diff --git a/.github/ISSUE_TEMPLATE/bug-report.md b/.github/ISSUE_TEMPLATE/bug-report.md index 40b424b..1ffe8f3 100644 --- a/.github/ISSUE_TEMPLATE/bug-report.md +++ b/.github/ISSUE_TEMPLATE/bug-report.md @@ -43,7 +43,7 @@ No | Yes **Self-Hosted Setup** Proxy: Nginx | Apache2 -Deployment: docker run | docker-compose | npm run start:prod +Deployment: docker run | docker compose | npm run start:prod Version: v1.9.4 **Additional context** diff --git a/.gitignore b/.gitignore index bd15e97..ba0f1e5 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,6 @@ node_modules fqdn.env /docker/certs qrcode-svg/ +turnserver.conf +rtc_config.json +ssl/ diff --git a/Dockerfile b/Dockerfile index a307a45..43c97ac 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,7 +8,12 @@ RUN npm ci COPY . . +# environment settings +ENV NODE_ENV="production" + EXPOSE 3000 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \ CMD wget --quiet --tries=1 --spider http://localhost:3000 || exit 1 + +ENTRYPOINT ["npm", "start"] \ No newline at end of file diff --git a/docker-compose-coturn.yml b/docker-compose-coturn.yml index e9a05b4..9d0b0a8 100644 --- a/docker-compose-coturn.yml +++ b/docker-compose-coturn.yml @@ -1,19 +1,31 @@ version: "3" services: - node: - image: "node:lts-alpine" - user: "node" - working_dir: /home/node/app - volumes: - - ./:/home/node/app - command: ash -c "npm i && npm run start:prod" + pairdrop: + image: "lscr.io/linuxserver/pairdrop:latest" + container_name: pairdrop restart: unless-stopped + volumes: + - ./rtc_config.json:/home/node/app/rtc_config.json + environment: + - PUID=1000 # UID to run the application as + - PGID=1000 # GID to run the application as + - WS_FALLBACK=false # Set to true to enable websocket fallback if the peer to peer WebRTC connection is not available to the client. + - RATE_LIMIT=false # Set to true to limit clients to 1000 requests per 5 min. + - RTC_CONFIG=/home/node/app/rtc_config.json # Set to the path of a file that specifies the STUN/TURN servers. + - DEBUG_MODE=false # Set to true to debug container and peer connections. + - TZ=Etc/UTC # Time Zone ports: - - "3000:3000" + - "127.0.0.1:3000:3000" # Web UI. Change the port number before the last colon e.g. `127.0.0.1:9000:3000` coturn_server: image: "coturn/coturn" - restart: always - network_mode: "host" + restart: unless-stopped volumes: - ./turnserver.conf:/etc/coturn/turnserver.conf - #you need to copy turnserver_example.conf to turnserver.conf and specify domain, IP address, user and password + - ./ssl/:/etc/coturn/ssl/ + ports: + - "3478:3478" + - "3478:3478/udp" + - "5349:5349" + - "5349:5349/udp" + - "10000-20000:10000-20000/udp" + # see guide at docs/host-your-own.md#coturn-and-pairdrop-via-docker-compose \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 5ff9305..357ed85 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,12 +1,16 @@ version: "3" services: - node: - image: "node:lts-alpine" - user: "node" - working_dir: /home/node/app - volumes: - - ./:/home/node/app - command: ash -c "npm i && npm run start:prod" + pairdrop: + image: "lscr.io/linuxserver/pairdrop:latest" + container_name: pairdrop restart: unless-stopped + environment: + - PUID=1000 # UID to run the application as + - PGID=1000 # GID to run the application as + - WS_FALLBACK=false # Set to true to enable websocket fallback if the peer to peer WebRTC connection is not available to the client. + - RATE_LIMIT=false # Set to true to limit clients to 1000 requests per 5 min. + - RTC_CONFIG=false # Set to the path of a file that specifies the STUN/TURN servers. + - DEBUG_MODE=false # Set to true to debug container and peer connections. + - TZ=Etc/UTC # Time Zone ports: - - "3000:3000" + - "127.0.0.1:3000:3000" # Web UI. Change the port number before the last colon e.g. `127.0.0.1:9000:3000` diff --git a/docs/host-your-own.md b/docs/host-your-own.md index c81afa1..32385a2 100644 --- a/docs/host-your-own.md +++ b/docs/host-your-own.md @@ -1,181 +1,132 @@ # Deployment Notes -The easiest way to get PairDrop up and running is by using Docker. -> TURN server for Internet Transfer -> -> Beware that you have to host your own TURN server to enable transfers between different networks. -> -> Follow [this guide](https://gabrieltanner.org/blog/turn-server/) to either install coturn directly on your system (Step 1) \ -> or deploy it via docker-compose (Step 5). +## TURN server for Internet Transfer -> PairDrop via HTTPS -> -> On some browsers PairDrop must be served over TLS in order for some feautures to work properly. These may include copying an incoming message via the 'copy' button, installing PairDrop as PWA, persistent pairing of devices and changing of the display name, and notifications. Naturally, this is also recommended to increase security. +Beware that you have to host your own TURN server to enable transfers between different networks. + +Follow [this guide](https://gabrieltanner.org/blog/turn-server/) to either install coturn directly on your system (Step 1) +or deploy it via Docker (Step 5). + +You can use the `docker-compose-coturn.yml` in this repository. See [Coturn and PairDrop via Docker Compose](#coturn-and-pairdrop-via-docker-compose). + +Alternatively, use a free, pre-configured TURN server like [OpenRelay](https://www.metered.ca/tools/openrelay/) + +
+ +## PairDrop via HTTPS + +On some browsers PairDrop must be served over TLS in order for some features to work properly. +These may include: +- Copying an incoming message via the 'copy' button +- Installing PairDrop as PWA +- Persistent pairing of devices +- Changing of the display name +- Notifications + +Naturally, this is also recommended to increase security. + +
## Deployment with Docker +The easiest way to get PairDrop up and running is by using Docker. + ### Docker Image from Docker Hub ```bash docker run -d --restart=unless-stopped --name=pairdrop -p 127.0.0.1:3000:3000 lscr.io/linuxserver/pairdrop ``` - -> You must use a server proxy to set the X-Forwarded-For \ -> to prevent all clients from discovering each other (See [#HTTP-Server](#http-server)). -> -> To prevent bypassing the proxy by reaching the docker container directly, \ -> `127.0.0.1` is specified in the run command. - -#### Options / Flags -Set options by using the following flags in the `docker run` command: - -##### Port -```bash --p 127.0.0.1:8080:3000 -``` -> Specify the port used by the docker image -> - 3000 -> `-p 127.0.0.1:3000:3000` -> - 8080 -> `-p 127.0.0.1:8080:3000` -##### Rate limiting requests -```bash --e RATE_LIMIT=true -``` -> Limits clients to 1000 requests per 5 min - -##### IPv6 Localization -```bash --e IPV6_LOCALIZE=4 -``` -> To enable Peer Discovery among IPv6 peers, you can specify a reduced number of segments \ -> of the client IPv6 address to be evaluated as the peer's IP. \ -> This can be especially useful when using Cloudflare as a proxy. -> -> The flag must be set to an **integer** between `1` and `7`. \ -> The number represents the number of IPv6 [hextets](https://en.wikipedia.org/wiki/IPv6#Address_representation) \ -> to match the client IP against. The most common value would be `4`, \ -> which will group peers within the same `/64` subnet. - -##### Websocket Fallback (for VPN) -```bash --e WS_FALLBACK=true -``` -> Provides PairDrop to clients with an included websocket fallback \ -> if the peer to peer WebRTC connection is not available to the client. -> -> This is not used on the official https://pairdrop.net website, \ -> but you can activate it on your self-hosted instance. -> This is especially useful if you connect to your instance via a VPN (as most VPN services block WebRTC completely in order to hide your real IP address). ([Read more here](https://privacysavvy.com/security/safe-browsing/disable-webrtc-chrome-firefox-safari-opera-edge/)). -> -> **Warning:** All traffic sent between devices using this fallback \ -> is routed through the server and therefor not peer to peer! \ -> Beware that the traffic routed via this fallback is readable by the server. \ -> Only ever use this on instances you can trust. \ -> Additionally, beware that all traffic using this fallback debits the servers data plan. - -##### Specify STUN/TURN Servers -```bash --e RTC_CONFIG="rtc_config.json" -``` - -> Specify the STUN/TURN servers PairDrop clients use by setting \ -> `RTC_CONFIG` to a JSON file including the configuration. \ -> You can use `pairdrop/rtc_config_example.json` as a starting point. -> -> To host your own TURN server you can follow this guide: https://gabrieltanner.org/blog/turn-server/ -> Alternatively, use a free, pre-configured TURN server like [OpenRelay]([url](https://www.metered.ca/tools/openrelay/)) -> -> Default configuration: -> ```json -> { -> "sdpSemantics": "unified-plan", -> "iceServers": [ -> { -> "urls": "stun:stun.l.google.com:19302" -> } -> ] -> } -> ``` - -##### Debug Mode -```bash --e DEBUG_MODE="true" -``` - -> Use this flag to enable debugging information about the connecting peers IP addresses. \ -> This is quite useful to check whether the [#HTTP-Server](#http-server) \ -> is configured correctly, so the auto-discovery feature works correctly. \ -> Otherwise, all clients discover each other mutually, independently of their network status. -> -> If this flag is set to `"true"` each peer that connects to the PairDrop server will produce a log to STDOUT like this: -> ``` -> ----DEBUGGING-PEER-IP-START---- -> remoteAddress: ::ffff:172.17.0.1 -> x-forwarded-for: 19.117.63.126 -> cf-connecting-ip: undefined -> PairDrop uses: 19.117.63.126 -> IP is private: false -> if IP is private, '127.0.0.1' is used instead -> ----DEBUGGING-PEER-IP-END---- -> ``` -> If the IP PairDrop uses is the public IP of your device, everything is set up correctly. \ ->To find out your devices public IP visit https://www.whatismyip.com/. -> -> To preserve your clients' privacy, **never use this flag in production!** +> This image is hosted by [linuxserver.io](https://linuxserver.io). For more information visit https://hub.docker.com/r/linuxserver/pairdrop
-### Docker Image from GHCR -```bash -docker run -d --restart=unless-stopped --name=pairdrop -p 127.0.0.1:3000:3000 ghcr.io/schlagmichdoch/pairdrop npm run start:prod -``` -> You must use a server proxy to set the X-Forwarded-For to prevent \ -> all clients from discovering each other (See [#HTTP-Server](#http-server)). -> -> To prevent bypassing the proxy by reaching the Docker container directly, \ -> `127.0.0.1` is specified in the run command. -> -> To specify options replace `npm run start:prod` \ -> according to [the documentation below.](#options--flags-1) +### Docker Image from GitHub Container Registry (ghcr.io) -> The Docker Image includes a healthcheck. \ -> Read more about [Docker Swarm Usage](docker-swarm-usage.md#docker-swarm-usage). +```bash +docker run -d --restart=unless-stopped --name=pairdrop -p 127.0.0.1:3000:3000 ghcr.io/schlagmichdoch/pairdrop +``` + + +
### Docker Image self-built + #### Build the image + ```bash docker build --pull . -f Dockerfile -t pairdrop ``` -> A GitHub action is set up to do this step automatically. + +> A GitHub action is set up to do this step automatically at the release of new versions. > > `--pull` ensures always the latest node image is used. #### Run the image + ```bash -docker run -d --restart=unless-stopped --name=pairdrop -p 127.0.0.1:3000:3000 -it pairdrop npm run start:prod +docker run -d --restart=unless-stopped --name=pairdrop -p 127.0.0.1:3000:3000 -it pairdrop ``` -> You must use a server proxy to set the X-Forwarded-For \ + +> You must use a server proxy to set the `X-Forwarded-For` header > to prevent all clients from discovering each other (See [#HTTP-Server](#http-server)). > -> To prevent bypassing the proxy by reaching the Docker container \ -> directly, `127.0.0.1` is specified in the run command. -> -> To specify options replace `npm run start:prod` \ -> according to [the documentation below.](#options--flags-1) +> To prevent bypassing the proxy by reaching the docker container directly, +> `127.0.0.1` is specified in the run command. -> The Docker Image includes a Healthcheck. \ -Read more about [Docker Swarm Usage](docker-swarm-usage.md#docker-swarm-usage). + +
+ +### Flags + +Set options by using the following flags in the `docker run` command: + +#### Port + +```bash +-p 127.0.0.1:8080:3000 +``` + +> Specify the port used by the docker image +> +> - 3000 -> `-p 127.0.0.1:3000:3000` +> - 8080 -> `-p 127.0.0.1:8080:3000` + +#### Set Environment Variables via Docker + +Environment Variables are set directly in the `docker run` command: \ +e.g. `docker run -p 127.0.0.1:3000:3000 -it pairdrop -e DEBUG_MODE="true"` + +Overview of available Environment Variables are found [here](#environment-variables). + +Example: +```bash +docker run -d \ + --name=pairdrop \ + --restart=unless-stopped \ + -p 127.0.0.1:3000:3000 \ + -e PUID=1000 \ + -e PGID=1000 \ + -e WS_SERVER=false \ + -e WS_FALLBACK=false \ + -e RTC_CONFIG=false \ + -e RATE_LIMIT=false \ + -e DEBUG_MODE=false \ + -e TZ=Etc/UTC \ + lscr.io/linuxserver/pairdrop +```
## Deployment with Docker Compose -Here's an example docker-compose file: + +Here's an example docker compose file: ```yaml -version: "2" +version: "3" services: pairdrop: - image: lscr.io/linuxserver/pairdrop:latest + image: "lscr.io/linuxserver/pairdrop:latest" container_name: pairdrop restart: unless-stopped environment: @@ -183,22 +134,26 @@ services: - PGID=1000 # GID to run the application as - WS_FALLBACK=false # Set to true to enable websocket fallback if the peer to peer WebRTC connection is not available to the client. - RATE_LIMIT=false # Set to true to limit clients to 1000 requests per 5 min. + - RTC_CONFIG=false # Set to the path of a file that specifies the STUN/TURN servers. + - DEBUG_MODE=false # Set to true to debug container and peer connections. - TZ=Etc/UTC # Time Zone ports: - - 127.0.0.1:3000:3000 # Web UI + - "127.0.0.1:3000:3000" # Web UI ``` Run the compose file with `docker compose up -d`. -> You must use a server proxy to set the X-Forwarded-For \ +> You must use a server proxy to set the `X-Forwarded-For` header > to prevent all clients from discovering each other (See [#HTTP-Server](#http-server)). > -> To prevent bypassing the proxy by reaching the Docker container \ -> directly, `127.0.0.1` is specified in the run command. +> To prevent bypassing the proxy by reaching the Docker container +> directly, `127.0.0.1` is specified in the `ports` argument.
-## Deployment with node +## Deployment with Node.js + +Clone this repository and enter the folder ```bash git clone https://github.com/schlagmichdoch/PairDrop.git && cd PairDrop @@ -212,56 +167,223 @@ npm install Start the server with: -```bash -node index.js -``` -or ```bash npm start ``` -> Remember to check your IP address using your OS command to see where you can access the server. - > By default, the node server listens on port 3000. +
-### Environment variables -#### Port -On Unix based systems -```bash -PORT=3010 npm start -``` -On Windows -```bash -$env:PORT=3010; npm start -``` -> Specify the port PairDrop is running on. (Default: 3000) +### Options / Flags + +These are some flags only reasonable when deploying via Node.js + +#### Port + +```bash +PORT=3000 +``` + +> Default: `3000` +> +> Environment variable to specify the port used by the Node.js server \ +> e.g. `PORT=3010 npm start` + +#### Local Run + +```bash +npm start -- --localhost-only +``` + +> Only allow connections from localhost. +> +> You must use a server proxy to set the `X-Forwarded-For` header +> to prevent all clients from discovering each other (See [#HTTP-Server](#http-server)). +> +> Use this when deploying PairDrop with node to prevent +> bypassing the reverse proxy by reaching the Node.js server directly. + +#### Automatic restart on error + +```bash +npm start -- --auto-restart +``` + +> Restarts server automatically on error + +#### Production (autostart and rate-limit) + +```bash +npm run start:prod +``` + +> shortcut for `RATE_LIMIT=5 npm start -- --auto-restart` + +#### Production (autostart, rate-limit, localhost-only) + +```bash +npm run start:prod -- --localhost-only +``` + +> To prevent connections to the node server from bypassing \ +> the proxy server you should always use "--localhost-only" on production. + +#### Set Environment Variables via Node.js + +To specify environment variables set them in the run command in front of `npm start`. +The syntax is different on Unix and Windows. + +On Unix based systems + +```bash +PORT=3000 RTC_CONFIG="rtc_config.json" npm start +``` + +On Windows + +```bash +$env:PORT=3000 RTC_CONFIG="rtc_config.json"; npm start +``` + +Overview of available Environment Variables are found [here](#environment-variables). + +
+ +## Environment Variables + +### Debug Mode + +```bash +DEBUG_MODE="true" +``` + +> Default: `false` +> +> Logs the used environment variables for debugging. +> +> Prints debugging information about the connecting peers IP addresses. +> +> This is quite useful to check whether the [#HTTP-Server](#http-server) +> is configured correctly, so the auto-discovery feature works correctly. +> Otherwise, all clients discover each other mutually, independently of their network status. +> +> If this flag is set to `"true"` each peer that connects to the PairDrop server will produce a log to STDOUT like this: +> +> ``` +> ----DEBUGGING-PEER-IP-START---- +> remoteAddress: ::ffff:172.17.0.1 +> x-forwarded-for: 19.117.63.126 +> cf-connecting-ip: undefined +> PairDrop uses: 19.117.63.126 +> IP is private: false +> if IP is private, '127.0.0.1' is used instead +> ----DEBUGGING-PEER-IP-END---- +> ``` +> +> If the IP address "PairDrop uses" matches the public IP address of the client device, everything is set up correctly. \ +> To find out the public IP address of the client device visit https://whatsmyip.com/. +> +> To preserve your clients' privacy: \ +> **Never use this environment variable in production!** + + +
+ +### Rate limiting requests + +```bash +RATE_LIMIT=1 +``` + +> Default: `false` +> +> Limits clients to 1000 requests per 5 min +> +> "If you are behind a proxy/load balancer (usually the case with most hosting services, e.g. Heroku, Bluemix, AWS ELB, +> Render, Nginx, Cloudflare, Akamai, Fastly, Firebase Hosting, Rackspace LB, Riverbed Stingray, etc.), the IP address of +> the request might be the IP of the load balancer/reverse proxy (making the rate limiter effectively a global one and +> blocking all requests once the limit is reached) or undefined." +> (See: https://express-rate-limit.mintlify.app/guides/troubleshooting-proxy-issues) +> +> To find the correct number to use for this setting: +> +> 1. Start PairDrop with `DEBUG_MODE=True` and `RATE_LIMIT=1` +> 2. Make a `get` request to `/ip` of the PairDrop instance (e.g. `https://pairdrop-example.net/ip`) +> 3. Check if the IP address returned in the response matches your public IP address (find out by visiting e.g. https://whatsmyip.com/) +> 4. You have found the correct number if the IP addresses match. If not, then increase `RATE_LIMIT` by one and redo 1. - 4. +> +> e.g. on Render you must use RATE_LIMIT=5 + + +
+ +### IPv6 Localization -#### IPv6 Localization ```bash IPV6_LOCALIZE=4 ``` -> Truncate a portion of the client IPv6 address to make peers more discoverable. \ -> See [Options/Flags](#options--flags) above. -#### Specify STUN/TURN Server -On Unix based systems +> Default: `false` +> +> To enable Peer Auto-Discovery among IPv6 peers, you can specify a reduced number of segments \ +> of the client IPv6 address to be evaluated as the peer's IP. \ +> This can be especially useful when using Cloudflare as a proxy. +> +> The flag must be set to an **integer** between `1` and `7`. \ +> The number represents the number of IPv6 [hextets](https://en.wikipedia.org/wiki/IPv6#Address_representation) \ +> to match the client IP against. The most common value would be `4`, \ +> which will group peers within the same `/64` subnet. + + +
+ +### Websocket Fallback (for VPN) + ```bash -RTC_CONFIG="rtc_config.json" npm start +WS_FALLBACK=true ``` -On Windows -```bash -$env:RTC_CONFIG="rtc_config.json"; npm start -``` -> Specify the STUN/TURN servers PairDrop clients use by setting `RTC_CONFIG` \ -> to a JSON file including the configuration. \ -> You can use `pairdrop/rtc_config_example.json` as a starting point. + +> Default: `false` +> +> Provides PairDrop to clients with an included websocket fallback \ +> if the peer to peer WebRTC connection is not available to the client. +> +> This is not used on the official https://pairdrop.net website, +> but you can activate it on your self-hosted instance.\ +> This is especially useful if you connect to your instance via a VPN (as most VPN services block WebRTC completely in +> order to hide your real IP address). ([Read more here](https://privacysavvy.com/security/safe-browsing/disable-webrtc-chrome-firefox-safari-opera-edge/)). +> +> **Warning:** \ +> All traffic sent between devices using this fallback +> is routed through the server and therefor not peer to peer! > -> To host your own TURN server you can follow this guide: \ -> https://gabrieltanner.org/blog/turn-server/ +> Beware that the traffic routed via this fallback is readable by the server. \ +> Only ever use this on instances you can trust. +> +> Additionally, beware that all traffic using this fallback debits the servers data plan. + + +
+ +### Specify STUN/TURN Servers + +```bash +RTC_CONFIG="rtc_config.json" +``` + +> Default: `false` +> +> Specify the STUN/TURN servers PairDrop clients use by setting \ +> `RTC_CONFIG` to a JSON file including the configuration. \ +> You can use `rtc_config_example.json` as a starting point. +> +> To host your own TURN server you can follow this guide: https://gabrieltanner.org/blog/turn-server/ +> Alternatively, use a free, pre-configured TURN server like [OpenRelay](<[url](https://www.metered.ca/tools/openrelay/)>) > > Default configuration: +> > ```json > { > "sdpSemantics": "unified-plan", @@ -273,109 +395,51 @@ $env:RTC_CONFIG="rtc_config.json"; npm start > } > ``` -#### Debug Mode -On Unix based systems +
+ +You can host an instance that uses another signaling server +This can be useful if you don't want to trust the client files that are hosted on another instance but still want to connect to devices that use https://pairdrop.net. +### Host Websocket Server (for VPN) + ```bash -DEBUG_MODE="true" npm start -``` -On Windows -```bash -$env:DEBUG_MODE="true"; npm start +SIGNALING_SERVER="pairdrop.net" ``` -> Use this flag to enable debugging info about the connecting peers IP addresses. \ -> This is quite useful to check whether the [#HTTP-Server](#http-server) \ -> is configured correctly, so the auto discovery feature works correctly. \ -> Otherwise, all clients discover each other mutually, independently of their network status. +> Default: `false` > -> If this flag is set to `"true"` each peer that connects to the \ -> PairDrop server will produce a log to STDOUT like this: -> ``` -> ----DEBUGGING-PEER-IP-START---- -> remoteAddress: ::ffff:172.17.0.1 -> x-forwarded-for: 19.117.63.126 -> cf-connecting-ip: undefined -> PairDrop uses: 19.117.63.126 -> IP is private: false -> if IP is private, '127.0.0.1' is used instead -> ----DEBUGGING-PEER-IP-END---- -> ``` -> If the IP PairDrop uses is the public IP of your device everything is set up correctly. \ ->Find your devices public IP by visiting https://www.whatismyip.com/. -> -> Preserve your clients' privacy. **Never use this flag in production!** - - -### Options / Flags -#### Local Run -```bash -npm start -- --localhost-only -``` -> Only allow connections from localhost. +> By default, clients connecting to your instance use the signaling server of your instance to connect to other devices. > -> You must use a server proxy to set the X-Forwarded-For \ -> to prevent all clients from discovering each other (See [#HTTP-Server](#http-server)). -> -> Use this when deploying PairDrop with node to prevent \ -> bypassing the proxy by reaching the Docker container directly. - -#### Automatic restart on error -```bash -npm start -- --auto-restart -``` -> Restarts server automatically on error - -
- -#### Rate limiting requests -```bash -npm start -- --rate-limit -``` -> Limits clients to 1000 requests per 5 min - -
- -#### Websocket Fallback (for VPN) -```bash -npm start -- --include-ws-fallback -``` -> Provides PairDrop to clients with an included websocket fallback \ -> if the peer to peer WebRTC connection is not available to the client. -> -> This is not used on the official https://pairdrop.net, \ -but you can activate it on your self-hosted instance. \ -> This is especially useful if you connect to your instance \ -> via a VPN as most VPN services block WebRTC completely in order to hide your real IP address. -> ([Read more](https://privacysavvy.com/security/safe-browsing/disable-webrtc-chrome-firefox-safari-opera-edge/)). +> By using `SIGNALING_SERVER`, you can host an instance that uses another signaling server. > -> **Warning:** All traffic sent between devices using this fallback \ -> is routed through the server and therefor not peer to peer! \ -> Beware that the traffic routed via this fallback is readable by the server. \ -> Only ever use this on instances you can trust. \ -> Additionally, beware that all traffic using this fallback debits the servers data plan. - +> This can be useful if you want to ensure the integrity of the client files and don't want to trust the client files that are hosted on another PairDrop instance but still want to connect to devices that use the other instance. +> E.g. host your own client files under *pairdrop.your-domain.com* but use the official signaling server under *pairdrop.net* +> This way devices connecting to *pairdrop.your-domain.com* and *pairdrop.net* can discover each other. +> +> Beware that the version of your PairDrop server is compatible with the version of the signaling server. +> +> `WS_SERVER` must be a valid url without the protocol prefix. +> Examples of valid values: `pairdrop.net`, `pairdrop.your-domain.com:3000`, `your-domain.com/pairdrop`
-#### Production (autostart and rate-limit) -```bash -npm run start:prod -``` +## Healthcheck -#### Production (autostart, rate-limit, localhost-only and websocket fallback for VPN) -```bash -npm run start:prod -- --localhost-only --include-ws-fallback -``` -> To prevent connections to the node server from bypassing \ -> the proxy server you should always use "--localhost-only" on production. +> The Docker Image hosted on `ghcr.io` and the self-built Docker Image include a healthcheck. +> +> Read more about [Docker Swarm Usage](docker-swarm-usage.md#docker-swarm-usage). + +
## HTTP-Server + When running PairDrop, the `X-Forwarded-For` header has to be set by a proxy. \ Otherwise, all clients will be mutually visible. To check if your setup is configured correctly [use the environment variable `DEBUG_MODE="true"`](#debug-mode). ### Using nginx + #### Allow http and https requests + ``` server { listen 80; @@ -409,6 +473,7 @@ server { ``` #### Automatic http to https redirect: + ``` server { listen 80; @@ -437,14 +502,21 @@ server { } ``` + +
+ ### Using Apache + install modules `proxy`, `proxy_http`, `mod_proxy_wstunnel` + ```bash a2enmod proxy ``` + ```bash a2enmod proxy_http ``` + ```bash a2enmod proxy_wstunnel ``` @@ -454,16 +526,18 @@ a2enmod proxy_wstunnel Create a new configuration file under `/etc/apache2/sites-available` (on Debian) **pairdrop.conf** + #### Allow HTTP and HTTPS requests + ```apacheconf - + ProxyPass / http://127.0.0.1:3000/ RewriteEngine on RewriteCond %{HTTP:Upgrade} websocket [NC] RewriteCond %{HTTP:Connection} upgrade [NC] RewriteRule ^/?(.*) "ws://127.0.0.1:3000/$1" [P,L] - + ProxyPass / https://127.0.0.1:3000/ RewriteEngine on RewriteCond %{HTTP:Upgrade} websocket [NC] @@ -471,12 +545,14 @@ Create a new configuration file under `/etc/apache2/sites-available` (on Debian) RewriteRule ^/?(.*) "wws://127.0.0.1:3000/$1" [P,L] ``` + #### Automatic HTTP to HTTPS redirect: + ```apacheconf - + Redirect permanent / https://127.0.0.1:3000/ - + ProxyPass / https://127.0.0.1:3000/ RewriteEngine on RewriteCond %{HTTP:Upgrade} websocket [NC] @@ -484,62 +560,120 @@ Create a new configuration file under `/etc/apache2/sites-available` (on Debian) RewriteRule ^/?(.*) "wws://127.0.0.1:3000/$1" [P,L] ``` + Activate the new virtual host and reload Apache: + ```bash a2ensite pairdrop ``` + ```bash service apache2 reload ``` -# Local Development -## Install +
+ +## Coturn and PairDrop via Docker Compose + +### Setup container +To run coturn and PairDrop at once by using the `docker-compose-coturn.yml` with TURN over TLS enabled +you need to follow these steps: + +1. Generate or retrieve certificates for your `` (e.g. letsencrypt / certbot) +2. Create `./ssl` folder: `mkdir ssl` +3. Copy your ssl-certificates and the privkey to `./ssl` +4. Restrict access to `./ssl`: `chown -R nobody:nogroup ./ssl` +5. Create a dh-params file: `openssl dhparam -out ./ssl/dhparams.pem 4096` +6. Copy `rtc_config_example.json` to `rtc_config.json` +7. Copy `turnserver_example.conf` to `turnserver.conf` +8. Change `` in both files to the domain where your PairDrop instance is running +9. Change `username` and `password` in `turnserver.conf` and `rtc-config.json` +10. To start the container including coturn run: \ + `docker compose -f docker-compose-coturn.yml up -d` + +
+ +#### Setup container +To restart the container including coturn run: \ + `docker compose -f docker-compose-coturn.yml restart` + +
+ +#### Setup container +To stop the container including coturn run: \ + `docker compose -f docker-compose-coturn.yml stop` + +
+ +### Firewall +To run PairDrop including its own coturn-server you need to punch holes in the firewall. These ports must be opened additionally: +- 3478 tcp/udp +- 5349 tcp/udp +- 10000:20000 tcp/udp + +
+ +### Firewall +To run PairDrop including its own coturn-server you need to punch holes in the firewall. These ports must be opened additionally: +- 3478 tcp/udp +- 5349 tcp/udp +- 10000:20000 tcp/udp + +
+ +## Local Development + +### Install + All files needed for developing are available on the branch `dev`. First, [Install docker with docker-compose.](https://docs.docker.com/compose/install/) Then, clone the repository and run docker-compose: + ```bash - git clone https://github.com/schlagmichdoch/PairDrop.git - - cd PairDrop - - git checkout dev - - docker-compose up -d +git clone https://github.com/schlagmichdoch/PairDrop.git && cd PairDrop ``` +```bash +git checkout dev +``` +```bash +docker compose -f docker-compose-dev.yml up -d +``` + Now point your web browser to `http://localhost:8080`. -- To restart the containers, run `docker-compose restart`. -- To stop the containers, run `docker-compose stop`. -- To debug the NodeJS server, run `docker logs pairdrop_node_1`. +- To restart the containers, run `docker compose restart`. +- To stop the containers, run `docker compose stop`. +- To debug the Node.js server, run `docker logs pairdrop`.
-## Testing PWA related features +### Testing PWA related features + PWAs requires the app to be served under a correctly set up and trusted TLS endpoint. -The NGINX container creates a CA certificate and a website certificate for you. \ -To correctly set the common name of the certificate, \ -you need to change the FQDN environment variable in `docker/fqdn.env` \ +The NGINX container creates a CA certificate and a website certificate for you. +To correctly set the common name of the certificate, +you need to change the FQDN environment variable in `docker/fqdn.env` to the fully qualified domain name of your workstation. If you want to test PWA features, you need to trust the CA of the certificate for your local deployment. \ For your convenience, you can download the crt file from `http://:8080/ca.crt`. \ Install that certificate to the trust store of your operating system. \ -- On Windows, make sure to install it to the `Trusted Root Certification Authorities` store. \ -- On macOS, double-click the installed CA certificate in `Keychain Access`, \ -- expand `Trust`, and select `Always Trust` for SSL. \ -- Firefox uses its own trust store. To install the CA, \ -- point Firefox at `http://:8080/ca.crt`. \ -- When prompted, select `Trust this CA to identify websites` and click *OK*. \ -- When using Chrome, you need to restart Chrome so it reloads the trust store (`chrome://restart`). \ -- Additionally, after installing a new cert, \ -- you need to clear the Storage (DevTools → Application → Clear storage → Clear site data). + +- On Windows, make sure to install it to the `Trusted Root Certification Authorities` store. +- On macOS, double-click the installed CA certificate in `Keychain Access`, +- expand `Trust`, and select `Always Trust` for SSL. +- Firefox uses its own trust store. To install the CA, +- point Firefox at `http://:8080/ca.crt`. +- When prompted, select `Trust this CA to identify websites` and click _OK_. +- When using Chrome, you need to restart Chrome so it reloads the trust store (`chrome://restart`). +- Additionally, after installing a new cert, you need to clear the Storage (DevTools → Application → Clear storage → Clear site data). Please note that the certificates (CA and webserver cert) expire after a day. -Also, whenever you restart the NGINX Docker, container new certificates are created. +Also, whenever you restart the NGINX Docker container new certificates are created. The site is served on `https://:8443`. diff --git a/index.js b/index.js deleted file mode 100644 index ae50931..0000000 --- a/index.js +++ /dev/null @@ -1,852 +0,0 @@ -const process = require('process') -const crypto = require('crypto') -const {spawn} = require('child_process') -const WebSocket = require('ws'); -const fs = require('fs'); -const parser = require('ua-parser-js'); -const { uniqueNamesGenerator, animals, colors } = require('unique-names-generator'); -const express = require('express'); -const RateLimit = require('express-rate-limit'); -const http = require('http'); - -// Handle SIGINT -process.on('SIGINT', () => { - console.info("SIGINT Received, exiting...") - process.exit(0) -}) - -// Handle SIGTERM -process.on('SIGTERM', () => { - console.info("SIGTERM Received, exiting...") - process.exit(0) -}) - -// Handle APP ERRORS -process.on('uncaughtException', (error, origin) => { - console.log('----- Uncaught exception -----') - console.log(error) - console.log('----- Exception origin -----') - console.log(origin) -}) -process.on('unhandledRejection', (reason, promise) => { - console.log('----- Unhandled Rejection at -----') - console.log(promise) - console.log('----- Reason -----') - console.log(reason) -}) - -if (process.argv.includes('--auto-restart')) { - process.on( - 'uncaughtException', - () => { - process.once( - 'exit', - () => spawn( - process.argv.shift(), - process.argv, - { - cwd: process.cwd(), - detached: true, - stdio: 'inherit' - } - ) - ); - process.exit(); - } - ); -} - -const rtcConfig = process.env.RTC_CONFIG - ? JSON.parse(fs.readFileSync(process.env.RTC_CONFIG, 'utf8')) - : { - "sdpSemantics": "unified-plan", - "iceServers": [ - { - "urls": "stun:stun.l.google.com:19302" - } - ] - }; - -const app = express(); - -if (process.argv.includes('--rate-limit')) { - const limiter = RateLimit({ - windowMs: 5 * 60 * 1000, // 5 minutes - max: 1000, // Limit each IP to 1000 requests per `window` (here, per 5 minutes) - message: 'Too many requests from this IP Address, please try again after 5 minutes.', - standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers - legacyHeaders: false, // Disable the `X-RateLimit-*` headers - }) - - app.use(limiter); - // ensure correct client ip and not the ip of the reverse proxy is used for rate limiting on render.com - // see https://github.com/express-rate-limit/express-rate-limit#troubleshooting-proxy-issues - app.set('trust proxy', 5); -} - -if (process.argv.includes('--include-ws-fallback')) { - app.use(express.static('public_included_ws_fallback')); -} else { - app.use(express.static('public')); -} - -const debugMode = process.env.DEBUG_MODE === "true"; - -if (debugMode) { - console.log("DEBUG_MODE is active. To protect privacy, do not use in production.") -} - -let ipv6_lcl; -if (process.env.IPV6_LOCALIZE) { - ipv6_lcl = parseInt(process.env.IPV6_LOCALIZE); - if (!ipv6_lcl || !(0 < ipv6_lcl && ipv6_lcl < 8)) { - console.error("IPV6_LOCALIZE must be an integer between 1 and 7"); - return; - } - - console.log("IPv6 client IPs will be localized to", ipv6_lcl, ipv6_lcl === 1 ? "segment" : "segments"); -} - -app.use(function(req, res) { - res.redirect('/'); -}); - -app.get('/', (req, res) => { - res.sendFile('index.html'); -}); - -const server = http.createServer(app); -const port = process.env.PORT || 3000; - -if (process.argv.includes('--localhost-only')) { - server.listen(port, '127.0.0.1'); -} else { - server.listen(port); -} - -server.on('error', (err) => { - if (err.code === 'EADDRINUSE') { - console.error(err); - console.info("Error EADDRINUSE received, exiting process without restarting process..."); - process.exit(0) - } -}); - -class PairDropServer { - - constructor() { - this._wss = new WebSocket.Server({ server }); - this._wss.on('connection', (socket, request) => this._onConnection(new Peer(socket, request))); - - this._rooms = {}; // { roomId: peers[] } - this._roomSecrets = {}; // { pairKey: roomSecret } - - this._keepAliveTimers = {}; - - console.log('PairDrop is running on port', port); - } - - _onConnection(peer) { - peer.socket.on('message', message => this._onMessage(peer, message)); - peer.socket.onerror = e => console.error(e); - - this._keepAlive(peer); - - this._send(peer, { - type: 'rtc-config', - config: rtcConfig - }); - - // send displayName - this._send(peer, { - type: 'display-name', - message: { - displayName: peer.name.displayName, - deviceName: peer.name.deviceName, - peerId: peer.id, - peerIdHash: hasher.hashCodeSalted(peer.id) - } - }); - } - - _onMessage(sender, message) { - // Try to parse message - try { - message = JSON.parse(message); - } catch (e) { - return; // TODO: handle malformed JSON - } - - switch (message.type) { - case 'disconnect': - this._onDisconnect(sender); - break; - case 'pong': - this._setKeepAliveTimerToNow(sender); - break; - case 'join-ip-room': - this._joinIpRoom(sender); - break; - case 'room-secrets': - this._onRoomSecrets(sender, message); - break; - case 'room-secrets-deleted': - this._onRoomSecretsDeleted(sender, message); - break; - case 'pair-device-initiate': - this._onPairDeviceInitiate(sender); - break; - case 'pair-device-join': - this._onPairDeviceJoin(sender, message); - break; - case 'pair-device-cancel': - this._onPairDeviceCancel(sender); - break; - case 'regenerate-room-secret': - this._onRegenerateRoomSecret(sender, message); - break; - case 'create-public-room': - this._onCreatePublicRoom(sender); - break; - case 'join-public-room': - this._onJoinPublicRoom(sender, message); - break; - case 'leave-public-room': - this._onLeavePublicRoom(sender); - break; - case 'signal': - default: - this._signalAndRelay(sender, message); - } - } - - _signalAndRelay(sender, message) { - const room = message.roomType === 'ip' - ? sender.ip - : message.roomId; - - // relay message to recipient - if (message.to && Peer.isValidUuid(message.to) && this._rooms[room]) { - const recipient = this._rooms[room][message.to]; - delete message.to; - // add sender - message.sender = { - id: sender.id, - rtcSupported: sender.rtcSupported - }; - this._send(recipient, message); - } - } - - _onDisconnect(sender) { - this._disconnect(sender); - } - - _disconnect(sender) { - this._removePairKey(sender.pairKey); - sender.pairKey = null; - - this._cancelKeepAlive(sender); - delete this._keepAliveTimers[sender.id]; - - this._leaveIpRoom(sender, true); - this._leaveAllSecretRooms(sender, true); - this._leavePublicRoom(sender, true); - - sender.socket.terminate(); - } - - _onRoomSecrets(sender, message) { - if (!message.roomSecrets) return; - - const roomSecrets = message.roomSecrets.filter(roomSecret => { - return /^[\x00-\x7F]{64,256}$/.test(roomSecret); - }) - - if (!roomSecrets) return; - - this._joinSecretRooms(sender, roomSecrets); - } - - _onRoomSecretsDeleted(sender, message) { - for (let i = 0; i 5 * timeout) { - // Disconnect peer if unresponsive for 10s - this._disconnect(peer); - return; - } - - this._send(peer, { type: 'ping' }); - - this._keepAliveTimers[peer.id].timer = setTimeout(() => this._keepAlive(peer), timeout); - } - - _cancelKeepAlive(peer) { - if (this._keepAliveTimers[peer.id]?.timer) { - clearTimeout(this._keepAliveTimers[peer.id].timer); - } - } - - _setKeepAliveTimerToNow(peer) { - if (this._keepAliveTimers[peer.id]?.lastBeat) { - this._keepAliveTimers[peer.id].lastBeat = Date.now(); - } - } -} - - - -class Peer { - - constructor(socket, request) { - // set socket - this.socket = socket; - - // set remote ip - this._setIP(request); - - // set peer id - this._setPeerId(request); - - // is WebRTC supported ? - this.rtcSupported = request.url.indexOf('webrtc') > -1; - - // set name - this._setName(request); - - this.requestRate = 0; - - this.roomSecrets = []; - this.roomKey = null; - - this.publicRoomId = null; - } - - rateLimitReached() { - // rate limit implementation: max 10 attempts every 10s - if (this.requestRate >= 10) { - return true; - } - this.requestRate += 1; - setTimeout(_ => this.requestRate -= 1, 10000); - return false; - } - - _setIP(request) { - if (request.headers['cf-connecting-ip']) { - this.ip = request.headers['cf-connecting-ip'].split(/\s*,\s*/)[0]; - } else if (request.headers['x-forwarded-for']) { - this.ip = request.headers['x-forwarded-for'].split(/\s*,\s*/)[0]; - } else { - this.ip = request.connection.remoteAddress; - } - - // remove the prefix used for IPv4-translated addresses - if (this.ip.substring(0,7) === "::ffff:") - this.ip = this.ip.substring(7); - - let ipv6_was_localized = false; - if (ipv6_lcl && this.ip.includes(':')) { - this.ip = this.ip.split(':',ipv6_lcl).join(':'); - ipv6_was_localized = true; - } - - if (debugMode) { - console.debug("----DEBUGGING-PEER-IP-START----"); - console.debug("remoteAddress:", request.connection.remoteAddress); - console.debug("x-forwarded-for:", request.headers['x-forwarded-for']); - console.debug("cf-connecting-ip:", request.headers['cf-connecting-ip']); - if (ipv6_was_localized) - console.debug("IPv6 client IP was localized to", ipv6_lcl, ipv6_lcl > 1 ? "segments" : "segment"); - console.debug("PairDrop uses:", this.ip); - console.debug("IP is private:", this.ipIsPrivate(this.ip)); - console.debug("if IP is private, '127.0.0.1' is used instead"); - console.debug("----DEBUGGING-PEER-IP-END----"); - } - - // IPv4 and IPv6 use different values to refer to localhost - // put all peers on the same network as the server into the same room as well - if (this.ip === '::1' || this.ipIsPrivate(this.ip)) { - this.ip = '127.0.0.1'; - } - } - - ipIsPrivate(ip) { - // if ip is IPv4 - if (!ip.includes(":")) { - // 10.0.0.0 - 10.255.255.255 || 172.16.0.0 - 172.31.255.255 || 192.168.0.0 - 192.168.255.255 - return /^(10)\.(.*)\.(.*)\.(.*)$/.test(ip) || /^(172)\.(1[6-9]|2[0-9]|3[0-1])\.(.*)\.(.*)$/.test(ip) || /^(192)\.(168)\.(.*)\.(.*)$/.test(ip) - } - - // else: ip is IPv6 - const firstWord = ip.split(":").find(el => !!el); //get first not empty word - - // The original IPv6 Site Local addresses (fec0::/10) are deprecated. Range: fec0 - feff - if (/^fe[c-f][0-f]$/.test(firstWord)) - return true; - - // These days Unique Local Addresses (ULA) are used in place of Site Local. - // Range: fc00 - fcff - else if (/^fc[0-f]{2}$/.test(firstWord)) - return true; - - // Range: fd00 - fcff - else if (/^fd[0-f]{2}$/.test(firstWord)) - return true; - - // Link local addresses (prefixed with fe80) are not routable - else if (firstWord === "fe80") - return true; - - // Discard Prefix - else if (firstWord === "100") - return true; - - // Any other IP address is not Unique Local Address (ULA) - return false; - } - - _setPeerId(request) { - const searchParams = new URL(request.url, "http://server").searchParams; - let peerId = searchParams.get("peer_id"); - let peerIdHash = searchParams.get("peer_id_hash"); - if (peerId && Peer.isValidUuid(peerId) && this.isPeerIdHashValid(peerId, peerIdHash)) { - this.id = peerId; - } else { - this.id = crypto.randomUUID(); - } - } - - toString() { - return `` - } - - _setName(req) { - let ua = parser(req.headers['user-agent']); - - - let deviceName = ''; - - if (ua.os && ua.os.name) { - deviceName = ua.os.name.replace('Mac OS', 'Mac') + ' '; - } - - if (ua.device.model) { - deviceName += ua.device.model; - } else { - deviceName += ua.browser.name; - } - - if(!deviceName) - deviceName = 'Unknown Device'; - - const displayName = uniqueNamesGenerator({ - length: 2, - separator: ' ', - dictionaries: [colors, animals], - style: 'capital', - seed: cyrb53(this.id) - }) - - this.name = { - model: ua.device.model, - os: ua.os.name, - browser: ua.browser.name, - type: ua.device.type, - deviceName, - displayName - }; - } - - getInfo() { - return { - id: this.id, - name: this.name, - rtcSupported: this.rtcSupported - } - } - - static isValidUuid(uuid) { - return /^([0-9]|[a-f]){8}-(([0-9]|[a-f]){4}-){3}([0-9]|[a-f]){12}$/.test(uuid); - } - - isPeerIdHashValid(peerId, peerIdHash) { - return peerIdHash === hasher.hashCodeSalted(peerId); - } - - addRoomSecret(roomSecret) { - if (!(roomSecret in this.roomSecrets)) { - this.roomSecrets.push(roomSecret); - } - } - - removeRoomSecret(roomSecret) { - if (roomSecret in this.roomSecrets) { - delete this.roomSecrets[roomSecret]; - } - } -} - -const hasher = (() => { - let password; - return { - hashCodeSalted(salt) { - if (!password) { - // password is created on first call. - password = randomizer.getRandomString(128); - } - - return crypto.createHash("sha3-512") - .update(password) - .update(crypto.createHash("sha3-512").update(salt, "utf8").digest("hex")) - .digest("hex"); - } - } -})() - -const randomizer = (() => { - let charCodeLettersOnly = r => 65 <= r && r <= 90; - let charCodeAllPrintableChars = r => r === 45 || 47 <= r && r <= 57 || 64 <= r && r <= 90 || 97 <= r && r <= 122; - - return { - getRandomString(length, lettersOnly = false) { - const charCodeCondition = lettersOnly - ? charCodeLettersOnly - : charCodeAllPrintableChars; - - let string = ""; - while (string.length < length) { - let arr = new Uint16Array(length); - crypto.webcrypto.getRandomValues(arr); - arr = Array.apply([], arr); /* turn into non-typed array */ - arr = arr.map(function (r) { - return r % 128 - }) - arr = arr.filter(function (r) { - /* strip non-printables: if we transform into desirable range we have a probability bias, so I suppose we better skip this character */ - return charCodeCondition(r); - }); - string += String.fromCharCode.apply(String, arr); - } - return string.substring(0, length) - } - } -})() - -/* - cyrb53 (c) 2018 bryc (github.com/bryc) - A fast and simple hash function with decent collision resistance. - Largely inspired by MurmurHash2/3, but with a focus on speed/simplicity. - Public domain. Attribution appreciated. -*/ -const cyrb53 = function(str, seed = 0) { - let h1 = 0xdeadbeef ^ seed, h2 = 0x41c6ce57 ^ seed; - for (let i = 0, ch; i < str.length; i++) { - ch = str.charCodeAt(i); - h1 = Math.imul(h1 ^ ch, 2654435761); - h2 = Math.imul(h2 ^ ch, 1597334677); - } - h1 = Math.imul(h1 ^ (h1>>>16), 2246822507) ^ Math.imul(h2 ^ (h2>>>13), 3266489909); - h2 = Math.imul(h2 ^ (h2>>>16), 2246822507) ^ Math.imul(h1 ^ (h1>>>13), 3266489909); - return 4294967296 * (2097151 & h2) + (h1>>>0); -}; - -new PairDropServer(); diff --git a/package.json b/package.json index ac41c5e..01cc03d 100644 --- a/package.json +++ b/package.json @@ -1,11 +1,12 @@ { "name": "pairdrop", "version": "1.9.4", + "type": "module", "description": "", - "main": "index.js", + "main": "server/index.js", "scripts": { - "start": "node index.js", - "start:prod": "node index.js --rate-limit --auto-restart" + "start": "node server/index.js", + "start:prod": "node server/index.js --rate-limit --auto-restart" }, "author": "", "license": "ISC", diff --git a/public/index.html b/public/index.html index 9f6504b..2d51d8d 100644 --- a/public/index.html +++ b/public/index.html @@ -9,13 +9,13 @@ - + - + @@ -28,13 +28,14 @@ + - + @@ -108,6 +109,11 @@

+