mirror of
https://github.com/okxlin/appstore.git
synced 2026-09-25 16:01:04 +00:00
okxlin
94e0291201
Pin the official MeshChatX image, require upstream authentication, and preserve its Reticulum identity data.
52 lines
3.5 KiB
Markdown
52 lines
3.5 KiB
Markdown
# MeshChatX
|
|
|
|
## 产品介绍
|
|
|
|
MeshChatX 是基于 Reticulum 的网状通信客户端，提供浏览器界面、消息、通话及相关工具。
|
|
|
|
## 主要功能
|
|
|
|
- Reticulum 网状通信与联系人管理
|
|
- 浏览器界面的消息、通话和工具
|
|
- 持久化的身份、TLS 和本地通信数据
|
|
|
|
## 访问说明
|
|
|
|
安装后通过 `https://<服务器 IP>:<端口>` 访问，实际端口以 `PANEL_APP_PORT_HTTPS` 为准。上游默认生成自签名证书，首次访问会出现浏览器证书提示；生产环境应使用可信 TLS 终端并限制网络暴露范围。
|
|
|
|
应用固定启用上游认证。首次访问时在 Web UI 中设置强密码，之后使用该密码登录。首次部署时，先仅从受信任网络完成此设置，再开启 1Panel 的端口外部访问。请只向受信任的用户开放服务；上游明确不建议将其直接暴露到公共互联网。
|
|
|
|
## 数据持久化
|
|
|
|
`APP_DATA_DIR` 挂载到容器的 `/config`，保存 Reticulum 身份、TLS 证书、认证配置、消息和其他应用数据。该路径必须位于应用版本目录内（默认 `./data`）；安装与升级脚本会拒绝绝对路径及目录外路径，避免误改宿主机文件权限。脚本将目录设置为镜像要求的 UID/GID `1000:1000`。卸载不会删除绑定目录中的用户数据，升级、迁移或卸载前请备份该目录。
|
|
|
|
## 安全说明
|
|
|
|
- 容器显式使用上游的非 root UID/GID `1000:1000`，根文件系统只读，丢弃全部 Linux capabilities，并启用 `no-new-privileges`。仅 `/config` 数据卷及上游要求的 `/tmp`、`/home/meshchat` tmpfs 可写。
|
|
- 2026-07-28 对固定镜像的 Trivy 扫描未发现 Critical 或 High 漏洞；仍应在后续镜像更新前重新扫描。
|
|
- 插件和通信数据属于用户信任边界。仅安装可信插件，并保护包含身份和消息数据的 `/config` 备份。
|
|
|
|
## Introduction
|
|
|
|
MeshChatX is a Reticulum mesh communications client with a browser interface for messaging, calls, and related tools.
|
|
|
|
## Features
|
|
|
|
- Reticulum mesh communications and contact management
|
|
- Browser-based messaging, calls, and tools
|
|
- Persistent identity, TLS, and local communications data
|
|
|
|
## Usage Notes
|
|
|
|
- Access the service at `https://<server-ip>:<port>`. The upstream self-signed certificate triggers a browser warning on first access; use a trusted TLS endpoint and restrict network exposure for production use.
|
|
- Upstream authentication is enabled by default. Set a strong password in the Web UI from a trusted network before enabling 1Panel external port access, then use it for later sign-in. Do not expose the service directly to the public internet.
|
|
- `APP_DATA_DIR` persists Reticulum identity, TLS material, authentication settings, messages, and other application data. It must remain relative to the application version directory (default `./data`); absolute and outside paths are rejected. The initialization script assigns it to UID/GID `1000:1000`.
|
|
- The container explicitly runs as upstream UID/GID `1000:1000`, uses a read-only root filesystem, drops all Linux capabilities, and enables `no-new-privileges`. Only `/config` and the upstream-required `/tmp` and `/home/meshchat` tmpfs mounts are writable.
|
|
|
|
## References
|
|
|
|
- Project: <https://github.com/Quad4-Software/MeshChatX>
|
|
- Docker deployment: <https://github.com/Quad4-Software/MeshChatX#docker>
|
|
- Security architecture: <https://github.com/Quad4-Software/MeshChatX/blob/master/docs/en/architecture.md>
|
|
- License: <https://github.com/Quad4-Software/MeshChatX/blob/master/LICENSE> (0BSD and MIT)
|