mirror of
https://github.com/okxlin/appstore.git
synced 2026-09-24 00:01:00 +00:00
63 lines
6.0 KiB
Markdown
63 lines
6.0 KiB
Markdown
# LeafWiki
|
||
|
||
## 产品介绍
|
||
|
||
LeafWiki 是一个轻量级自托管 Wiki，以目录和文件夹结构组织 Markdown 页面，提供全文搜索、标签、页面历史、备份和多用户权限管理。
|
||
|
||
## 主要功能
|
||
|
||
- 以目录树组织 Markdown 页面
|
||
- 全文搜索、标签和页面链接
|
||
- 管理员、编辑者和只读用户角色
|
||
- TOTP 双因素认证、快照和 Git 备份
|
||
|
||
## 访问说明
|
||
|
||
安装后先在 1Panel 中为应用配置可信 HTTPS 反向代理，再通过 `https://<配置的域名>` 访问，并使用安装时设置的初始管理员用户名和密码登录。初始管理员参数只在首次创建用户数据库时生效；之后请在 LeafWiki 中管理账号和密码。
|
||
|
||
默认关闭“允许明文 HTTP 登录（不安全）”，保持上游安全默认。应用的明文端口可用于健康检查，但登录必须通过可信 HTTPS 反向代理，并正确传递 `X-Forwarded-Proto: https`。只有在端口严格限制于可信局域网且无法配置 HTTPS 时，才可显式把该选项改为 `true`；此时认证 Cookie 会通过未加密网络传输，绝不能把服务暴露到公网。
|
||
|
||
## 数据持久化
|
||
|
||
`APP_DATA_DIR` 挂载到 `/app/data`，保存 Markdown 页面、SQLite 用户数据库、资源、索引、快照和配置。该路径必须位于应用版本目录内，默认值为 `./data`；初始化脚本会拒绝绝对路径和目录外路径，并将其设置给官方非 root 用户 UID/GID `1000:1000`。脚本还会在该目录中首次生成并持久保存两枚 256-bit JWT/TOTP 密钥，不会在升级或重启时重新生成。卸载不会删除绑定目录中的用户数据，升级或迁移前请单独备份。
|
||
|
||
## 安全与部署风险
|
||
|
||
- 认证和刷新令牌限流保持启用；包内没有启用公开读取、无认证模式、API 密钥管理或 Git 备份。容器以 UID/GID `1000:1000` 运行，根文件系统只读，丢弃全部 Linux capabilities，并启用 `no-new-privileges`。
|
||
- 对固定镜像执行的 2026-07-28 Trivy 扫描发现 `0` 个 Critical 和 `1` 个 High：`CVE-2026-39822`（Go `os.Root` 符号链接目录逃逸）。镜像使用 Go 1.26.4，修复版本为 1.26.5；源码级 Go 漏洞扫描未找到 LeafWiki 调用受影响 `os.Root` API 的路径，但仍应在上游发布修复镜像后尽快更新。
|
||
- 同一次源码级 Go 漏洞扫描发现 `GO-2026-5856`（`CVE-2026-42505`，ECH 客户端握手隐私泄露）存在通用 TLS 调用链。该问题只在 LeafWiki 作为客户端使用 Encrypted Client Hello 时生效；默认关闭的 Git 备份和普通入站 HTTP 服务不启用 ECH。扫描还在依赖元数据或二进制符号中报告 `GO-2026-5970`、`GO-2026-5942` 和 `GO-2026-5932`，但未发现 LeafWiki 调用其受影响符号。
|
||
|
||
## Introduction
|
||
|
||
LeafWiki is a lightweight self-hosted wiki that organizes Markdown pages in a folder tree and provides full-text search, tags, page history, backups, and multi-user access control.
|
||
|
||
## Features
|
||
|
||
- Folder-oriented Markdown page tree
|
||
- Full-text search, tags, and page links
|
||
- Administrator, editor, and viewer roles
|
||
- TOTP two-factor authentication, snapshots, and Git backups
|
||
|
||
## Usage Notes
|
||
|
||
Configure a trusted HTTPS reverse proxy for the app in 1Panel, then access it at `https://<configured-domain>` and sign in with the initial administrator credentials selected during installation. Initial administrator settings apply only when the user database is first created; manage later account changes inside LeafWiki.
|
||
|
||
The package keeps **Allow Plain HTTP Login (Insecure)** disabled by default, matching the upstream secure default. The plain application port remains available for health checks, but login requires a trusted HTTPS reverse proxy that forwards `X-Forwarded-Proto: https`. Enable the insecure option explicitly only when the port is strictly limited to a trusted LAN and HTTPS cannot be configured; authentication cookies then cross the network unencrypted, so never expose that mode to the public Internet.
|
||
|
||
`APP_DATA_DIR` is mounted at `/app/data` and stores Markdown pages, the SQLite user database, assets, indexes, snapshots, and configuration. It must remain relative to the application version directory and is prepared for UID/GID `1000:1000`. On first install, the initialization script also generates and persists separate 256-bit JWT and TOTP keys in this directory; upgrades and restarts do not regenerate them. Uninstall does not delete bind-mounted user data; back it up before upgrades or migration.
|
||
|
||
## Security and Deployment Risks
|
||
|
||
- Authentication and refresh-token rate limiting remain enabled. Public access, authentication bypass, API-key management, and Git backup are not enabled by this package. The container runs as UID/GID `1000:1000`, uses a read-only root filesystem, drops all Linux capabilities, and enables `no-new-privileges`.
|
||
- A 2026-07-28 Trivy scan of the pinned image found 0 Critical and 1 High finding: `CVE-2026-39822`, a symlink root escape in Go `os.Root`. The image was built with Go 1.26.4 and the fix is in 1.26.5. Source-mode Go vulnerability analysis found no LeafWiki call path to the affected `os.Root` APIs, but update promptly when upstream publishes a fixed image.
|
||
- The same source-mode Go scan found a generic TLS call path for `GO-2026-5856` (`CVE-2026-42505`), an ECH client-handshake privacy leak. It applies only when LeafWiki acts as a client using Encrypted Client Hello; the default-disabled Git backup and ordinary inbound HTTP service do not enable ECH. The scan also reported `GO-2026-5970`, `GO-2026-5942`, and `GO-2026-5932` in dependency metadata or binary symbols without finding calls from LeafWiki to their affected symbols.
|
||
|
||
## References
|
||
|
||
- Project: <https://github.com/perber/leafwiki>
|
||
- Release: <https://github.com/perber/leafwiki/releases/tag/v0.12.0>
|
||
- Container source: <https://github.com/perber/leafwiki/blob/v0.12.0/Dockerfile>
|
||
- Configuration: <https://github.com/perber/leafwiki/blob/v0.12.0/.env.example>
|
||
- License: <https://github.com/perber/leafwiki/blob/v0.12.0/LICENSE> (MIT)
|
||
- Logo source: <https://github.com/lucide-icons/lucide/blob/0.468.0/icons/leaf.svg> (ISC)
|