chore(deps): update Dropzone.js upstream source

Signed-off-by: Arian Nasr <arian@2ari.ca>

.gitea/workflows/build-deb.yml

@@ -0,0 +1,31 @@
+name: Build Debian Package
+
+on:
+  push:
+    branches:
+      - '**'
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Make scripts executable
+        run: |
+          chmod +x release/build-docker.sh
+          chmod +x release/build-deb.sh
+
+      - name: Build Debian Package
+        run: ./release/build-docker.sh
+
+      - name: Upload Build Artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: navidrome-uploader-deb
+          path: output/*.deb
+          retention-days: 5

.gitignore

@@ -4,4 +4,5 @@ navidrome-upload.service
 .idea/
 .env
 /README.md
-__pycache__/
+__pycache__/
+*.deb

Dockerfile.build

@@ -0,0 +1,29 @@
+# Navidome-Uploader Dockerfile for building .deb packages
+# Arian Nasr
+# May 9, 2026
+
+FROM debian:13-slim
+
+# Prevent interactive prompts
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    debhelper \
+    devscripts \
+    fakeroot \
+    python3 \
+    python3-venv \
+    python3-pip \
+    python3-wheel \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build/src
+
+RUN mkdir -p /dist
+
+COPY . .
+
+RUN chmod +x release/build-deb.sh
+
+CMD ["sh", "-c", "./release/build-deb.sh && mv ../*.deb /dist/"]

LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Arian Nasr (arian-nasr) - arian@2ari.ca
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

contrib/navidrome-uploader.service

@@ -9,7 +9,7 @@ Group=navidrome-uploader
 WorkingDirectory=/opt/navidrome-uploader
 Environment="PATH=/opt/navidrome-uploader/venv/bin"
 EnvironmentFile=/etc/default/navidrome-uploader/.env
-ExecStart=/opt/navidrome-uploader/venv/bin/gunicorn -c gunicorn.conf.py main:app
+ExecStart=/opt/navidrome-uploader/venv/bin/gunicorn --no-control-socket -c gunicorn.conf.py main:app
 Restart=on-failure
 RestartSec=30
 

debian/changelog

@@ -1,3 +1,34 @@
+navidrome-uploader (0.2.0) unstable; urgency=medium
+
+  * Packaging:
+    - Bundle pip wheels during build for offline host installation
+    - Ensure debian build environment includes pip and wheel modules
+  * Docker:
+    - Implement containerized debian packaging automation scripts
+  * Security:
+    - Add MAX_CONTENT_LENGTH to prevent upload DoS vectors
+  * Bug Fixes:
+    - Fix apt purge leaving pycache and systemd directory remnants
+  * Frontend:
+    - Change Dropzone.js upstream source location
+  * Maintenance:
+    - Add the open source software MIT license
+    - Upstream package & dependency updates
+
+ -- Arian Nasr <arian@2ari.ca>  Mon, 25 May 2026 18:31:00 -0400
+
+navidrome-uploader (0.1.0-2) unstable; urgency=high
+
+  * Run pip install stage as navidrome-uploader user instead of root
+
+ -- Arian Nasr <arian@2ari.ca>  Tue, 14 Apr 2026 12:11:00 -0400
+
+navidrome-uploader (0.1.0-1) unstable; urgency=medium
+
+  * Disable gunicorn control socket in systemd service unit
+
+ -- Arian Nasr <arian@2ari.ca>  Thu, 09 Apr 2026 01:58:00 -0400
+
 navidrome-uploader (0.1.0) unstable; urgency=medium
 
   * Add Debian packaging with systemd service integration and venv setup.

debian/control

@@ -8,5 +8,5 @@ Rules-Requires-Root: no
 
 Package: navidrome-uploader
 Architecture: all
-Depends: ${misc:Depends}, adduser, python3, python3-venv
-Description: Navidrome Web Upload Utility
+Depends: ${misc:Depends}, adduser, python3, python3-venv, python3-pip, python3-wheel
+Description: Navidrome Web Upload Utility

debian/navidrome-uploader.install

@@ -6,4 +6,4 @@ templates/* opt/navidrome-uploader/templates/
 static/css/* opt/navidrome-uploader/static/css/
 static/js/* opt/navidrome-uploader/static/js/
 contrib/navidrome-uploader.service lib/systemd/system/
-
+debian/wheels/* opt/navidrome-uploader/wheels/

debian/navidrome-uploader.postinst

@@ -3,20 +3,24 @@ set -e
 
 APP_DIR="/opt/navidrome-uploader"
 VENV_DIR="${APP_DIR}/venv"
+APP_USER="navidrome-uploader"
 
 case "$1" in
-    configure)
-        python3 -m venv "${VENV_DIR}"
-        "${VENV_DIR}/bin/pip" install --no-cache-dir --upgrade pip
-        "${VENV_DIR}/bin/pip" install --no-cache-dir -r "${APP_DIR}/requirements.txt"
+  configure)
+    chown -R "$APP_USER:$APP_USER" "$APP_DIR"
 
-        if command -v systemctl > /dev/null 2>&1; then
-            systemctl daemon-reload || true
-            systemctl enable navidrome-uploader.service || true
-            systemctl restart navidrome-uploader.service || true
-        fi
-        ;;
+    runuser -u "$APP_USER" -- python3 -m venv "$VENV_DIR"
+
+    runuser -u "$APP_USER" -- "$VENV_DIR/bin/pip" install --no-cache-dir --no-index --find-links="$APP_DIR/wheels" -r "$APP_DIR/requirements.txt"
+
+    if command -v systemctl >/dev/null 2>&1; then
+      systemctl daemon-reload || true
+      systemctl enable navidrome-uploader.service || true
+      systemctl restart navidrome-uploader.service || true
+    fi
+    ;;
 esac
 
 exit 0
 
+

debian/navidrome-uploader.postrm

@@ -8,6 +8,7 @@ fi
 if [ "$1" = "purge" ]; then
     rm -rf /etc/default/navidrome-uploader
     rm -rf /opt/navidrome-uploader/venv
+    rm -rf /opt/navidrome-uploader/__pycache__
 fi
 
 exit 0

debian/rules

@@ -3,6 +3,11 @@
 %:
 	dh $@
 
+override_dh_auto_build:
+	dh_auto_build
+	mkdir -p debian/wheels
+	python3 -m pip wheel --no-cache-dir -r requirements.txt pip -w debian/wheels
+
 override_dh_install:
 	dh_install
 	install -d debian/navidrome-uploader/etc/default/navidrome-uploader

main.py

@@ -3,14 +3,16 @@
 # March 6, 2026
 
 import os
-from flask import Flask, request, render_template
+from flask import Flask, request, render_template, jsonify
 from werkzeug.utils import secure_filename
 
 UPLOAD_FOLDER = os.environ.get('NAVIDROME_MUSIC_FOLDER', '/opt/navidrome/music')
 ALLOWED_EXTENSIONS = {'flac', 'mp3', 'wav'}
+MAX_CONTENT_LENGTH = 500 * 1024 * 1024
 
 app = Flask(__name__)
 app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
+app.config['MAX_CONTENT_LENGTH'] = MAX_CONTENT_LENGTH
 
 def allowed_file(filename):
     return '.' in filename and \
@@ -23,13 +25,15 @@ def ping():
 @app.route('/', methods=['GET', 'POST'])
 def upload_file():
     if request.method == 'POST':
+        uploaded_count = 0
         for key, file in request.files.items():
             if key.startswith('file') and file and allowed_file(file.filename) and file.filename != '':
                 filename = secure_filename(file.filename)
                 file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename))
+                uploaded_count += 1
             else:
-                return render_template('error.html', error_message=f'File is not allowed.'), 400
+                return jsonify({"error": f"File '{file.filename}' is not allowed or is empty."}), 400
 
-        return render_template('success.html', success_message=f'{len(request.files)} file(s) uploaded successfully!'), 200
+        return jsonify({"message": f"{uploaded_count} file(s) uploaded successfully!"}), 200
 
     return render_template('index.html'), 200

release/build-docker.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -eu
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+PROJECT_ROOT="$(CDPATH= cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+cd "${PROJECT_ROOT}"
+
+docker build --platform linux/amd64 -t uploader-builder -f Dockerfile.build .
+
+docker run --name uploader-builder-container --platform linux/amd64 uploader-builder
+
+docker cp uploader-builder-container:/dist/. output/
+
+docker rm uploader-builder-container

requirements.txt

@@ -1,8 +1,10 @@
 blinker==1.9.0
-click==8.3.2
+click==8.4.1
 Flask==3.1.3
 itsdangerous==2.2.0
 Jinja2==3.1.6
 MarkupSafe==3.0.3
 Werkzeug==3.1.8
-gunicorn==25.3.0
+gunicorn==26.0.0
+pip==26.1.1
+packaging==26.2

static/css/dropzone.css

@@ -0,0 +1 @@
+@keyframes passing-through{0%{opacity:0;transform:translateY(40px)}30%,70%{opacity:1;transform:translateY(0px)}100%{opacity:0;transform:translateY(-40px)}}@keyframes slide-in{0%{opacity:0;transform:translateY(40px)}30%{opacity:1;transform:translateY(0px)}}@keyframes pulse{0%{transform:scale(1)}10%{transform:scale(1.1)}20%{transform:scale(1)}}.dropzone,.dropzone *{box-sizing:border-box}.dropzone{min-height:150px;border:1px solid rgba(0,0,0,.8);border-radius:5px;padding:20px 20px}.dropzone.dz-clickable{cursor:pointer}.dropzone.dz-clickable *{cursor:default}.dropzone.dz-clickable .dz-message,.dropzone.dz-clickable .dz-message *{cursor:pointer}.dropzone.dz-started .dz-message{display:none}.dropzone.dz-drag-hover{border-style:solid}.dropzone.dz-drag-hover .dz-message{opacity:.5}.dropzone .dz-message{text-align:center;margin:3em 0}.dropzone .dz-message .dz-button{background:none;color:inherit;border:none;padding:0;font:inherit;cursor:pointer;outline:inherit}.dropzone .dz-preview{position:relative;display:inline-block;vertical-align:top;margin:16px;min-height:100px}.dropzone .dz-preview:hover{z-index:1000}.dropzone .dz-preview:hover .dz-details{opacity:1}.dropzone .dz-preview.dz-file-preview .dz-image{border-radius:20px;background:#999;background:linear-gradient(to bottom, #eee, #ddd)}.dropzone .dz-preview.dz-file-preview .dz-details{opacity:1}.dropzone .dz-preview.dz-image-preview{background:#fff}.dropzone .dz-preview.dz-image-preview .dz-details{transition:opacity .2s linear}.dropzone .dz-preview .dz-remove{font-size:14px;text-align:center;display:block;cursor:pointer;border:none}.dropzone .dz-preview .dz-remove:hover{text-decoration:underline}.dropzone .dz-preview:hover .dz-details{opacity:1}.dropzone .dz-preview .dz-details{z-index:20;position:absolute;top:0;left:0;opacity:0;font-size:13px;min-width:100%;max-width:100%;padding:2em 1em;text-align:center;color:rgba(0,0,0,.9);line-height:150%}.dropzone .dz-preview .dz-details .dz-size{margin-bottom:1em;font-size:16px}.dropzone .dz-preview .dz-details .dz-filename{white-space:nowrap}.dropzone .dz-preview .dz-details .dz-filename:hover span{border:1px solid rgba(200,200,200,.8);background-color:hsla(0,0%,100%,.8)}.dropzone .dz-preview .dz-details .dz-filename:not(:hover){overflow:hidden;text-overflow:ellipsis}.dropzone .dz-preview .dz-details .dz-filename:not(:hover) span{border:1px solid rgba(0,0,0,0)}.dropzone .dz-preview .dz-details .dz-filename span,.dropzone .dz-preview .dz-details .dz-size span{background-color:hsla(0,0%,100%,.4);padding:0 .4em;border-radius:3px}.dropzone .dz-preview:hover .dz-image img{transform:scale(1.05, 1.05);filter:blur(8px)}.dropzone .dz-preview .dz-image{border-radius:20px;overflow:hidden;width:120px;height:120px;position:relative;display:block;z-index:10}.dropzone .dz-preview .dz-image img{display:block}.dropzone .dz-preview.dz-success .dz-success-mark{animation:passing-through 3s cubic-bezier(0.77, 0, 0.175, 1)}.dropzone .dz-preview.dz-error .dz-error-mark{opacity:1;animation:slide-in 3s cubic-bezier(0.77, 0, 0.175, 1)}.dropzone .dz-preview .dz-success-mark,.dropzone .dz-preview .dz-error-mark{pointer-events:none;opacity:0;z-index:500;position:absolute;display:block;top:50%;left:50%;margin-left:-27px;margin-top:-27px;background:rgba(0,0,0,.8);border-radius:50%}.dropzone .dz-preview .dz-success-mark svg,.dropzone .dz-preview .dz-error-mark svg{display:block;width:54px;height:54px;fill:#fff}.dropzone .dz-preview.dz-processing .dz-progress{opacity:1;transition:all .2s linear}.dropzone .dz-preview.dz-complete .dz-progress{opacity:0;transition:opacity .4s ease-in}.dropzone .dz-preview:not(.dz-processing) .dz-progress{animation:pulse 6s ease infinite}.dropzone .dz-preview .dz-progress{opacity:1;z-index:1000;pointer-events:none;position:absolute;height:20px;top:50%;margin-top:-10px;left:15%;right:15%;border:3px solid rgba(0,0,0,.8);background:rgba(0,0,0,.8);border-radius:10px;overflow:hidden}.dropzone .dz-preview .dz-progress .dz-upload{background:#fff;display:block;position:relative;height:100%;width:0;transition:width 300ms ease-in-out;border-radius:17px}.dropzone .dz-preview.dz-error .dz-error-message{display:block}.dropzone .dz-preview.dz-error:hover .dz-error-message{opacity:1;pointer-events:auto}.dropzone .dz-preview .dz-error-message{pointer-events:none;z-index:1000;position:absolute;display:block;display:none;opacity:0;transition:opacity .3s ease;border-radius:8px;font-size:13px;top:130px;left:-10px;width:140px;background:#b10606;padding:.5em 1em;color:#fff}.dropzone .dz-preview .dz-error-message:after{content:"";position:absolute;top:-6px;left:64px;width:0;height:0;border-left:6px solid rgba(0,0,0,0);border-right:6px solid rgba(0,0,0,0);border-bottom:6px solid #b10606}/*# sourceMappingURL=dropzone.css.map */

templates/error.html

@@ -1,14 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Error - Upload Music</title>
-    <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}" type="text/css" />
-</head>
-<body>
-    <h1>Error</h1>
-    <p>{{ error_message }}</p>
-    <a href="/"><button>Upload another file</button></a>
-</body>
-</html>

templates/index.html

@@ -5,19 +5,22 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Upload Music</title>
     <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}" type="text/css" />
-    <script src="{{ url_for('static', filename='js/dropzone.min.js') }}"></script>
-    <link rel="stylesheet" href="{{ url_for('static', filename='css/dropzone.min.css') }}" type="text/css" />
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/dropzone.css') }}" type="text/css" />
 </head>
 <body>
-    <script>
-        Dropzone.options.myDropzone = {
-            parallelUploads: 4,
-            uploadMultiple: true,
-            acceptedFiles: 'audio/*'
-        };
-    </script>
-    <form action="/"
-          class="dropzone"
-          id="my-dropzone"></form>
+  <form action="/"
+        class="dropzone"
+        id="my-dropzone"
+        enctype="multipart/form-data"></form>
+
+  <script src="{{ url_for('static', filename='js/dropzone-min.js') }}"></script>
+  <script>
+    const dz = new Dropzone("#my-dropzone", {
+      url: "/",
+      parallelUploads: 4,
+      uploadMultiple: true,
+      acceptedFiles: "audio/*"
+    });
+  </script>
 </body>
 </html>

templates/success.html

@@ -1,14 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Success - Upload Music</title>
-    <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}" type="text/css" />
-</head>
-<body>
-    <h1>Success</h1>
-    <p>{{ success_message }}</p>
-    <a href="/"><button>Upload another file</button></a>
-</body>
-</html>