Make web interface accessible for Docker deployment by default (#2189)

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.10-slim
+FROM python:3.11-slim
 LABEL maintainer="Soxoj <soxoj@protonmail.com>"
 WORKDIR /app
 RUN pip install --no-cache-dir --upgrade pip
@@ -13,4 +13,6 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/* /tmp/*
 COPY . .
 RUN YARL_NO_EXTENSIONS=1 python3 -m pip install --no-cache-dir .
+# For production use, set FLASK_HOST to a specific IP address for security
+ENV FLASK_HOST=0.0.0.0
 ENTRYPOINT ["maigret"]

maigret/maigret.py

@@ -611,7 +611,10 @@ async def main():
         port = (
             args.web if args.web else 5000
         )  # args.web is either the specified port or 5000 by default
-        app.run(port=port)
+
+        # Host configuration: secure by default, but allow override via environment
+        host = os.getenv('FLASK_HOST', '127.0.0.1')
+        app.run(host=host, port=port)
         return
 
     if usernames == {}:

maigret/web/app.py

@@ -19,7 +19,8 @@ from maigret.sites import MaigretDatabase
 from maigret.report import generate_report_context
 
 app = Flask(__name__)
-app.secret_key = 'your-secret-key-here'
+# Use environment variable for secret key, generate random one if not set
+app.secret_key = os.getenv('FLASK_SECRET_KEY', os.urandom(24).hex())
 
 # add background job tracking
 background_jobs = {}
@@ -338,4 +339,10 @@ if __name__ == '__main__':
         format='%(asctime)s - %(name)s - %(levelname)s - %(message)s',
     )
     debug_mode = os.getenv('FLASK_DEBUG', 'False').lower() in ['true', '1', 't']
-    app.run(debug=debug_mode)
+
+    # Host configuration: secure by default
+    # Use 127.0.0.1 for local development, 0.0.0.0 only if explicitly set
+    host = os.getenv('FLASK_HOST', '127.0.0.1')
+    port = int(os.getenv('FLASK_PORT', '5000'))
+
+    app.run(host=host, port=port, debug=debug_mode)