From d6650108e823d9847d054b403cd77dc82a308436 Mon Sep 17 00:00:00 2001 From: Joachim Friberg Date: Wed, 1 Apr 2026 21:05:14 +0200 Subject: [PATCH] Remove timemachine app and refresh appstore zip --- Apps/timemachine/README.md | 73 -------------------- Apps/timemachine/docker-compose.yaml | 96 --------------------------- dist/phirna-appstore.zip | Bin 305606 -> 303044 bytes 3 files changed, 169 deletions(-) delete mode 100644 Apps/timemachine/README.md delete mode 100644 Apps/timemachine/docker-compose.yaml diff --git a/Apps/timemachine/README.md b/Apps/timemachine/README.md deleted file mode 100644 index 5260f22..0000000 --- a/Apps/timemachine/README.md +++ /dev/null @@ -1,73 +0,0 @@ -# Time Machine - -Denna app kör en SMB-baserad Time Machine-target för macOS med image `mbentley/timemachine`. - -Imagepinning i denna app: - -- Compose använder explicit daterad tag: `mbentley/timemachine:smb-20260329` -- `latest` används inte enligt repo-policy. -- Taggen verifierades mot Docker Hub innan införande. - -## Syfte - -- Ge en dedikerad backup-destination för macOS Time Machine i ZimaOS. -- Hålla konfigureringen enkel och reviewbar. -- Prioritera minst möjliga privilegier som fortfarande fungerar utan host network. - -## Portar - -- `137/udp` (NetBIOS name service) -- `138/udp` (NetBIOS datagram service) -- `139/tcp` (NetBIOS session service) -- `445/tcp` (SMB) - -## Volymer - -- `/DATA/AppData/$AppID/backup -> /opt/timemachine` - -Backupdata lagras isolerat under appens AppData-sökväg. - -## Miljövariabler - -- `TZ` (default `Europe/Stockholm`) -- `TM_USERNAME` (default `timemachine`) -- `TM_GROUPNAME` (default `timemachine`) -- `PASSWORD` (MUST ändras från `CHANGE_ME` före drift) -- `TM_UID` (default `1000`) -- `TM_GID` (default `1000`) -- `SET_PERMISSIONS` (default `false`) -- `VOLUME_SIZE_LIMIT` (default `0`, dvs obegränsad) - -## Säkerhetsmodell - -Aktiva skydd: - -- Ingen `privileged: true` -- Ingen `network_mode: host` -- Ingen mount av `/var/run/docker.sock` -- `security_opt: ["no-new-privileges:true"]` -- Snäv bind-mount till appens egna data under `/DATA/AppData/$AppID/...` - -Tradeoff: - -- Utan host network fungerar inte alltid automatisk Bonjour/Avahi-discovery över alla nät. -- Fallback är manuell anslutning i Finder: `smb:///TimeMachine`. - -## Högrisk-inställningar - -Inga högrisk-inställningar används i default-config. - -Alternativ som utvärderats men inte valts som default: - -- `network_mode: host` för bättre auto-discovery. - -Varför inte default: - -- Host network ökar attackytan och isoleringen minskar. -- Manuell SMB-anslutning ger fungerande backupflöde med lägre risk. - -## Drift och underhåll - -- Uppdatera till nyare `smb-YYYYMMDD`-taggar regelbundet för säkerhetsfixar. -- Rotera Time Machine-lösenord enligt normal credential-policy. -- Verifiera återläsning periodiskt, inte bara backup-jobb. diff --git a/Apps/timemachine/docker-compose.yaml b/Apps/timemachine/docker-compose.yaml deleted file mode 100644 index 16f6dda..0000000 --- a/Apps/timemachine/docker-compose.yaml +++ /dev/null @@ -1,96 +0,0 @@ -name: timemachine - -services: - timemachine: - # Setting this will allow the Zima webui to display the field "REQUIRE MEMORY" - deploy: - resources: - reservations: - memory: 128M - image: mbentley/timemachine:smb-20260329 - container_name: timemachine - restart: unless-stopped - - environment: - TZ: Europe/Stockholm - TM_USERNAME: timemachine - TM_GROUPNAME: timemachine - PASSWORD: CHANGE_ME - TM_UID: "1000" - TM_GID: "1000" - SET_PERMISSIONS: "false" - VOLUME_SIZE_LIMIT: "0" - - ports: - - target: 137 - published: "137" - protocol: udp - - target: 138 - published: "138" - protocol: udp - - target: 139 - published: "139" - protocol: tcp - - target: 445 - published: "445" - protocol: tcp - - tmpfs: - - /run/samba - - volumes: - - type: bind - source: /DATA/AppData/$AppID/backup - target: /opt/timemachine - - security_opt: - - no-new-privileges:true - - x-casaos: - envs: - - container: TZ - description: - en_us: Timezone, for example Europe/Stockholm - - container: TM_USERNAME - description: - en_us: Time Machine username - - container: PASSWORD - description: - en_us: Time Machine password - - container: TM_UID - description: - en_us: User ID for filesystem permissions - - container: TM_GID - description: - en_us: Group ID for filesystem permissions - - container: VOLUME_SIZE_LIMIT - description: - en_us: Size limit in MB (0 means unlimited) - ports: - - container: "445" - description: - en_us: SMB service port for Time Machine backups - volumes: - - container: /opt/timemachine - description: - en_us: Time Machine backup data - -x-casaos: - architectures: - - amd64 - - arm64 - main: timemachine - category: phirna - author: Joachim Friberg - developer: Joachim Friberg - icon: https://cdn.simpleicons.org/apple - tagline: - en_us: Network Time Machine target for macOS over SMB - description: - en_us: >- - Runs a Samba-based Time Machine target for macOS backups. - Uses explicit image pinning, scoped app data storage, and no-new-privileges. - title: - en_us: Time Machine - index: / - port_map: "445" diff --git a/dist/phirna-appstore.zip b/dist/phirna-appstore.zip index 15ebda55f60764c88bae588d485e501653bbe412..543edfa11f5d7b54ffe13905a54fb016d6f8318b 100644 GIT binary patch delta 4721 zcmZu!2~br>7JdJ}`%wc%SyVOw1ymLZ2rdZYg18|j5JX9W?28cDBHL#XKD$98_?6b+ z1}=;f8O>1fCngR_oFq7umd0_)Ol6pWqm@A&m$;-R6`k&Wum9`!D^Rb>d+s^s-oCH9 zAAWt!?k@v&HZki&a1aDxypY!0VdG=gFe^UP~Bzg1q^!0CJYE`_2ei9p~-_( znCh^ELB|~olr_g`A%ilV_EG4?bUzs~exac~tal4xq-M7v9dX~_^*aV3uMFz`>uhgD zCod_r*SK;{tkqLG3u=dvPv*Qqk*B%+jy?-CS`5YbW;5u#@0TKh3;}O4Xe40zEDY_A zPnHp5W_%jqT#VmHk!QKsTPYc_QIcA~0~?bRwhPfO+mtIiq7QG1_Wc(&dFlxMV6#pwi@Uc$OG?koA2Ag`B79Qq>YbZ(XI zWIn0-`NmUa^9b*UGFH%-TwYC(;qq#Qx0xWH>s89;iXeiXt5Bha%0PnlSGFta`Nr*4 z!4$13qNvi%>gr0y8>~(soSEAj8Pd0Xlpq~7%?xp?eMk^ngS1%{pDsfU<9O8VA)K>y zY_Ima)L)_-daTL3p`)7rNZ-%@TGC}*fBKFn$~wI>fkKM8Z(D&(sz2P;e7H@6AFb(d zo9MIzS3>88!~i*O`tOjKFb*G2wC0+~&b6uWn)nSl*eGyBG+#s9aY5B1VvxEfx;i2* zVWv|?#WzW}sOYA+n1T4X#99%s`?2Vae8xm;3x`c(;u@KZX8Xejg!}p(F_IY^xFd=a zWP?Bp?c>MhLMY^kXdpDx6ET8mUpx_SIS}ynOAyRJcWW4=YyXcOuq)H#XAcQVo3FWm z6*}VtI*WQYoPaG1IXc5xVtvIK7Fy7JU0^w@R^$SY#}Qt(Cxpr%I^hXFkwJHP;kKmv zU%vCuLoZmtw2QrA5xKQdu^-lQJPcj&gIF1o#)h%K`NMh{GtHh0?Ns|oFoY>u^A`k7 z3xTByPOfjH4}oZ=9|{43hJddwP)xfQK(3a66GLGwVMBMdc4y zDB#jaI7q?al}e$&Rq&YHrD#?(M6m&tM#E}iIS>u2ESj9N9%5t&;o;hwI@W`Ud}>fs zoH=7U5(fw9US5)*lxk0auPAddZ%YtQe&*x?1%|veOr@5xn*>IcA9_3@E^xjOP`EZ05Zzu-#(Z?V8sWuv|o5=ni zK-Y_5q4rrW>TZJRWKDBRU=bfTm4GiFUoC;fBwk)7@%>97ijPq#tl;BcN+FVuQ_3KL zkH0H}Xg*$54l7B_`Z-k&p?uy-4-tHvqla}o|GFN6%`u*xPX#1vpUVB>_+$lS^Knom zl<@I4m9T}6W2zvJ#Izr*AFhH7K2EQe_$+_78n*I!{dOqlW4jtDX8aFoAfNYJTnlA9 z|Jz#F&gY8^P{rq8u7i3$|ED^r~4lg8;@R7t`T= zxNiMFXk7=?c~i6_#koPpzK;o0M`S|Sez0cp8Kkw=vyEfz*!&=Vg1BP$3^`0wH70t< zrfizS`>|=psBBtxM|AzIs{MB)!o<|<%>3e4;x|a0F_SZ-GpoC@iPIBv>x|&kg$WlK zA-W4+ckB(|mA^}}KWl(Y+yR~Mf|t!%{C@6|>@O4Ktos3&#$QQvC}=XE5od5l?FT@| zv~(yt*X@b#!UK7PA5U&5#|&dkbN>KLA{w@z-4Eh=qqfx1lbaUxn_&B;<9Fi(;qp{L z@KyPR+fl^~l;{FBmNMHsJIk#H9Fmqz+rZ1-dpqIrz1Fj+f#8s zZyf)|Ss3yqx>@F;Y)vnSsgEB?`kIq;kKl@V-8k7QCDBLSU`L9v z564M5q(>#JuBSqZ{t69vIr#jZ&r1>8_qHdu29 zmd+}9u(PKTPu2sg)HP0KN~(a9%0(1Ljzi?PTM9+|YRO}#D%ANl2w9n_#U<}#X3R}3 iEZi25yR9H!-fj554)zW@+@K(2;opnFf^ZA-1>yhrP3s5% delta 7191 zcmaJ_2{=^k7r)Fag=GKiDUygrBujkRLusRwC1NZwNOmy|Ns)DMvn8ayPZ6n4aY6Ghie_pw%}au z^=;hZ#=&E?tlqi{&r-cr59{rf%Z$s(bu(68rJFm4N9c{b!;j;~^sej(#`TuFH)7o!uyKBK03XR(+oURNf4(2| zWbbl>s|ixh--z&H;CVXwzTM{3{$eUYgTn}zbHYWUPO)?J>z zLW-|&kSgS0BVw>EKuR#>tXiI^rGQHLy$PGD48d1BjcDcrhs3;UetFov2%dZ~cB_Eo zl$>nd(kE9k>8m?ztL+{(monkLPvc=T7LYT`I?1|GF;4$`w)+K(XNqsLVhsh&4AK_aY}6-T=`*d={t!(OEn3i38a@)allBo|Xp>ck@oCZt^tEQ#0<#uIxG? zOwJTfHYj0cR4ib0G_U9hmlDrljJny*D&KNRO*SD?f@hdk@m%anbiy^~>p`2n)xJNR zO$8fCIUD*+nZ^&@V}*7pZ(k5aZ{5d~d_H)wFzRW>$|JpGQfhOup6tYu(ZKUde&pZQ z&XrMDkD4B;tG@9D#F>nYM$$VZ&7Z3!Z8`nzfywiUzZOJpJ54?vE&6py=v$8?BYk3; z&Htp&rwv$^j6SAC>u%j1sPVXYj!*B1ZeicJQ2K0IQ&Q{FcXg=x%@0M68tMJ3p z3}me?5jdUe)R53-C)C=WljwT;TKK$0o#n6c4(`A5T5-EKup1F>{v>;svdSklG~=dR znZIJ2aN^m!XKnY&boqwKbT6|%d3Ue$s{I$ze}wN2kNVX}f7wgZ|MmIZ&I6`*DOZ4) zt|X&i)XntMh*$J?>eW&emF2=RZ~BeRw%t5%wQMH7YT9sXl`FBul^ut?E&D=cbj zK2~URxj8KC>(ui6GtXMb_m0PkYUVayY<{lbRmoTMsYz*P*V$jT!=u6lUd=_7p>5^z zsVBEf#szJ(0(&xFB@g4Oqm z%|lMUx^Zr-&AvXVNooH+mlKy6Sy>s@N>7CJ&YTf0{42b4cHiTE@@t1uYNqyu$HlTq zC8}j@7B5FCP9CF(?eL4OdqNYR7-UYo$lp0GJhHyfcr4+htM)KyZ=XjMW5IO)kNtxN zDuH%&<_8}9uncPUI!g&^xSO^)Kb_<@_Ur5YHCrCUY}UHWzqjO@+FfT6r5dJ=QJMWX zf7G{tj_C%&H}&(Q8~X3%4(ZjOdb;eV#od71r?a&VdMAYBETKM0_59Jl;}UK1ZgayO zll!%E(*9Yxb0xz!Q|@Th9E+S9&W6|L&_l@~2P@4VB~ui7NHrZa8gtx*=m`f5qR z6&sy<21(5Z%Id1xyxogzbGt7!*|(Rtew25;M-MNJ=9}bM{^jT?nMs3)>gO~wNZf4M zYlWdayIFRH+45Ho#2YF1SKMA}kj#7gz}Sv5FKKhxlLSns5^;t8AF zMF~lV&u&(g5A31MyPDP$S-7ZsY|=kVb^W=0S1W6+oEs}+Act(3P2052{2kOyYswbC z{zyJ0dHnn50q3S&6^T*~txfXui^e>=e@ux)ELIv#GoAb?^6bS6xJ*RiZ@!I54Z6Ks zT+N&-?r0l$y!~R9vT5h#U=4Gs-cUtzdlNc3`D#IVrJ=cFpPPQ(m9rZ4b_Vd$yt@&of#hV|)Eb)ze$^ zMbC$Kh4Ixt4B33ChT10J?qaxoZO>J|#Fu2I)W;kf<&W7qUk^P#{K?*G&3)#+EN@H7 zt6?Cg5i9YC{4#e?>g34c57!kloz{F0D?brx7C5rXmh8JIqAEXP@uATtmZ3pmekM(! zG_v$#)BLfZ+3|Lxbd5E%gyMSL+Po0vn#v}ppAYxe>3Dusc_%w&ks1V^U#M zA@grjotO6}B;8)W%->JD%T%93b22eCdg~BP`%A4O(V9{CRsQ9?b&M|{6aU;kV&T~WXzT_xe_di(l_!vS7j>v1|X^*~co zpZ`R%dUHwC#vS`#S=E%Ct2|Lrto|`)u)H?#MU9ttZ~Zj(bmIpn*uI~HAGWx@_~C+n zk~a4j75t%}gr9@zbOuP<(Qh$0eUM~`e@Ar>k~X5pD!B12X%Rdx1I!X6ya?D|eQ?+i zX$_kJTPlN7C?WV6$pTlYe?}tBVXKe{CCo)Xs}la1)8mbNi!opxQ6LMid`FVRwKlyY z(NP-n9mx#WQg}}qkwBe*7wF(lV_wjKeeUrK0Q`_xXCnZdIJIwJ{CDkNMF8F{tS1UC zpwgqF0RL#jTU;XsOz~{#V&DswEm0O2;I+2Mg3l=TlH5#LICq{rFvq!0@<1OeDr?~k z7srh*1o-)IW*I*zgLOF9QUzpS-23Xli0wqUoI@DALIeEG381Gi7}fx5ae>zwfR1f( zfF?(^Q4{P!Pd2ay8Q9>+Xfl|ZjXI+Y0KT<#?FPUKqt7$qI9-iE5$624ij&CR7<@qw zkg$b0z|Y=rwmGmyeUHq6)o(>wS%3|A>Ou?9iE({xInJxLpb$Nh!!GMNS*q59Rty>D z$f>-=5vXD9jBcGtQ)lP|bTE353$SA+g0H!NRjA}I7hs7ew{Zolv2Ie_ID>S{4ZOhC z{XAs`dBGbT!*ZAUgC)2ka<`#`Dt`6{D|w~#;hHF*fZBEeK%ZzI4*=>!`$GUQL~YS< z7T%T$Y>D=HDljM7GJ(K?XvYNtC!#$O2-Xs9uOMKF+IT&kLBN0*R|y7YL^~-M*b(uc zgMkjww%!eP5b^E1fe+DM9|FRN_DBfuCE9^|02Q_IdVcN!UPPN7%EIGufiMt20dQK4_f{6bZ0pf`9^hmIm7+)F%5{U6TQ6PpG4~XWDi^PBf#CTl{ zfQfd{UXV+)RbyFkyj~=~Jp4TtxD!D!aUh9kE7QP!qTNAbHGvO}&pz&=1nJ!I3OdLq z@+tA$`g0RN3Nd~ufg2yXpW9xR2#%t7you37KqK7sHI)o@6ZO(lfH#pZbr{4F?Q@5b$Di=fiKcQM62m_)38dNA z1tQRUQ?q{3e_a{yp;ubiLu~%%eF2M)+yX$y>8bz4C)^%zgqEX1+@I@2A^S&v76O~3 z0%?397X03bI7DnjWrzgRpOGZ^9UWLX@y)!G3gk(<*-`jfKWPphrzrH5MovQjtpor+ zEH^-!_ZzARMNx)XN#HwaKoTzu)mWc_L?>TkQCax!bijx22Ud2N3=!EC@nh z43#=4OM}?>R4!7xpf2o@57hr?+#g1QR8|nKg@G8?0%xQs9$L=}LEn%HxvMkN!}MUS zBS4&s;sz&lJwxs%&#OSta;}DW3|N$kBdm$QU!#LZkP_CLVL=h(YTnz=M=Ln$_orfG z9x|gNuzNnxfb;UW=eGli@%C7<tT0YK+jgiA9fZFmfpbp+7M$$;eOuc~d+>!$K%tnjXkqxz?^dL4oWU aK~5mzaCI@5CF}?JL9cZos2zbr(Ek9*jY+Qn