Apr 2026 01:58:00 -0400
+
+navidrome-uploader (0.1.0) unstable; urgency=medium
+
+  * Add Debian packaging with systemd service integration and venv setup.
+
+ -- Arian Nasr <arian@2ari.ca>  Tue, 07 Apr 2026 12:00:00 +0000
+

debian/control

@@ -0,0 +1,12 @@
+Source: navidrome-uploader
+Section: web
+Priority: optional
+Maintainer: Arian Nasr <arian@2ari.ca>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.7.0
+Rules-Requires-Root: no
+
+Package: navidrome-uploader
+Architecture: all
+Depends: ${misc:Depends}, adduser, python3, python3-venv, python3-pip, python3-wheel
+Description: Navidrome Web Upload Utility

debian/navidrome-uploader.dirs

@@ -0,0 +1,7 @@
+opt/navidrome-uploader
+opt/navidrome-uploader/templates
+opt/navidrome-uploader/static
+opt/navidrome-uploader/static/css
+opt/navidrome-uploader/static/js
+etc/default/navidrome-uploader
+

debian/navidrome-uploader.install

@@ -0,0 +1,9 @@
+main.py opt/navidrome-uploader/
+gunicorn.conf.py opt/navidrome-uploader/
+requirements.txt opt/navidrome-uploader/
+.env.example opt/navidrome-uploader/
+templates/* opt/navidrome-uploader/templates/
+static/css/* opt/navidrome-uploader/static/css/
+static/js/* opt/navidrome-uploader/static/js/
+contrib/navidrome-uploader.service lib/systemd/system/
+debian/wheels/* opt/navidrome-uploader/wheels/

debian/navidrome-uploader.postinst

@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+APP_DIR="/opt/navidrome-uploader"
+VENV_DIR="${APP_DIR}/venv"
+APP_USER="navidrome-uploader"
+
+case "$1" in
+  configure)
+    chown -R "$APP_USER:$APP_USER" "$APP_DIR"
+
+    runuser -u "$APP_USER" -- python3 -m venv "$VENV_DIR"
+
+    runuser -u "$APP_USER" -- "$VENV_DIR/bin/pip" install --no-cache-dir --no-index --find-links="$APP_DIR/wheels" -r "$APP_DIR/requirements.txt"
+
+    if command -v systemctl >/dev/null 2>&1; then
+      systemctl daemon-reload || true
+      systemctl enable navidrome-uploader.service || true
+      systemctl restart navidrome-uploader.service || true
+    fi
+    ;;
+esac
+
+exit 0
+
+

debian/navidrome-uploader.postrm

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+if command -v systemctl > /dev/null 2>&1; then
+    systemctl daemon-reload || true
+fi
+
+if [ "$1" = "purge" ]; then
+    rm -rf /etc/default/navidrome-uploader
+    rm -rf /opt/navidrome-uploader/venv
+    rm -rf /opt/navidrome-uploader/__pycache__
+fi
+
+exit 0
+

debian/navidrome-uploader.preinst

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -e
+
+if ! getent passwd navidrome-uploader > /dev/null 2>&1; then
+    printf "Creating navidrome-uploader user\n"
+    useradd --system --shell /usr/sbin/nologin --user-group navidrome-uploader
+fi
+
+exit 0
+

debian/navidrome-uploader.prerm

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    remove|deconfigure)
+        if command -v systemctl > /dev/null 2>&1; then
+            systemctl stop navidrome-uploader.service || true
+            systemctl disable navidrome-uploader.service || true
+        fi
+        ;;
+esac
+
+exit 0
+

debian/rules

@@ -0,0 +1,15 @@
+#!/usr/bin/make -f
+
+%:
+	dh $@
+
+override_dh_auto_build:
+	dh_auto_build
+	mkdir -p debian/wheels
+	python3 -m pip wheel --no-cache-dir -r requirements.txt pip -w debian/wheels
+
+override_dh_install:
+	dh_install
+	install -d debian/navidrome-uploader/etc/default/navidrome-uploader
+	install -m 0640 .env.example debian/navidrome-uploader/etc/default/navidrome-uploader/.env
+

debian/source/format

@@ -0,0 +1,2 @@
+3.0 (native)
+

gunicorn.conf.py

@@ -0,0 +1,16 @@
+# gunicorn.conf.py
+# Arian Nasr
+# April 4, 2026
+
+import os
+
+
+BIND_ADDRESS = os.environ.get('BIND_ADDRESS', '0.0.0.0')
+BIND_PORT = int(os.environ.get('BIND_PORT', 5001))
+
+bind = f"{BIND_ADDRESS}:{BIND_PORT}"
+workers = 2
+accesslog = "-" # Log to stdout
+errorlog = "-"  # Log to stderr
+
+# gunicorn -c gunicorn.conf.py main:app

main.py

@@ -6,11 +6,13 @@ import os
 from flask import Flask, request, render_template
 from werkzeug.utils import secure_filename
 
-UPLOAD_FOLDER = '/opt/navidrome/music'
+UPLOAD_FOLDER = os.environ.get('NAVIDROME_MUSIC_FOLDER', '/opt/navidrome/music')
 ALLOWED_EXTENSIONS = {'flac', 'mp3', 'wav'}
+MAX_CONTENT_LENGTH = 500 * 1024 * 1024
 
 app = Flask(__name__)
 app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
+app.config['MAX_CONTENT_LENGTH'] = MAX_CONTENT_LENGTH
 
 def allowed_file(filename):
     return '.' in filename and \
@@ -33,7 +35,3 @@ def upload_file():
         return render_template('success.html', success_message=f'{len(request.files)} file(s) uploaded successfully!'), 200
 
     return render_template('index.html'), 200
-
-
-if __name__ == '__main__':
-    app.run(host='192.168.2.24', port=5001, debug=False)

release/build-deb.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -eu
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+PROJECT_ROOT="$(CDPATH= cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+cd "${PROJECT_ROOT}"
+dpkg-buildpackage -us -uc -b
+

release/build-docker.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+PROJECT_ROOT="$(CDPATH= cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+cd "${PROJECT_ROOT}"
+
+docker build --platform linux/amd64 -t uploader-builder -f Dockerfile.build .
+
+docker run --rm --platform linux/amd64 -v "$(pwd)/output:/dist" uploader-builder

requirements.txt

@@ -1,7 +1,10 @@
 blinker==1.9.0
-click==8.3.1
+click==8.4.1
 Flask==3.1.3
 itsdangerous==2.2.0
 Jinja2==3.1.6
 MarkupSafe==3.0.3
-Werkzeug==3.1.6
+Werkzeug==3.1.8
+gunicorn==26.0.0
+pip==26.1.1
+packaging==26.2

templates/index.html

@@ -11,7 +11,7 @@
 <body>
     <script>
         Dropzone.options.myDropzone = {
-            parallelUploads: 2,
+            parallelUploads: 4,
             uploadMultiple: true,
             acceptedFiles: 'audio/*'
         };