Audiofy – Musikwünsche für Partys

Server (Website, Admin-Bereich, Player-API) und Player (raspotify + Controller) mit Install-Skripten für Debian-Systeme. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-17 19:16:39 +01:00
commit 3610de7bae
45 changed files with 5666 additions and 0 deletions
@@ -0,0 +1,2 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
@@ -0,0 +1,19 @@
+# Audiofy – Caddy-Konfiguration (erzeugt von install-server.sh)
+{
+	email {{ACME_EMAIL}}
+	servers {
+		protocols h1 h2
+	}
+}
+
+{{DOMAIN}} {
+	encode zstd gzip
+	header {
+		Strict-Transport-Security "max-age=31536000"
+		X-Content-Type-Options nosniff
+		X-Frame-Options DENY
+		Referrer-Policy strict-origin-when-cross-origin
+		-Server
+	}
+	reverse_proxy 127.0.0.1:{{APP_PORT}}
+}
@@ -0,0 +1,31 @@
+[Unit]
+Description=Audiofy – Controller (Spotify-Steuerung, Wünsche vom Server)
+After=network-online.target bluetooth.target raspotify.service
+Wants=network-online.target raspotify.service
+# nie aufgeben, immer wieder neu starten
+StartLimitIntervalSec=0
+
+[Service]
+User={{AUDIOFY_USER}}
+Group={{AUDIOFY_USER}}
+WorkingDirectory={{AUDIOFY_DIR}}/app
+ExecStart={{AUDIOFY_DIR}}/.venv/bin/python -u {{AUDIOFY_DIR}}/app/controller.py --env {{AUDIOFY_DIR}}/config/.env
+Restart=always
+RestartSec=5
+UMask=0077
+# Härtung
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths={{AUDIOFY_DIR}}/config
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK AF_BLUETOOTH
+LockPersonality=yes
+MemoryMax=200M
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,30 @@
+[Unit]
+Description=Audiofy – Website, Admin-Bereich und Player-API
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User={{AUDIOFY_USER}}
+Group={{AUDIOFY_USER}}
+WorkingDirectory={{AUDIOFY_DIR}}/app
+Environment=AUDIOFY_ENV={{AUDIOFY_DIR}}/.env
+ExecStart={{AUDIOFY_DIR}}/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port {{APP_PORT}} --workers 1 --no-access-log --proxy-headers --forwarded-allow-ips 127.0.0.1
+Restart=always
+RestartSec=3
+UMask=0077
+# Härtung
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths={{AUDIOFY_DIR}}/data {{AUDIOFY_DIR}}/.env
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+LockPersonality=yes
+MemoryMax=300M
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,8 @@
+# Audiofy – SSH gegen Passwort-Raten schützen
+[sshd]
+enabled  = true
+port     = {{SSH_PORT}}
+backend  = systemd
+maxretry = 5
+findtime = 10m
+bantime  = 1h
@@ -0,0 +1,2 @@
+[Journal]
+SystemMaxUse=200M
@@ -0,0 +1,8 @@
+# Audiofy: raspotify nie endgültig aufgeben (z. B. wenn der Lautsprecher kurz fehlt
+# oder das Netz beim Start noch nicht da ist)
+[Unit]
+StartLimitIntervalSec=0
+
+[Service]
+Restart=always
+RestartSec=10
@@ -0,0 +1,8 @@
+# Audiofy – SSH-Härtung (NICHT automatisch installiert, siehe README „Server härten“)
+# Erst einsetzen, wenn der Login per Schlüssel für {{ADMIN_USER}} nachweislich klappt!
+Port {{SSH_PORT}}
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+AllowUsers {{ADMIN_USER}}