mirror of
https://github.com/okxlin/appstore.git
synced 2026-09-26 00:01:06 +00:00
okxlin
56bad2194d
Source: okxlin/appstore#4782 Contributor: @YuniqueUnic Includes the upstream v1.5.2 log-redaction fix, lifecycle scripts, strict-store normalization, and documented base-image CVE assessment.
81 lines
3.7 KiB
Markdown
81 lines
3.7 KiB
Markdown
# Elizabeth
|
||
|
||
## 产品介绍
|
||
|
||
**Elizabeth** 是一款无需注册的自托管实时文件与消息共享工具。用户可通过房间分享
|
||
Markdown 消息、文件、图片和链接；Rust 后端以单个容器提供 API、WebSocket 与内嵌
|
||
Web 界面。
|
||
|
||
## 主要功能
|
||
|
||
- **实时房间**：通过 WebSocket 同步消息和房间状态，并支持可分享的房间链接。
|
||
- **文件与消息共享**：支持 Markdown、代码高亮、图片、PDF、文本文件和链接预览。
|
||
- **安全与权限**：提供 JWT 会话、房间密码、细粒度权限、过期策略与访问次数限制。
|
||
- **轻量部署**：默认使用 SQLite，单容器即可运行，也可连接外部 PostgreSQL。
|
||
|
||
## 访问说明
|
||
|
||
- Web 端口由安装表单设置，默认 `4092`。
|
||
- 安装后直接打开 Web UI 即可创建房间并分享链接，无需注册账号。
|
||
- 健康检查路径：`/api/v1/health`。
|
||
|
||
## 数据持久化
|
||
|
||
- `APP_DATA_DIR` 挂载到 `/app/data`，保存 SQLite 数据库等本地状态。
|
||
- `APP_STORAGE_DIR` 挂载到 `/app/storage`，保存房间上传文件。
|
||
- 升级或迁移前应完整备份这两个目录。
|
||
- `JWT_SECRET` 用于签发登录会话；升级时不要更换，否则现有会话会失效。
|
||
|
||
## 安全说明
|
||
|
||
- 安装表单会为 `JWT_SECRET` 生成随机后缀；公网部署前请确认密钥足够强。
|
||
- 容器启用 `read_only`、`cap_drop: ALL`、`no-new-privileges` 与 `/tmp` tmpfs。
|
||
- 当前镜像基础层可能包含尚无发行版修复的系统组件 CVE。维护审计确认已报告的 Critical 项位于 `perl-base`，Elizabeth 的 Rust 服务不调用 Perl 或解包归档文件，其中一项仅影响 32 位构建；仍建议及时更新镜像并限制不必要的外部访问。
|
||
- 对公网开放时应通过 1Panel 反向代理启用 HTTPS，并按需要设置房间密码与权限。
|
||
|
||
## Introduction
|
||
|
||
**Elizabeth** is a self-hosted real-time file and message sharing tool that
|
||
requires no account registration. Users share Markdown messages, files, images,
|
||
and links through rooms, while one Rust container serves the API, WebSocket
|
||
endpoint, and embedded web interface.
|
||
|
||
## Features
|
||
|
||
- **Real-time rooms**: Synchronizes messages and room state over WebSocket and
|
||
supports shareable room links.
|
||
- **File and message sharing**: Supports Markdown, code highlighting, images,
|
||
PDFs, text files, and link previews.
|
||
- **Security and permissions**: Provides JWT sessions, room passwords, granular
|
||
permissions, expiry policies, and entry limits.
|
||
- **Lightweight deployment**: Runs as a single container with SQLite by default
|
||
and can connect to an external PostgreSQL database.
|
||
|
||
## Access
|
||
|
||
- The web port is configured in the install form and defaults to `4092`.
|
||
- Open the web UI after install to create rooms and share links without
|
||
registration.
|
||
- Health endpoint: `/api/v1/health`.
|
||
|
||
## Persistence
|
||
|
||
- `APP_DATA_DIR` mounts to `/app/data` for SQLite and other local state.
|
||
- `APP_STORAGE_DIR` mounts to `/app/storage` for room file uploads.
|
||
- Back up both directories before upgrades or migrations.
|
||
- Keep `JWT_SECRET` stable across upgrades to avoid invalidating sessions.
|
||
|
||
## Security
|
||
|
||
- The install form randomizes `JWT_SECRET`; use a strong secret for public
|
||
deployments.
|
||
- The container runs with `read_only`, `cap_drop: ALL`, `no-new-privileges`, and
|
||
a `/tmp` tmpfs.
|
||
- The image base may contain system-package CVEs for which the distribution has
|
||
not yet published fixes. The reported Critical findings are in `perl-base`;
|
||
the Rust service does not invoke Perl or extract archives, and one finding
|
||
applies only to 32-bit builds. Keep the image updated and limit unnecessary
|
||
external exposure.
|
||
- For public access, terminate TLS with a reverse proxy and configure room
|
||
passwords or permissions as needed.
|