Merge branch 'deb-packaging'

Signed-off-by: Arian Nasr <arian@2ari.ca>

.gitignore

@@ -5,3 +5,4 @@ navidrome-upload.service
 .env
 /README.md
 __pycache__/
+*.deb

Dockerfile.build

@@ -0,0 +1,29 @@
+# Navidome-Uploader Dockerfile for building .deb packages
+# Arian Nasr
+# May 9, 2026
+
+FROM debian:13-slim
+
+# Prevent interactive prompts
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    debhelper \
+    devscripts \
+    fakeroot \
+    python3 \
+    python3-venv \
+    python3-pip \
+    python3-wheel \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build/src
+
+RUN mkdir -p /dist
+
+COPY . .
+
+RUN chmod +x release/build-deb.sh
+
+CMD ["sh", "-c", "./release/build-deb.sh && mv ../*.deb /dist/"]

LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Arian Nasr (arian-nasr) - arian@2ari.ca
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

contrib/navidrome-uploader.service

@@ -9,7 +9,7 @@ Group=navidrome-uploader
 WorkingDirectory=/opt/navidrome-uploader
 Environment="PATH=/opt/navidrome-uploader/venv/bin"
 EnvironmentFile=/etc/default/navidrome-uploader/.env
-ExecStart=/opt/navidrome-uploader/venv/bin/gunicorn -c gunicorn.conf.py main:app
+ExecStart=/opt/navidrome-uploader/venv/bin/gunicorn --no-control-socket -c gunicorn.conf.py main:app
 Restart=on-failure
 RestartSec=30
 

debian/changelog

@@ -1,3 +1,34 @@
+navidrome-uploader (0.2.0) unstable; urgency=medium
+
+  * Packaging:
+    - Bundle pip wheels during build for offline host installation
+    - Ensure debian build environment includes pip and wheel modules
+  * Docker:
+    - Implement containerized debian packaging automation scripts
+  * Security:
+    - Add MAX_CONTENT_LENGTH to prevent upload DoS vectors
+  * Bug Fixes:
+    - Fix apt purge leaving pycache and systemd directory remnants
+  * Frontend:
+    - Change Dropzone.js upstream source location
+  * Maintenance:
+    - Add the open source software MIT license
+    - Upstream package & dependency updates
+
+ -- Arian Nasr <arian@2ari.ca>  Mon, 25 May 2026 18:31:00 -0400
+
+navidrome-uploader (0.1.0-2) unstable; urgency=high
+
+  * Run pip install stage as navidrome-uploader user instead of root
+
+ -- Arian Nasr <arian@2ari.ca>  Tue, 14 Apr 2026 12:11:00 -0400
+
+navidrome-uploader (0.1.0-1) unstable; urgency=medium
+
+  * Disable gunicorn control socket in systemd service unit
+
+ -- Arian Nasr <arian@2ari.ca>  Thu, 09 Apr 2026 01:58:00 -0400
+
 navidrome-uploader (0.1.0) unstable; urgency=medium
 
   * Add Debian packaging with systemd service integration and venv setup.

debian/control

@@ -8,5 +8,5 @@ Rules-Requires-Root: no
 
 Package: navidrome-uploader
 Architecture: all
-Depends: ${misc:Depends}, adduser, python3, python3-venv
+Depends: ${misc:Depends}, adduser, python3, python3-venv, python3-pip, python3-wheel
 Description: Navidrome Web Upload Utility

debian/navidrome-uploader.install

@@ -6,4 +6,4 @@ templates/* opt/navidrome-uploader/templates/
 static/css/* opt/navidrome-uploader/static/css/
 static/js/* opt/navidrome-uploader/static/js/
 contrib/navidrome-uploader.service lib/systemd/system/
-
+debian/wheels/* opt/navidrome-uploader/wheels/

debian/navidrome-uploader.postinst

@@ -3,14 +3,17 @@ set -e
 
 APP_DIR="/opt/navidrome-uploader"
 VENV_DIR="${APP_DIR}/venv"
+APP_USER="navidrome-uploader"
 
 case "$1" in
   configure)
-        python3 -m venv "${VENV_DIR}"
-        "${VENV_DIR}/bin/pip" install --no-cache-dir --upgrade pip
-        "${VENV_DIR}/bin/pip" install --no-cache-dir -r "${APP_DIR}/requirements.txt"
+    chown -R "$APP_USER:$APP_USER" "$APP_DIR"
 
-        if command -v systemctl > /dev/null 2>&1; then
+    runuser -u "$APP_USER" -- python3 -m venv "$VENV_DIR"
+
+    runuser -u "$APP_USER" -- "$VENV_DIR/bin/pip" install --no-cache-dir --no-index --find-links="$APP_DIR/wheels" -r "$APP_DIR/requirements.txt"
+
+    if command -v systemctl >/dev/null 2>&1; then
       systemctl daemon-reload || true
       systemctl enable navidrome-uploader.service || true
       systemctl restart navidrome-uploader.service || true
@@ -20,3 +23,4 @@ esac
 
 exit 0
 
+

debian/navidrome-uploader.postrm

@@ -8,6 +8,7 @@ fi
 if [ "$1" = "purge" ]; then
     rm -rf /etc/default/navidrome-uploader
     rm -rf /opt/navidrome-uploader/venv
+    rm -rf /opt/navidrome-uploader/__pycache__
 fi
 
 exit 0

debian/rules

@@ -3,6 +3,11 @@
 %:
 	dh $@
 
+override_dh_auto_build:
+	dh_auto_build
+	mkdir -p debian/wheels
+	python3 -m pip wheel --no-cache-dir -r requirements.txt pip -w debian/wheels
+
 override_dh_install:
 	dh_install
 	install -d debian/navidrome-uploader/etc/default/navidrome-uploader

main.py

@@ -8,9 +8,11 @@ from werkzeug.utils import secure_filename
 
 UPLOAD_FOLDER = os.environ.get('NAVIDROME_MUSIC_FOLDER', '/opt/navidrome/music')
 ALLOWED_EXTENSIONS = {'flac', 'mp3', 'wav'}
+MAX_CONTENT_LENGTH = 500 * 1024 * 1024
 
 app = Flask(__name__)
 app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
+app.config['MAX_CONTENT_LENGTH'] = MAX_CONTENT_LENGTH
 
 def allowed_file(filename):
     return '.' in filename and \

release/build-docker.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+PROJECT_ROOT="$(CDPATH= cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+cd "${PROJECT_ROOT}"
+
+docker build --platform linux/amd64 -t uploader-builder -f Dockerfile.build .
+
+docker run --rm --platform linux/amd64 -v "$(pwd)/output:/dist" uploader-builder

requirements.txt

@@ -1,8 +1,10 @@
 blinker==1.9.0
-click==8.3.2
+click==8.4.1
 Flask==3.1.3
 itsdangerous==2.2.0
 Jinja2==3.1.6
 MarkupSafe==3.0.3
 Werkzeug==3.1.8
-gunicorn==25.3.0
+gunicorn==26.0.0
+pip==26.1.1
+packaging==26.2