jozamudi
aae5857dba
- /stream/{token}: tokens are plain base64; allowlist https://hls.anidb.app
so a session can't use the proxy for arbitrary URLs (new test)
- X-Aniweb:1 required on POST/DELETE except /login — SameSite=Lax is
still sent on cross-site form POSTs, which could hit /account/delete
(new test; SPA + tests send the header)
- tmp+os.replace writes for users/history/searches: a crash mid-write
could corrupt the JSON -> load() returned {} -> silent data loss
- resume positions now read from full history (?all=1), not top-5
- pagehide bound once; savePos reads currentEp (no stale closures)
- account delete also removes the searches file; episodes TTL 5m
- ani-web.service: supervised restart (not installed; see header)
- gitignore pi-session dumps + .pytest_cache
18 lines
663 B
Desktop File
18 lines
663 B
Desktop File
# Supervised replacement for run.sh's nohup (crash -> auto-restart).
|
|
# Install (then stop the run.sh instance: pkill -f 'uvicorn .*app:app'):
|
|
# sudo ln -s /home/jozamudi/code/ani-cli-front-end/ani-web.service /etc/systemd/system/
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now ani-web
|
|
[Unit]
|
|
Description=ani-web (FastAPI anime front-end)
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
WorkingDirectory=/home/jozamudi/code/ani-cli-front-end
|
|
Environment=ANIWEB_SECURE=1
|
|
ExecStart=/home/jozamudi/code/ani-cli-front-end/.venv/bin/python -m uvicorn server.app:app --host 0.0.0.0 --port 8321
|
|
Restart=always
|
|
RestartSec=2
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|