nightscout update

.gitignore

@@ -30,3 +30,7 @@ npm-debug.log
 /cgm-remote-monitor.sln
 /obj/Debug
 /*.bat
+
+# directories created by docker-compose.yml
+mongo-data/
+letsencrypt/

Dockerfile

@@ -2,17 +2,22 @@ FROM node:14.15.3-alpine
 
 LABEL maintainer="Nightscout Contributors"
 
-RUN mkdir -p /opt/app
-ADD . /opt/app
 WORKDIR /opt/app
-RUN chown -R node:node /opt/app
-USER node
+ADD . /opt/app
 
-RUN npm install && \
+# TODO: We should be able to do `RUN npm install --only=production`.
+# For this to work, we need to copy only package.json and things needed for `npm`'s to succeed.
+# TODO: Do we need to re-add `npm audit fix`? Or should that be part of a development process/stage?
+RUN npm install --cache /tmp/empty-cache && \
   npm run postinstall && \
   npm run env && \
-  npm audit fix
+  rm -rf /tmp/*
+  # TODO: These should be added in the future to correctly cache express-minify content to disk
+  # Currently, doing this breaks the browser cache.
+  # mkdir /tmp/public && \
+  # chown node:node /tmp/public
 
+USER node
 EXPOSE 1337
 
 CMD ["node", "lib/server/server.js"]

docker-compose.yml

@@ -0,0 +1,76 @@
+version: '3'
+
+services:
+  mongo:
+    image: mongo:4.4
+    volumes:
+      - ${NS_MONGO_DATA_DIR:-./mongo-data}:/data/db:cached
+
+  nightscout:
+    image: nightscout/cgm-remote-monitor:latest
+    container_name: nightscout
+    restart: always
+    depends_on:
+      - mongo
+    labels:
+      - 'traefik.enable=true'
+      # Change the below Host from `localhost` to be the web address where Nightscout is running.
+      # Also change the email address in the `traefik` service below.
+      - 'traefik.http.routers.nightscout.rule=Host(`localhost`)'
+      - 'traefik.http.routers.nightscout.entrypoints=websecure'
+      - 'traefik.http.routers.nightscout.tls.certresolver=le'
+    environment:
+      ### Variables for the container
+      NODE_ENV: production
+      TZ: Etc/UTC
+
+      ### Overridden variables for Docker Compose setup
+      # The `nightscout` service can use HTTP, because we use `traefik` to serve the HTTPS
+      # and manage TLS certificates
+      INSECURE_USE_HTTP: 'true'
+
+      # For all other settings, please refer to the Environment section of the README
+      ### Required variables
+      # MONGO_CONNECTION - The connection string for your Mongo database.
+      # Something like mongodb://sally:[email protected]:99999/nightscout
+      # The default connects to the `mongo` included in this docker-compose file.
+      # If you change it, you probably also want to comment out the entire `mongo` service block
+      # and `depends_on` block above.
+      MONGO_CONNECTION: mongodb://mongo:27017/nightscout
+
+      # API_SECRET - A secret passphrase that must be at least 12 characters long.
+      API_SECRET: change_me
+
+      ### Features
+      # ENABLE - Used to enable optional features, expects a space delimited list, such as: careportal rawbg iob
+      # See https://github.com/nightscout/cgm-remote-monitor#plugins for details
+      ENABLE: careportal rawbg iob
+
+      # AUTH_DEFAULT_ROLES (readable) - possible values readable, denied, or any valid role name.
+      # When readable, anyone can view Nightscout without a token. Setting it to denied will require
+      # a token from every visit, using status-only will enable api-secret based login.
+      AUTH_DEFAULT_ROLES: denied
+
+      # For all other settings, please refer to the Environment section of the README
+      # https://github.com/nightscout/cgm-remote-monitor#environment
+
+  traefik:
+    image: traefik:latest
+    container_name: 'traefik'
+    command:
+      - '--providers.docker=true'
+      - '--providers.docker.exposedbydefault=false'
+      - '--entrypoints.web.address=:80'
+      - '--entrypoints.web.http.redirections.entrypoint.to=websecure'
+      - '--entrypoints.websecure.address=:443'
+      - "--certificatesresolvers.le.acme.httpchallenge=true"
+      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
+      - '--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json'
+      # Change the below to match your email address
+      - '[email protected]'
+    ports:
+      - '443:443'
+      - '80:80'
+    volumes:
+      - './letsencrypt:/letsencrypt'
+      - '/var/run/docker.sock:/var/run/docker.sock:ro'

lib/api/activity/index.js

@@ -12,23 +12,14 @@ function configure(app, wares, ctx) {
         , api = express.Router();
 
     api.use(wares.compression());
-    api.use(wares.bodyParser({
-        limit: 1048576 * 50
-    }));
     // text body types get handled as raw buffer stream
-    api.use(wares.bodyParser.raw({
-        limit: 1048576
-    }));
+    api.use(wares.rawParser);
     // json body types get handled as parsed json
     api.use(wares.bodyParser.json({
-        limit: 1048576
-        , extended: true
+      limit: '50Mb'
     }));
     // also support url-encoded content-type
-    api.use(wares.bodyParser.urlencoded({
-        limit: 1048576
-        , extended: true
-    }));
+    api.use(wares.urlencodedParser);
     // invoke common middleware
     api.use(wares.sendJSONStatus);
 
@@ -94,9 +85,7 @@ function configure(app, wares, ctx) {
             });
         }
 
-        api.post('/activity/', wares.bodyParser({
-            limit: 1048576 * 50
-        }), ctx.authorization.isPermitted('api:activity:create'), post_response);
+        api.post('/activity/', ctx.authorization.isPermitted('api:activity:create'), post_response);
 
         api.delete('/activity/:_id', ctx.authorization.isPermitted('api:activity:delete'), function(req, res) {
             ctx.activity.remove(req.params._id, function() {

lib/api/alexa/index.js

@@ -11,12 +11,12 @@ function configure (app, wares, ctx, env) {
   // invoke common middleware
   api.use(wares.sendJSONStatus);
   // text body types get handled as raw buffer stream
-  api.use(wares.bodyParser.raw());
+  api.use(wares.rawParser);
   // json body types get handled as parsed json
-  api.use(wares.bodyParser.json({
-    limit: 1048576
-    , extended: true
-  }));
+  api.use(wares.jsonParser);
+  // also support url-encoded content-type
+  api.use(wares.urlencodedParser);
+  // text body types get handled as raw buffer stream
 
   ctx.virtAsstBase.setupVirtAsstHandlers(ctx.alexa);
 

lib/api/devicestatus/index.js

@@ -13,14 +13,12 @@ function configure (app, wares, ctx, env) {
   // invoke common middleware
   api.use(wares.sendJSONStatus);
   // text body types get handled as raw buffer stream
-  api.use(wares.bodyParser.raw());
+  api.use(wares.rawParser);
   // json body types get handled as parsed json
-  api.use(wares.bodyParser.json({
-    limit: 1048576
-    , extended: true
-  }));
+  api.use(wares.jsonParser);
   // also support url-encoded content-type
-  api.use(wares.bodyParser.urlencoded({ extended: true }));
+  api.use(wares.urlencodedParser);
+  // text body types get handled as raw buffer stream
 
   api.use(ctx.authorization.isPermitted('api:devicestatus:read'));
 

lib/api/entries/index.js

@@ -41,20 +41,18 @@ function configure (app, wares, ctx, env) {
   // invoke common middleware
   api.use(wares.sendJSONStatus);
   // text body types get handled as raw buffer stream
-  api.use(wares.bodyParser.raw());
+  api.use(wares.rawParser);
   // json body types get handled as parsed json
   api.use(wares.bodyParser.json({
-    limit: 1048576
-    , extended: true
+    limit: '50Mb'
   }));
+  // also support url-encoded content-type
+  api.use(wares.urlencodedParser);
+  // text body types get handled as raw buffer stream
   // shortcut to use extension to specify output content-type
   api.use(wares.extensions([
         'json', 'svg', 'csv', 'txt', 'png', 'html', 'tsv'
     ]));
-  // also support url-encoded content-type
-  api.use(wares.bodyParser.urlencoded({
-    extended: true
-  }));
 
   api.use(ctx.authorization.isPermitted('api:entries:read'));
   /**

lib/api/food/index.js

@@ -9,14 +9,13 @@ function configure (app, wares, ctx) {
     // invoke common middleware
     api.use(wares.sendJSONStatus);
     // text body types get handled as raw buffer stream
-    api.use(wares.bodyParser.raw( ));
+    api.use(wares.rawParser);
     // json body types get handled as parsed json
-    api.use(wares.bodyParser.json({
-      limit: 1048576
-      , extended: true
-    }));  
+    api.use(wares.jsonParser);
     // also support url-encoded content-type
-    api.use(wares.bodyParser.urlencoded({ extended: true }));
+    api.use(wares.urlencodedParser);
+    // text body types get handled as raw buffer stream
+    // shortcut to use extension to specify output content-type
 
     api.use(ctx.authorization.isPermitted('api:food:read'));
 

lib/api/googlehome/index.js

@@ -11,9 +11,10 @@ function configure (app, wares, ctx, env) {
   // invoke common middleware
   api.use(wares.sendJSONStatus);
   // text body types get handled as raw buffer stream
-  api.use(wares.bodyParser.raw());
+  api.use(wares.rawParser);
   // json body types get handled as parsed json
-  api.use(wares.bodyParser.json());
+  api.use(wares.jsonParser);
+
 
   ctx.virtAsstBase.setupVirtAsstHandlers(ctx.googleHome);
 

lib/api/index.js

@@ -6,7 +6,7 @@ function create (env, ctx) {
     ,  app = express( )
     ;
 
-  var wares = require('../middleware/')(env);
+  const wares = ctx.wares;
 
   // set up express app with our options
   app.set('name', env.name);

lib/api/notifications-v2.js

@@ -7,6 +7,13 @@ function configure (app, ctx) {
     , api = express.Router( )
     ;
 
+  api.use(ctx.wares.compression());
+  api.use(ctx.wares.rawParser);
+  api.use(ctx.wares.bodyParser.json({
+      limit: '50Mb'
+  }));
+  api.use(ctx.wares.urlencodedParser);
+
   api.post('/loop', ctx.authorization.isPermitted('notifications:loop:push'), function (req, res) {
     ctx.loop.sendNotification(req.body, req.connection.remoteAddress, function (error) {
       if (error) {

lib/api/profile/index.js

@@ -9,14 +9,12 @@ function configure (app, wares, ctx) {
     // invoke common middleware
     api.use(wares.sendJSONStatus);
     // text body types get handled as raw buffer stream
-    api.use(wares.bodyParser.raw( ));
+    api.use(wares.rawParser);
     // json body types get handled as parsed json
-    api.use(wares.bodyParser.json({
-        limit: 1048576
-        , extended: true
-    })); 
+    api.use(wares.jsonParser);
     // also support url-encoded content-type
-    api.use(wares.bodyParser.urlencoded({ extended: true }));
+    api.use(wares.urlencodedParser);
+    // text body types get handled as raw buffer stream
 
     api.use(ctx.authorization.isPermitted('api:profile:read'));
 

lib/api/status.js

@@ -2,6 +2,7 @@
 
 function configure (app, wares, env, ctx) {
   var express = require('express'),
+    forwarded = require('forwarded-for'),
     api = express.Router( )
     ;
 
@@ -21,7 +22,8 @@ function configure (app, wares, env, ctx) {
     var authToken = req.query.token || req.query.secret || '';
 
     function getRemoteIP (req) {
-      return req.headers['x-forwarded-for'] || req.connection.remoteAddress;
+      const address = forwarded(req, req.headers);
+      return address.ip;
     }
 
     var date = new Date();

lib/api/treatments/index.js

@@ -13,24 +13,16 @@ function configure (app, wares, ctx, env) {
     , api = express.Router();
 
   api.use(wares.compression());
-  api.use(wares.bodyParser({
-    limit: 1048576 * 50
-    , extended: true
-  }));
+
   // text body types get handled as raw buffer stream
-  api.use(wares.bodyParser.raw({
-    limit: 1048576
-  }));
+  api.use(wares.rawParser);
   // json body types get handled as parsed json
   api.use(wares.bodyParser.json({
-    limit: 1048576
-    , extended: true
+    limit: '50Mb'
   }));
   // also support url-encoded content-type
-  api.use(wares.bodyParser.urlencoded({
-    limit: 1048576
-    , extended: true
-  }));
+  api.use(wares.urlencodedParser);
+
   // invoke common middleware
   api.use(wares.sendJSONStatus);
 
@@ -150,9 +142,7 @@ function configure (app, wares, ctx, env) {
       });
     }
 
-    api.post('/treatments/', wares.bodyParser({
-      limit: 1048576 * 50
-    }), ctx.authorization.isPermitted('api:treatments:create'), post_response);
+    api.post('/treatments/', ctx.authorization.isPermitted('api:treatments:create'), post_response);
 
     /**
      * @function delete_records

lib/api3/security.js

@@ -4,11 +4,13 @@ const apiConst = require('./const.json')
   , _ = require('lodash')
   , shiroTrie = require('shiro-trie')
   , opTools = require('./shared/operationTools')
+  , forwarded = require('forwarded-for')
   ;
 
 
 function getRemoteIP (req) {
-  return req.headers['x-forwarded-for'] || req.connection.remoteAddress;
+  const address = forwarded(req, req.headers);
+  return address.ip;
 }
 
 

lib/api3/storageSocket.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const apiConst = require('./const');
+const forwarded = require('forwarded-for');
 
 /**
  * Socket.IO broadcaster of any storage change
@@ -28,7 +29,8 @@ function StorageSocket (app, env, ctx) {
     self.namespace = io.of(NAMESPACE);
     self.namespace.on('connection', function onConnected (socket) {
 
-      const remoteIP = socket.request.headers['x-forwarded-for'] || socket.request.connection.remoteAddress;
+      const address = forwarded(socket.request, socket.request.headers);
+      const remoteIP = address.ip;
       console.log(LOG + 'Connection from client ID: ', socket.client.id, ' IP: ', remoteIP);
 
       socket.on('disconnect', function onDisconnect () {
@@ -142,4 +144,4 @@ function StorageSocket (app, env, ctx) {
   }
 }
 
-module.exports = StorageSocket;
+module.exports = StorageSocket;