feat(app): add Wayback

2026-09-22 16:00:58 +00:00 · 2026-07-28 20:44:27 +08:00
parent e09f914f06
commit fb64e70d74
18 changed files with 532 additions and 0 deletions
@@ -0,0 +1,7 @@
+CONTAINER_NAME="wayback"
+PANEL_APP_BIND_ADDRESS="127.0.0.1"
+PANEL_APP_PORT_HTTP="8964"
+DATA_PATH="./data"
+WAYBACK_POOLING_SIZE="3"
+WAYBACK_TIMEOUT="300"
+WAYBACK_MAX_MEDIA_SIZE="512MB"
@@ -0,0 +1,99 @@
+additionalProperties:
+  formFields:
+    - default: 127.0.0.1
+      edit: true
+      envKey: PANEL_APP_BIND_ADDRESS
+      labelEn: Bind Address
+      labelZh: 绑定地址
+      label:
+        en: Bind Address
+        zh: 绑定地址
+        zh-Hant: 綁定位址
+        ja: バインドアドレス
+        ko: 바인드 주소
+        ru: Адрес привязки
+        ms: Alamat ikatan
+        pt-br: Endereco de vinculacao
+      required: true
+      type: text
+    - default: 8964
+      edit: true
+      envKey: PANEL_APP_PORT_HTTP
+      labelEn: HTTP Port
+      labelZh: HTTP 端口
+      label:
+        en: HTTP Port
+        zh: HTTP 端口
+        zh-Hant: HTTP 連接埠
+        ja: HTTP ポート
+        ko: HTTP 포트
+        ru: HTTP-порт
+        ms: Port HTTP
+        pt-br: Porta HTTP
+      required: true
+      rule: paramPort
+      type: number
+    - default: ./data
+      edit: true
+      envKey: DATA_PATH
+      labelEn: Data Folder Path
+      labelZh: 数据文件夹路径
+      label:
+        en: Data Folder Path
+        zh: 数据文件夹路径
+        zh-Hant: 資料夾路徑
+        ja: データフォルダのパス
+        ko: 데이터 폴더 경로
+        ru: Путь к папке данных
+        ms: Laluan folder data
+        pt-br: Caminho da pasta de dados
+      required: true
+      type: text
+    - default: 3
+      edit: true
+      envKey: WAYBACK_POOLING_SIZE
+      labelEn: Concurrent Jobs
+      labelZh: 并发任务数
+      label:
+        en: Concurrent Jobs
+        zh: 并发任务数
+        zh-Hant: 並行工作數
+        ja: 同時実行ジョブ数
+        ko: 동시 작업 수
+        ru: Параллельные задания
+        ms: Kerja serentak
+        pt-br: Tarefas simultaneas
+      required: true
+      type: number
+    - default: 300
+      edit: true
+      envKey: WAYBACK_TIMEOUT
+      labelEn: Archive Timeout Seconds
+      labelZh: 归档超时秒数
+      label:
+        en: Archive Timeout Seconds
+        zh: 归档超时秒数
+        zh-Hant: 封存逾時秒數
+        ja: アーカイブのタイムアウト秒数
+        ko: 아카이브 제한 시간(초)
+        ru: Тайм-аут архивации в секундах
+        ms: Tamat masa arkib dalam saat
+        pt-br: Tempo limite de arquivamento em segundos
+      required: true
+      type: number
+    - default: 512MB
+      edit: true
+      envKey: WAYBACK_MAX_MEDIA_SIZE
+      labelEn: Maximum Media Size
+      labelZh: 最大媒体大小
+      label:
+        en: Maximum Media Size
+        zh: 最大媒体大小
+        zh-Hant: 最大媒體大小
+        ja: 最大メディアサイズ
+        ko: 최대 미디어 크기
+        ru: Максимальный размер медиафайла
+        ms: Saiz media maksimum
+        pt-br: Tamanho maximo de midia
+      required: true
+      type: text
@@ -0,0 +1 @@
+
@@ -0,0 +1,39 @@
+services:
+  wayback:
+    image: "wabarc/wayback:0.21.1@sha256:60cc26d4678462a866d34866d2f1d07c0419d4b87940640bdf2e3030e3b77a06"
+    container_name: ${CONTAINER_NAME}
+    restart: unless-stopped
+    command: ["wayback", "--ia", "--is", "--ga", "-d", "web"]
+    networks:
+      - 1panel-network
+    ports:
+      - "${PANEL_APP_BIND_ADDRESS}:${PANEL_APP_PORT_HTTP}:8964"
+    user: "100:101"
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      - WAYBACK_LISTEN_ADDR=0.0.0.0:8964
+      - WAYBACK_BOLT_PATH=/data/wayback.db
+      - WAYBACK_POOLING_SIZE=${WAYBACK_POOLING_SIZE}
+      - WAYBACK_TIMEOUT=${WAYBACK_TIMEOUT}
+      - WAYBACK_MAX_MEDIA_SIZE=${WAYBACK_MAX_MEDIA_SIZE}
+      - WAYBACK_ONION_DISABLED=true
+    volumes:
+      - "${DATA_PATH}:/data"
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=256m
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1:8964/healthcheck | grep -qx OK"]
+      interval: 10s
+      timeout: 5s
+      start_period: 20s
+      retries: 12
+    labels:
+      createdBy: "Apps"
+
+networks:
+  1panel-network:
+    external: true
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+ENV_FILE="${ENV_FILE:-${ROOT_DIR}/.env}"
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 1
+}
+
+read_env_value() {
+  local key="$1"
+  local value=""
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+validate_ipv4() {
+  local value="$1"
+  local part
+  local -a parts
+  IFS='.' read -r -a parts <<< "$value"
+  [[ ${#parts[@]} -eq 4 ]] || return 1
+  for part in "${parts[@]}"; do
+    [[ "$part" =~ ^[0-9]{1,3}$ ]] || return 1
+    (( 10#$part <= 255 )) || return 1
+  done
+}
+
+[[ -f "$ENV_FILE" ]] || fail "$ENV_FILE not found"
+[[ ! -L "$ENV_FILE" ]] || fail "$ENV_FILE must not be a symbolic link"
+
+bind_address="$(read_env_value PANEL_APP_BIND_ADDRESS)"
+validate_ipv4 "$bind_address" || fail "PANEL_APP_BIND_ADDRESS must be an IPv4 address"
+
+pooling_size="$(read_env_value WAYBACK_POOLING_SIZE)"
+[[ "$pooling_size" =~ ^[0-9]+$ ]] || fail "WAYBACK_POOLING_SIZE must be an integer"
+(( pooling_size >= 1 && pooling_size <= 32 )) || fail "WAYBACK_POOLING_SIZE must be between 1 and 32"
+
+timeout="$(read_env_value WAYBACK_TIMEOUT)"
+[[ "$timeout" =~ ^[0-9]+$ ]] || fail "WAYBACK_TIMEOUT must be an integer"
+(( timeout >= 10 && timeout <= 3600 )) || fail "WAYBACK_TIMEOUT must be between 10 and 3600"
+
+media_size="$(read_env_value WAYBACK_MAX_MEDIA_SIZE)"
+[[ "$media_size" =~ ^[1-9][0-9]{0,4}(MB|GB)$ ]] || fail "WAYBACK_MAX_MEDIA_SIZE must use MB or GB, for example 512MB"
+
+data_path="$(read_env_value DATA_PATH)"
+[[ "$data_path" =~ ^\./[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$ ]] || fail "DATA_PATH must be a relative path inside the app directory"
+[[ "/$data_path/" != *"/../"* ]] || fail "DATA_PATH must not contain parent traversal"
+
+data_dir="${ROOT_DIR}/${data_path#./}"
+canonical_root="$(realpath -m -- "$ROOT_DIR")"
+canonical_data="$(realpath -m -- "$data_dir")"
+[[ "$canonical_data" == "$canonical_root"/* ]] || fail "DATA_PATH resolves outside the app directory"
+[[ ! -L "$data_dir" ]] || fail "DATA_PATH must not be a symbolic link"
+
+umask 077
+mkdir -p "$data_dir"
+chown -R 100:101 "$data_dir"
+chmod 750 "$data_dir"
+chmod 600 "$ENV_FILE"
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v docker-compose >/dev/null 2>&1; then
+  docker-compose down --remove-orphans
+else
+  docker compose down --remove-orphans
+fi
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+exec bash "${SCRIPT_DIR}/init.sh"
@@ -0,0 +1,44 @@
+# Wayback
+
+## 产品介绍
+
+Wayback 是开源的网页归档与回放工具。它提供 Web 界面，可将网页提交到 Internet Archive、archive.today 和 Ghostarchive，并聚合多个公共归档服务的回放结果。
+
+## 主要功能
+
+- 从 Web 界面提交一个或多个网页地址
+- 聚合多个公共归档服务的结果
+- 使用本地 Bolt 数据库保存应用状态
+
+## 访问说明
+
+- 默认仅监听 `127.0.0.1:8964`，实际地址和端口以安装表单为准。远程访问建议使用 HTTPS 反向代理，不要直接暴露到公网。
+- Wayback Web 界面没有内置用户认证。能够访问该界面的用户可以让服务器请求外部 URL，并可能访问服务器可达的内部地址。请使用反向代理认证、网络访问控制和出站防火墙限制不受信任用户。
+- 默认禁用 Wayback 的 Tor、Telegraph 和 IPFS 集成。官方 Compose 中的无头浏览器不能绕过当前应用对本地 Chromium 的前置检查，同时其当前镜像存在 Critical 漏洞，因此本包不包含该可选依赖。
+- Meilisearch 是可选的归档索引与回放增强服务，不属于本包的默认拓扑。
+- 当前官方 Wayback 镜像的安全扫描结果为 0 个 Critical、7 个 High。源码与运行路径复核未发现这些 High 在本包默认配置下的可达路径，但相关上游组件仍保留在镜像中；上游发布修复镜像后应及时更新。
+
+## 数据与备份
+
+应用数据保存在 `DATA_PATH`，其中 `wayback.db` 是 Bolt 数据库。升级或卸载前请备份整个目录。
+
+## Introduction
+
+Wayback is an open-source web archiving and playback tool. This package runs the official single image in Web mode with Internet Archive, archive.today, and Ghostarchive enabled. Optional browser, Telegraph, IPFS, Tor, and Meilisearch integrations are not enabled by default.
+
+The Web interface has no built-in authentication and can make outbound requests to user-supplied URLs. Keep the default loopback binding or place it behind an authenticated HTTPS reverse proxy with appropriate egress controls. Back up the complete data directory before upgrades or uninstalling.
+
+The current official Wayback image scans at 0 Critical and 7 High findings. Source and runtime-path review found no demonstrated reachability in this package's default configuration, but the affected upstream components remain present and the package should be updated when upstream publishes a fixed image.
+
+## Features
+
+- Submit one or more URLs from the Web interface
+- Collect results from multiple public archive services
+- Persist application state in a local Bolt database
+
+## References
+
+- Website: <https://wabarc.eu.org/>
+- Source: <https://github.com/wabarc/wayback>
+- Documentation: <https://docs.wabarc.eu.org/>
+- License: GPL-3.0
@@ -0,0 +1,33 @@
+name: Wayback
+tags:
+  - 工具
+  - 网络工具
+title: 网页归档与回放工具
+description: 网页归档与回放工具
+additionalProperties:
+  key: wayback
+  name: Wayback
+  tags:
+    - Tool
+    - Network
+  shortDescZh: 网页归档与回放工具
+  shortDescEn: Web archiving and playback tool
+  description:
+    en: Web archiving and playback tool
+    zh: 网页归档与回放工具
+    zh-Hant: 網頁封存與回放工具
+    ja: Webアーカイブおよび再生ツール
+    ko: 웹 아카이빙 및 재생 도구
+    ru: Инструмент архивирования и воспроизведения веб-страниц
+    ms: Alat pengarkiban dan main balik web
+    pt-br: Ferramenta de arquivamento e reproducao da Web
+  type: tool
+  crossVersionUpdate: true
+  limit: 0
+  recommend: 0
+  website: https://wabarc.eu.org/
+  github: https://github.com/wabarc/wayback
+  document: https://docs.wabarc.eu.org/
+  architectures:
+    - amd64
+    - arm64
@@ -0,0 +1,7 @@
+CONTAINER_NAME="wayback"
+PANEL_APP_BIND_ADDRESS="127.0.0.1"
+PANEL_APP_PORT_HTTP="8964"
+DATA_PATH="./data"
+WAYBACK_POOLING_SIZE="3"
+WAYBACK_TIMEOUT="300"
+WAYBACK_MAX_MEDIA_SIZE="512MB"
@@ -0,0 +1,99 @@
+additionalProperties:
+  formFields:
+    - default: 127.0.0.1
+      edit: true
+      envKey: PANEL_APP_BIND_ADDRESS
+      labelEn: Bind Address
+      labelZh: 绑定地址
+      label:
+        en: Bind Address
+        zh: 绑定地址
+        zh-Hant: 綁定位址
+        ja: バインドアドレス
+        ko: 바인드 주소
+        ru: Адрес привязки
+        ms: Alamat ikatan
+        pt-br: Endereco de vinculacao
+      required: true
+      type: text
+    - default: 8964
+      edit: true
+      envKey: PANEL_APP_PORT_HTTP
+      labelEn: HTTP Port
+      labelZh: HTTP 端口
+      label:
+        en: HTTP Port
+        zh: HTTP 端口
+        zh-Hant: HTTP 連接埠
+        ja: HTTP ポート
+        ko: HTTP 포트
+        ru: HTTP-порт
+        ms: Port HTTP
+        pt-br: Porta HTTP
+      required: true
+      rule: paramPort
+      type: number
+    - default: ./data
+      edit: true
+      envKey: DATA_PATH
+      labelEn: Data Folder Path
+      labelZh: 数据文件夹路径
+      label:
+        en: Data Folder Path
+        zh: 数据文件夹路径
+        zh-Hant: 資料夾路徑
+        ja: データフォルダのパス
+        ko: 데이터 폴더 경로
+        ru: Путь к папке данных
+        ms: Laluan folder data
+        pt-br: Caminho da pasta de dados
+      required: true
+      type: text
+    - default: 3
+      edit: true
+      envKey: WAYBACK_POOLING_SIZE
+      labelEn: Concurrent Jobs
+      labelZh: 并发任务数
+      label:
+        en: Concurrent Jobs
+        zh: 并发任务数
+        zh-Hant: 並行工作數
+        ja: 同時実行ジョブ数
+        ko: 동시 작업 수
+        ru: Параллельные задания
+        ms: Kerja serentak
+        pt-br: Tarefas simultaneas
+      required: true
+      type: number
+    - default: 300
+      edit: true
+      envKey: WAYBACK_TIMEOUT
+      labelEn: Archive Timeout Seconds
+      labelZh: 归档超时秒数
+      label:
+        en: Archive Timeout Seconds
+        zh: 归档超时秒数
+        zh-Hant: 封存逾時秒數
+        ja: アーカイブのタイムアウト秒数
+        ko: 아카이브 제한 시간(초)
+        ru: Тайм-аут архивации в секундах
+        ms: Tamat masa arkib dalam saat
+        pt-br: Tempo limite de arquivamento em segundos
+      required: true
+      type: number
+    - default: 512MB
+      edit: true
+      envKey: WAYBACK_MAX_MEDIA_SIZE
+      labelEn: Maximum Media Size
+      labelZh: 最大媒体大小
+      label:
+        en: Maximum Media Size
+        zh: 最大媒体大小
+        zh-Hant: 最大媒體大小
+        ja: 最大メディアサイズ
+        ko: 최대 미디어 크기
+        ru: Максимальный размер медиафайла
+        ms: Saiz media maksimum
+        pt-br: Tamanho maximo de midia
+      required: true
+      type: text
@@ -0,0 +1 @@
+
@@ -0,0 +1,39 @@
+services:
+  wayback:
+    image: "wabarc/wayback:latest@sha256:60cc26d4678462a866d34866d2f1d07c0419d4b87940640bdf2e3030e3b77a06"
+    container_name: ${CONTAINER_NAME}
+    restart: unless-stopped
+    command: ["wayback", "--ia", "--is", "--ga", "-d", "web"]
+    networks:
+      - 1panel-network
+    ports:
+      - "${PANEL_APP_BIND_ADDRESS}:${PANEL_APP_PORT_HTTP}:8964"
+    user: "100:101"
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      - WAYBACK_LISTEN_ADDR=0.0.0.0:8964
+      - WAYBACK_BOLT_PATH=/data/wayback.db
+      - WAYBACK_POOLING_SIZE=${WAYBACK_POOLING_SIZE}
+      - WAYBACK_TIMEOUT=${WAYBACK_TIMEOUT}
+      - WAYBACK_MAX_MEDIA_SIZE=${WAYBACK_MAX_MEDIA_SIZE}
+      - WAYBACK_ONION_DISABLED=true
+    volumes:
+      - "${DATA_PATH}:/data"
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=256m
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1:8964/healthcheck | grep -qx OK"]
+      interval: 10s
+      timeout: 5s
+      start_period: 20s
+      retries: 12
+    labels:
+      createdBy: "Apps"
+
+networks:
+  1panel-network:
+    external: true
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+ENV_FILE="${ENV_FILE:-${ROOT_DIR}/.env}"
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 1
+}
+
+read_env_value() {
+  local key="$1"
+  local value=""
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+validate_ipv4() {
+  local value="$1"
+  local part
+  local -a parts
+  IFS='.' read -r -a parts <<< "$value"
+  [[ ${#parts[@]} -eq 4 ]] || return 1
+  for part in "${parts[@]}"; do
+    [[ "$part" =~ ^[0-9]{1,3}$ ]] || return 1
+    (( 10#$part <= 255 )) || return 1
+  done
+}
+
+[[ -f "$ENV_FILE" ]] || fail "$ENV_FILE not found"
+[[ ! -L "$ENV_FILE" ]] || fail "$ENV_FILE must not be a symbolic link"
+
+bind_address="$(read_env_value PANEL_APP_BIND_ADDRESS)"
+validate_ipv4 "$bind_address" || fail "PANEL_APP_BIND_ADDRESS must be an IPv4 address"
+
+pooling_size="$(read_env_value WAYBACK_POOLING_SIZE)"
+[[ "$pooling_size" =~ ^[0-9]+$ ]] || fail "WAYBACK_POOLING_SIZE must be an integer"
+(( pooling_size >= 1 && pooling_size <= 32 )) || fail "WAYBACK_POOLING_SIZE must be between 1 and 32"
+
+timeout="$(read_env_value WAYBACK_TIMEOUT)"
+[[ "$timeout" =~ ^[0-9]+$ ]] || fail "WAYBACK_TIMEOUT must be an integer"
+(( timeout >= 10 && timeout <= 3600 )) || fail "WAYBACK_TIMEOUT must be between 10 and 3600"
+
+media_size="$(read_env_value WAYBACK_MAX_MEDIA_SIZE)"
+[[ "$media_size" =~ ^[1-9][0-9]{0,4}(MB|GB)$ ]] || fail "WAYBACK_MAX_MEDIA_SIZE must use MB or GB, for example 512MB"
+
+data_path="$(read_env_value DATA_PATH)"
+[[ "$data_path" =~ ^\./[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$ ]] || fail "DATA_PATH must be a relative path inside the app directory"
+[[ "/$data_path/" != *"/../"* ]] || fail "DATA_PATH must not contain parent traversal"
+
+data_dir="${ROOT_DIR}/${data_path#./}"
+canonical_root="$(realpath -m -- "$ROOT_DIR")"
+canonical_data="$(realpath -m -- "$data_dir")"
+[[ "$canonical_data" == "$canonical_root"/* ]] || fail "DATA_PATH resolves outside the app directory"
+[[ ! -L "$data_dir" ]] || fail "DATA_PATH must not be a symbolic link"
+
+umask 077
+mkdir -p "$data_dir"
+chown -R 100:101 "$data_dir"
+chmod 750 "$data_dir"
+chmod 600 "$ENV_FILE"
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v docker-compose >/dev/null 2>&1; then
+  docker-compose down --remove-orphans
+else
+  docker compose down --remove-orphans
+fi
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+exec bash "${SCRIPT_DIR}/init.sh"
@@ -0,0 +1,5 @@
+{
+  "repository": "https://github.com/wabarc/wayback/tree/v0.21.1",
+  "dockerDocs": "https://github.com/wabarc/wayback/blob/v0.21.1/README.md#dockerpodman",
+  "composeFile": "https://github.com/wabarc/wayback/blob/v0.21.1/docker-compose.yml"
+}