From e3dbd3e6093f44f736e29ae9ff33cfeba0bb061e Mon Sep 17 00:00:00 2001 From: Donkie Date: Fri, 31 Jul 2026 09:19:42 +0200 Subject: [PATCH] Move the security notes out of the README and into the Wiki's remit The README carries no config reference at all -- env vars and deployment guidance live in the Wiki -- so documenting SPOOLMAN_CORS_ORIGIN and the reverse-proxy host requirement here gave them two homes to drift apart in. --- README.md | 33 --------------------------------- 1 file changed, 33 deletions(-) diff --git a/README.md b/README.md index 2fb6d264..1404a335 100644 --- a/README.md +++ b/README.md @@ -49,39 +49,6 @@ Spoolman is a self-hosted web service designed to help you efficiently manage yo -## Security - -**Spoolman has no authentication.** This is by design — it is built to sit on a trusted home -network alongside your printers, where requiring a login for every Moonraker or OctoPrint call -would only get in the way. It does mean that anyone who can reach Spoolman over the network can -read and modify your entire inventory. - -If your instance is reachable from beyond your own LAN, put it behind a reverse proxy that -handles authentication (Authelia, Authentik, or your proxy's own basic auth). Do not forward a -port to it directly. - -Spoolman does defend the one boundary a browser can be tricked into crossing on your behalf: a -website you visit cannot make your browser write to your Spoolman instance, or open a websocket -to it, unless it is an origin you have allowed. That protection is not a substitute for the -above — it does nothing about anyone already on your network. - -### `SPOOLMAN_CORS_ORIGIN` - -A comma-separated list of extra browser origins allowed to talk to Spoolman, for example -`https://fluidd.local,https://mainsail.local`. Leave it unset unless you have a browser-based -client on a *different* origin; the built-in web client does not need it, and neither does -Moonraker, OctoPrint, Home Assistant or anything else that is not a browser. - -> [!WARNING] -> Setting it to `*` turns the origin checks off entirely, which means any website you happen to -> visit can read and modify your Spoolman data in the background. Only do this on a network you -> trust completely, and list the origins you actually need instead wherever you can. Debug mode -> (`SPOOLMAN_DEBUG_MODE`) has the same effect and is not meant for normal use. - -If you run Spoolman behind a reverse proxy, forward the original host — nginx -`proxy_set_header Host $host;`, Apache `ProxyPreserveHost On`, or the `X-Forwarded-Host` header, -any of which is enough. Traefik, Caddy and HAProxy do this by default. - ## Installation Please see the [Installation page on the Wiki](https://github.com/Donkie/Spoolman/wiki/Installation) for details how to install Spoolman.