Skip to content

Commit 978efe2

Browse files
CodeShellDevCodeShellDev
authored
Merge pull request #1 from CodeShellDev/main
Update Dev Branch
2 parents b5e2f51 + bf9a63b commit 978efe2

File tree

7 files changed

+234
-23
lines changed

7 files changed

+234
-23
lines changed

‎.dockerignore‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1 @@
1-
.gitignore
2-
.git
3-
.github
4-
.env
5-
docker-compose.yaml
6-
LICENSE
7-
*.md
8-
.venv
1+
!*.py

‎.github/templates/README.template.md‎

Lines changed: 50 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,65 @@ Get the latest version of the `docker-compose.yaml` file:
1010
{ { file.docker-compose.yaml } }
1111
```
1212

13+
### Reverse proxy
14+
15+
Take a look at traefik implementation:
16+
17+
```yaml
18+
{ { file.examples/traefik.docker-compose.yaml } }
19+
```
20+
21+
## Setup
22+
23+
Before you can send messages via `secured-signal-api` you must first setup [`signal-api`](https://github.com/bbernhard/signal-cli-rest-api/blob/master/doc/EXAMPLES.md),
24+
25+
to send messages you have to either:
26+
27+
- register a Signal Account
28+
29+
OR
30+
31+
- link Signal Api to a already registered Signal Device
32+
1333
## Usage
1434

1535
To send a message to `number`: `1234567`:
1636

1737
```bash
18-
curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer TOKEN" -d '{"message": "Hello World!", "recipients": ["1234567"]}' http://signal-api/v2/send
38+
curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer TOKEN" -d '{"message": "Hello World!", "recipients": ["1234567"]}' http://signal-api:8880/v2/send
39+
```
40+
41+
### Configuration
42+
43+
Because `secured-signal-api` is just a secure proxy you can use all of the [Signal REST Api](https://github.com/bbernhard/signal-cli-rest-api/blob/master/doc/EXAMPLES.md) endpoints with an Exception of:
44+
45+
```python
46+
DEFAULT_BLOCKED_ENDPOINTS = [
47+
"/v1/about",
48+
"/v1/configuration",
49+
"/v1/devices",
50+
"/v1/register",
51+
"/v1/unregister",
52+
"/v1/qrcodelink",
53+
"/v1/accounts",
54+
"/v1/contacts"
55+
]
56+
```
57+
58+
Which are blocked by default to increase Security, but you these can be modified by setting the `BLOCKED_ENDPOINTS` environment variable as a valid json array
59+
60+
```yaml
61+
environment:
62+
BLOCKED_ENDPOINTS: '[ "/v1/register","/v1/unregister","/v1/qrcodelink","/v1/contacts" ]'
1963
```
2064
2165
## Contributing
2266
67+
Found a bug? Want to change or add something?
68+
Feel free to open up an issue or create a Pull Request!
69+
70+
_This is a small project so don't expect any huge changes in the future_
71+
2372
## License
2473
2574
[MIT](https://choosealicense.com/licenses/mit/)

‎.github/workflows/readme-update.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ on:
55
paths:
66
- "docker-compose.yaml"
77
- ".github/templates/README.template.md"
8+
- "examples/*"
89

910
jobs:
1011
update-readme:

‎README.md‎

Lines changed: 108 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,125 @@ Get the latest version of the `docker-compose.yaml` file:
99
```yaml
1010
---
1111
services:
12-
myservice:
13-
container_name: myservice
12+
signal-api:
13+
image: bbernhard/signal-cli-rest-api
14+
container_name: signal-api
15+
environment:
16+
- MODE=normal
17+
volumes:
18+
- ./data:/home/.local/share/signal-cli
19+
networks:
20+
backend:
21+
aliases:
22+
- signal-api
23+
restart: unless-stopped
24+
25+
secured-signal:
26+
image: ghcr.io/codeshelldev/secured-signal-api
27+
container_name: secured-signal
28+
networks:
29+
backend:
30+
aliases:
31+
- secured-signal-api
32+
environment:
33+
SIGNAL_API_URL: http://signal-api:8080
34+
DEFAULT_RECIPIENTS: '[ "000", "001", "002" ]'
35+
SENDER: 123456789
36+
ports:
37+
- "8880:8880"
38+
restart: unless-stopped
39+
40+
networks:
41+
backend:
1442
```
1543
44+
### Reverse proxy
45+
46+
Take a look at traefik implementation:
47+
48+
```yaml
49+
services:
50+
# ...
51+
secured-signal:
52+
image: ghcr.io/codeshelldev/secured-signal-api
53+
container_name: secured-signal
54+
networks:
55+
proxy:
56+
backend:
57+
aliases:
58+
- secured-signal-api
59+
environment:
60+
SIGNAL_API_URL: http://signal-api:8080
61+
DEFAULT_RECIPIENTS: '[ "000", "001", "002" ]'
62+
SENDER: 123456789
63+
labels:
64+
- traefik.enable=true
65+
- traefik.http.routers.signal-api.rule=Host(`signal-api.mydomain.com`)
66+
- traefik.http.routers.signal-api.entrypoints=websecure
67+
- traefik.http.routers.signal-api.tls=true
68+
- traefik.http.routers.signal-api.tls.certresolver=cloudflare
69+
- traefik.http.routers.signal-api.service=signal-api-svc
70+
- traefik.http.services.signal-api-svc.loadbalancer.server.port=8880
71+
- traefik.docker.network=proxy
72+
restart: unless-stopped
73+
74+
networks:
75+
backend:
76+
proxy:
77+
external: true
78+
```
79+
80+
## Setup
81+
82+
Before you can send messages via `secured-signal-api` you must first setup [`signal-api`](https://github.com/bbernhard/signal-cli-rest-api/blob/master/doc/EXAMPLES.md),
83+
84+
to send messages you have to either:
85+
86+
- register a Signal Account
87+
88+
OR
89+
90+
- link Signal Api to a already registered Signal Device
91+
1692
## Usage
1793

1894
To send a message to `number`: `1234567`:
1995

2096
```bash
21-
curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer TOKEN" -d '{"message": "Hello World!", "recipients": ["1234567"]}' http://signal-api/v2/send
97+
curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer TOKEN" -d '{"message": "Hello World!", "recipients": ["1234567"]}' http://signal-api:8880/v2/send
98+
```
99+
100+
### Configuration
101+
102+
Because `secured-signal-api` is just a secure proxy you can use all of the [Signal REST Api](https://github.com/bbernhard/signal-cli-rest-api/blob/master/doc/EXAMPLES.md) endpoints with an Exception of:
103+
104+
```python
105+
DEFAULT_BLOCKED_ENDPOINTS = [
106+
"/v1/about",
107+
"/v1/configuration",
108+
"/v1/devices",
109+
"/v1/register",
110+
"/v1/unregister",
111+
"/v1/qrcodelink",
112+
"/v1/accounts",
113+
"/v1/contacts"
114+
]
115+
```
116+
117+
Which are blocked by default to increase Security, but you these can be modified by setting the `BLOCKED_ENDPOINTS` environment variable as a valid json array
118+
119+
```yaml
120+
environment:
121+
BLOCKED_ENDPOINTS: '[ "/v1/register","/v1/unregister","/v1/qrcodelink","/v1/contacts" ]'
22122
```
23123

24124
## Contributing
25125

126+
Found a bug? Want to change or add something?
127+
Feel free to open up an issue or create a Pull Request!
128+
129+
_This is a small project so don't expect any huge changes in the future_
130+
26131
## License
27132

28133
[MIT](https://choosealicense.com/licenses/mit/)

‎app.py‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@
44
import requests
55
import re
66
import base64
7-
import logging
7+
import logging
8+
from urllib.parse import unquote
89

910
app = Flask("Secured Signal Api")
1011

@@ -39,7 +40,7 @@ def fillInVars(obj):
3940
for i in range(len(obj)):
4041
obj[i] = fillInVars(obj[i])
4142
elif isinstance(obj, str):
42-
matches = re.findall(r"\${(.*?)}", obj)
43+
matches = re.findall(r"\${(.*?)}", obj)
4344
for match in matches:
4445
if match in VARIABLES:
4546
value = VARIABLES[match]
@@ -75,15 +76,20 @@ def middlewares():
7576
auth_header = request.headers.get("Authorization", "")
7677

7778
if auth_header.startswith("Bearer "):
78-
token = auth_header.split(" ", 1)[1]
79-
if token != API_TOKEN:
79+
token = auth_header.split(" ", 1)[1]
80+
81+
token = unquote(token)
82+
if token != API_TOKEN:
8083
infoLog(f"Client failed Bearer Auth [token: {token}]")
8184
return UnauthorizedResponse()
82-
elif auth_header.startswith("Basic "):
83-
try:
84-
decoded = base64.b64decode(auth_header.split(" ", 1)[1]).decode()
85-
username, password = decoded.split(":", 1)
86-
if username != "api" or password != API_TOKEN:
85+
elif auth_header.startswith("Basic "):
86+
try:
87+
decoded = base64.b64decode(auth_header.split(" ", 1)[1]).decode()
88+
username, password = decoded.split(":", 1)
89+
90+
username = unquote(username)
91+
password = unquote(password)
92+
if username != "api" or password != API_TOKEN:
8793
infoLog(f"Client failed Basic Auth [user: {username}, pw:{password}]")
8894
return UnauthorizedResponse()
8995
except Exception as error:

‎docker-compose.yaml‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,32 @@
11
---
22
services:
3-
myservice:
4-
container_name: myservice
3+
signal-api:
4+
image: bbernhard/signal-cli-rest-api
5+
container_name: signal-api
6+
environment:
7+
- MODE=normal
8+
volumes:
9+
- ./data:/home/.local/share/signal-cli
10+
networks:
11+
backend:
12+
aliases:
13+
- signal-api
14+
restart: unless-stopped
15+
16+
secured-signal:
17+
image: ghcr.io/codeshelldev/secured-signal-api
18+
container_name: secured-signal
19+
networks:
20+
backend:
21+
aliases:
22+
- secured-signal-api
23+
environment:
24+
SIGNAL_API_URL: http://signal-api:8080
25+
DEFAULT_RECIPIENTS: '[ "000", "001", "002" ]'
26+
SENDER: 123456789
27+
ports:
28+
- "8880:8880"
29+
restart: unless-stopped
30+
31+
networks:
32+
backend:

‎examples/traefik.docker-compose.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
services:
2+
# ...
3+
secured-signal:
4+
image: ghcr.io/codeshelldev/secured-signal-api
5+
container_name: secured-signal
6+
networks:
7+
proxy:
8+
backend:
9+
aliases:
10+
- secured-signal-api
11+
environment:
12+
SIGNAL_API_URL: http://signal-api:8080
13+
DEFAULT_RECIPIENTS: '[ "000", "001", "002" ]'
14+
SENDER: 123456789
15+
labels:
16+
- traefik.enable=true
17+
- traefik.http.routers.signal-api.rule=Host(`signal-api.mydomain.com`)
18+
- traefik.http.routers.signal-api.entrypoints=websecure
19+
- traefik.http.routers.signal-api.tls=true
20+
- traefik.http.routers.signal-api.tls.certresolver=cloudflare
21+
- traefik.http.routers.signal-api.service=signal-api-svc
22+
- traefik.http.services.signal-api-svc.loadbalancer.server.port=8880
23+
- traefik.docker.network=proxy
24+
restart: unless-stopped
25+
26+
networks:
27+
backend:
28+
proxy:
29+
external: true

0 commit comments

Comments
 (0)