Merge pull request #5227 from okxlin/feat/umbrel-round2-mazanoke-20260728

Add Mazanoke app
2026-09-27 16:01:05 +00:00 · 2026-07-28 09:17:04 +08:00
parent 6592474ea2 0125e82af2
commit 2d9909283a
9 changed files with 181 additions and 0 deletions
@@ -0,0 +1,4 @@
+PANEL_APP_PORT_HTTP=3474
+MAZANOKE_USERNAME=mazanoke
+MAZANOKE_PASSWORD=
+CONTAINER_NAME=
@@ -0,0 +1,53 @@
+additionalProperties:
+  formFields:
+    - default: 3474
+      edit: true
+      envKey: PANEL_APP_PORT_HTTP
+      labelEn: Port
+      labelZh: 端口
+      label:
+        en: Port
+        zh: 端口
+        zh-Hant: 埠
+        ja: ポート
+        ko: 포트
+        ru: Порт
+        ms: Port
+        pt-br: Porta
+      required: true
+      rule: paramPort
+      type: number
+    - default: mazanoke
+      edit: true
+      envKey: MAZANOKE_USERNAME
+      labelEn: Username
+      labelZh: 用户名
+      label:
+        en: Username
+        zh: 用户名
+        zh-Hant: 使用者名稱
+        ja: ユーザー名
+        ko: 사용자 이름
+        ru: Имя пользователя
+        ms: Nama pengguna
+        pt-br: Nome de usuário
+      required: true
+      type: text
+    - default: ""
+      edit: true
+      envKey: MAZANOKE_PASSWORD
+      labelEn: Password
+      labelZh: 密码
+      label:
+        en: Password
+        zh: 密码
+        zh-Hant: 密碼
+        ja: パスワード
+        ko: 비밀번호
+        ru: Пароль
+        ms: Kata laluan
+        pt-br: Senha
+      random: true
+      required: true
+      rule: paramComplexity
+      type: password
@@ -0,0 +1,33 @@
+services:
+  mazanoke:
+    image: "ghcr.io/civilblur/mazanoke:v1.1.6@sha256:92cc7474deb789af6549318563b7a9ee750131f9f7b297cc9c87ab67e656c22c"
+    container_name: ${CONTAINER_NAME}
+    restart: unless-stopped
+    networks:
+      - 1panel-network
+    ports:
+      - "${PANEL_APP_PORT_HTTP}:80"
+    environment:
+      - USERNAME=${MAZANOKE_USERNAME}
+      - PASSWORD=${MAZANOKE_PASSWORD}
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETUID
+      - SETGID
+      - NET_BIND_SERVICE
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/assets/images/favicon-16x16.png"]
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
+    labels:
+      createdBy: "Apps"
+
+networks:
+  1panel-network:
+    external: true
@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+set -euo pipefail
@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+set -euo pipefail
@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+set -euo pipefail
@@ -0,0 +1,55 @@
+# Mazanoke
+
+## 产品介绍
+
+Mazanoke 是可离线使用的图片优化工具。图片解码、压缩和格式转换全部在浏览器本地完成，不会上传到 Mazanoke 容器。
+
+## 主要功能
+
+- 调整图片质量、目标大小和最大宽高
+- 支持 JPG、PNG、WebP、ICO、HEIC、AVIF、TIFF、GIF 和 SVG
+- 移除 EXIF 元数据并支持剪贴板粘贴
+- 可安装为渐进式 Web 应用并离线运行
+
+## 访问说明
+
+安装后通过 `http://<服务器 IP>:<端口>` 访问，实际端口以 `PANEL_APP_PORT_HTTP` 为准。适配默认强制启用上游 Basic Auth；使用安装时配置的 `MAZANOKE_USERNAME` 和随机生成或手动设置的强密码登录。生产环境还应使用 HTTPS，避免 Basic Auth 凭据以明文 HTTP 传输。
+
+Mazanoke 不在服务器端保存或处理图片。浏览器加载应用后，所选文件只进入当前浏览器的内存和本地处理流程。
+
+## 安全与漏洞警告
+
+- 固定镜像的扫描结果为 `0 Critical / 18 High`，涉及 `apache2-utils`、c-ares、curl/libcurl、OpenSSL、Expat、libxml2 和 nghttp2。Apache 模块漏洞不在该 Nginx 静态站点中加载，默认配置未启用 HTTP/2，且图片不会到达容器；因此多数报告路径在默认部署中不可达。Nginx 仍是网络可访问服务，应限制访问范围，并在上游发布更新镜像后尽快升级。
+- 图片在浏览器中解析和转换，不会上传到容器，但恶意或畸形文件仍可能攻击浏览器及其媒体解码器。只处理可信来源的图片，在隔离的浏览器会话中检查来源不明的文件，并及时更新浏览器。
+- Basic Auth 由容器启动脚本写入 Nginx 配置。容器丢弃全部 capabilities 后仅恢复 `CHOWN`、`SETUID`、`SETGID` 和 `NET_BIND_SERVICE`，并启用 `no-new-privileges`。
+- 不要使用不受信任来源提供的共享密码。更换凭据后重启应用，并确保旧凭据未留在自动化日志或备份中。
+
+## Introduction
+
+Mazanoke is an offline-capable image optimizer. Image decoding, compression, and format conversion happen locally in the browser and files are never uploaded to the Mazanoke container.
+
+## Features
+
+- Image quality, target size, and maximum-dimension controls
+- JPG, PNG, WebP, ICO, HEIC, AVIF, TIFF, GIF, and SVG support
+- EXIF removal and clipboard paste support
+- Installable progressive web app with offline operation
+
+## Usage Notes
+
+- Access the service at `http://<server-ip>:<port>`. This adaptation requires upstream Basic Auth. Sign in with the configured `MAZANOKE_USERNAME` and generated or user-supplied strong password.
+- Use HTTPS in production so Basic Auth credentials are not transmitted over plaintext HTTP.
+- Selected images remain in the browser's memory and local processing flow; the server only delivers static application files.
+
+## Security and Vulnerability Warning
+
+- The pinned image scans as `0 Critical / 18 High` across `apache2-utils`, c-ares, curl/libcurl, OpenSSL, Expat, libxml2, and nghttp2. Apache module findings are not loaded by this Nginx static site, HTTP/2 is not enabled in the default configuration, and images never reach the container, so most reported paths are unreachable by default. Nginx remains network-facing; restrict exposure and upgrade promptly when upstream publishes a refreshed image.
+- Images are parsed and converted in the browser rather than uploaded to the container, but malicious or malformed files may still target the browser and its media decoders. Process trusted images only, inspect unknown files in an isolated browser session, and keep the browser current.
+- The container drops all capabilities and restores only `CHOWN`, `SETUID`, `SETGID`, and `NET_BIND_SERVICE`, with `no-new-privileges` enabled.
+
+## References
+
+- Project: <https://github.com/civilblur/mazanoke>
+- Docker deployment: <https://github.com/civilblur/mazanoke#docker>
+- Configuration: <https://github.com/civilblur/mazanoke/blob/main/docs/configuration.md>
+- License: <https://github.com/civilblur/mazanoke/blob/main/LICENSE> (GPL-3.0)
@@ -0,0 +1,30 @@
+name: Mazanoke
+tags:
+  - Tools
+title: 浏览器本地图片优化工具
+description: 浏览器本地图片优化工具
+additionalProperties:
+  key: mazanoke
+  name: Mazanoke
+  tags:
+    - Tools
+  shortDescZh: 浏览器本地图片优化工具
+  shortDescEn: A browser-local image optimizer
+  description:
+    en: A browser-local image optimizer
+    zh: 浏览器本地图片优化工具
+    zh-Hant: 瀏覽器本機圖片最佳化工具
+    ja: ブラウザー内で動作する画像最適化ツール
+    ko: 브라우저에서 로컬로 실행되는 이미지 최적화 도구
+    ru: Локальный браузерный оптимизатор изображений
+    ms: Pengoptimum imej setempat dalam pelayar
+    pt-br: Otimizador de imagens local no navegador
+  type: website
+  crossVersionUpdate: true
+  limit: 0
+  website: https://mazanoke.com/
+  github: https://github.com/civilblur/mazanoke
+  document: https://github.com/civilblur/mazanoke#docker
+  architectures:
+    - amd64
+    - arm64