Force host validation

.babelrc

@@ -1,3 +0,0 @@
-{
-  "presets": ["next/babel"]
-}

.github/workflows/docker-publish.yml

@@ -145,7 +145,7 @@ jobs:
             REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
           # https://github.com/docker/setup-qemu-action#about
           # platforms: linux/amd64,linux/arm64,linux/riscv64,linux/ppc64le,linux/s390x,linux/386,linux/mips64le,linux/mips64,linux/arm/v7,linux/arm/v6
-          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6
+          platforms: linux/amd64,linux/arm64
           cache-from: type=local,src=/tmp/.buildx-cache
           cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
 

Dockerfile

@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:latest
 
 # Install dependencies only when needed
-FROM docker.io/node:18-alpine AS deps
+FROM docker.io/node:22-alpine AS deps
 
 WORKDIR /app
 
@@ -17,7 +17,7 @@ RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store pnpm f
 RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store pnpm install -r --offline
 
 # Rebuild the source code only when needed
-FROM docker.io/node:18-alpine AS builder
+FROM docker.io/node:22-alpine AS builder
 WORKDIR /app
 
 ARG BUILDTIME
@@ -33,7 +33,7 @@ RUN npm run telemetry \
  && NEXT_PUBLIC_BUILDTIME=$BUILDTIME NEXT_PUBLIC_VERSION=$VERSION NEXT_PUBLIC_REVISION=$REVISION npm run build
 
 # Production image, copy all the files and run next
-FROM docker.io/node:18-alpine AS runner
+FROM docker.io/node:22-alpine AS runner
 LABEL org.opencontainers.image.title "Homepage"
 LABEL org.opencontainers.image.description "A self-hosted services landing page, with docker and service integrations."
 LABEL org.opencontainers.image.url="https://github.com/gethomepage/homepage"
@@ -41,7 +41,7 @@ LABEL org.opencontainers.image.documentation='https://github.com/gethomepage/hom
 LABEL org.opencontainers.image.source='https://github.com/gethomepage/homepage'
 LABEL org.opencontainers.image.licenses='Apache-2.0'
 
-ENV NODE_ENV production
+ENV NODE_ENV=production
 
 WORKDIR /app
 
@@ -56,7 +56,8 @@ COPY --link --chmod=755 docker-entrypoint.sh /usr/local/bin/
 
 RUN apk add --no-cache su-exec
 
-ENV PORT 3000
+ENV HOSTNAME=::
+ENV PORT=3000
 EXPOSE $PORT
 
 HEALTHCHECK --interval=10s --timeout=3s --start-period=20s \

README.md

@@ -38,7 +38,7 @@ With features like quick search, bookmarks, weather support, a wide range of int
 
 - **Fast** - The site is statically generated at build time for instant load times.
 - **Secure** - All API requests to backend services are proxied, keeping your API keys hidden. Constantly reviewed for security by the community.
-- **For Everyone** - Images built for AMD64, ARM64, ARMv7, and ARMv6.
+- **For Everyone** - Images built for AMD64, ARM64.
 - **Full i18n** - Support for over 40 languages.
 - **Service & Web Bookmarks** - Add custom links to the homepage.
 - **Docker Integration** - Container status and stats. Automatic service discovery via labels.

package.json

@@ -10,7 +10,7 @@
     "telemetry": "next telemetry disable"
   },
   "dependencies": {
-    "@headlessui/react": "^1.7.18",
+    "@headlessui/react": "^1.7.19",
     "@kubernetes/client-node": "^0.17.1",
     "cal-parser": "^1.0.2",
     "classnames": "^2.5.1",
@@ -24,22 +24,22 @@
     "luxon": "^3.5.0",
     "memory-cache": "^0.2.0",
     "minecraft-ping-js": "^1.0.2",
-    "next": "^12.3.4",
+    "next": "^15.0.3",
     "next-i18next": "^12.1.0",
     "ping": "^0.4.4",
     "pretty-bytes": "^6.1.1",
     "raw-body": "^3.0.0",
     "react": "^18.3.1",
-    "react-dom": "^18.2.0",
+    "react-dom": "^18.3.1",
     "react-i18next": "^11.18.6",
     "react-icons": "^5.4.0",
-    "recharts": "^2.12.6",
+    "recharts": "^2.12.7",
     "rrule": "^2.8.1",
     "swr": "^1.3.0",
     "systeminformation": "^5.24.3",
-    "tough-cookie": "^4.1.3",
-    "urbackup-server-api": "^0.52.1",
-    "winston": "^3.11.0",
+    "tough-cookie": "^4.1.4",
+    "urbackup-server-api": "^0.8.9",
+    "winston": "^3.13.0",
     "xml-js": "^1.6.11"
   },
   "devDependencies": {
@@ -47,15 +47,15 @@
     "autoprefixer": "^10.4.20",
     "eslint": "^8.57.1",
     "eslint-config-airbnb": "^19.0.4",
-    "eslint-config-next": "^14.2.3",
+    "eslint-config-next": "^14.2.4",
     "eslint-config-prettier": "^9.1.0",
     "eslint-plugin-import": "^2.31.0",
-    "eslint-plugin-jsx-a11y": "^6.8.0",
+    "eslint-plugin-jsx-a11y": "^6.9.0",
     "eslint-plugin-prettier": "^5.2.1",
     "eslint-plugin-react": "^7.37.3",
     "eslint-plugin-react-hooks": "^4.6.2",
-    "postcss": "^8.4.47",
-    "prettier": "^3.2.5",
+    "postcss": "^8.4.48",
+    "prettier": "^3.3.2",
     "tailwind-scrollbar": "^3.0.5",
     "tailwindcss": "^3.4.17",
     "typescript": "^5.6.3"

src/components/resolvedicon.jsx

@@ -1,5 +1,5 @@
 import { useContext } from "react";
-import Image from "next/future/image";
+import Image from "next/image";
 
 import { SettingsContext } from "utils/contexts/settings";
 import { ThemeContext } from "utils/contexts/theme";

src/components/version.jsx

@@ -1,6 +1,6 @@
 import { useTranslation } from "next-i18next";
 import useSWR from "swr";
-import { compareVersions } from "compare-versions";
+import { compareVersions, validate } from "compare-versions";
 import { MdNewReleases } from "react-icons/md";
 
 export default function Version() {
@@ -44,7 +44,7 @@ export default function Version() {
           </a>
         )}
       </span>
-      {version === "main" || version === "dev" || version === "nightly"
+      {!validate(version)
         ? null
         : releaseData &&
           latestRelease &&

src/middleware.js

@@ -0,0 +1,22 @@
+import { NextResponse } from "next/server";
+
+export function middleware(req) {
+  // Check the Host header, if HOMEPAGE_ALLOWED_HOSTS is set
+  const host = req.headers.get("host");
+  let allowedHosts = ["localhost:3000"];
+  if (process.env.HOMEPAGE_ALLOWED_HOSTS) {
+    allowedHosts = allowedHosts.concat(process.env.HOMEPAGE_ALLOWED_HOSTS.split(","));
+  }
+  if (!host || !allowedHosts.includes(host)) {
+    // eslint-disable-next-line no-console
+    console.error(
+      `Host validation failed for: ${host}. Hint: Set HOMEPAGE_ALLOWED_HOSTS to allow requests from this host.`,
+    );
+    return NextResponse.json({ error: "Host validation failed. See logs for more details." }, { status: 400 });
+  }
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: "/api/:path*",
+};

src/pages/index.jsx

@@ -86,6 +86,7 @@ function Index({ initialSettings, fallback }) {
   const windowFocused = useWindowFocus();
   const [stale, setStale] = useState(false);
   const { data: errorsData } = useSWR("/api/validate");
+  const { error: validateError } = errorsData || {};
   const { data: hashData, mutate: mutateHash } = useSWR("/api/hash");
 
   useEffect(() => {
@@ -117,6 +118,24 @@ function Index({ initialSettings, fallback }) {
     }
   }, [hashData]);
 
+  if (validateError) {
+    return (
+      <div className="w-full h-screen container m-auto justify-center p-10 pointer-events-none">
+        <div className="flex flex-col">
+          <div className="basis-1/2 bg-theme-500 dark:bg-theme-600 text-theme-600 dark:text-theme-300 m-2 rounded-md font-mono shadow-md border-4 border-transparent">
+            <div className="bg-rose-200 text-rose-800 dark:text-rose-200 dark:bg-rose-800 p-2 rounded-md font-bold">
+              <BiError className="float-right w-6 h-6" />
+              Error
+            </div>
+            <div className="p-2 text-theme-100 dark:text-theme-200">
+              <pre className="opacity-50 font-bold pb-2">{validateError}</pre>
+            </div>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
   if (stale) {
     return (
       <div className="flex items-center justify-center h-screen">