[trahloff]

Aldine (https://aldine.dev, source at https://github.com/trahloff/Aldine) is an open-source collaborative LaTeX editor, an alternative to Overleaf. Several people edit at once, every project is a git repository with branches, and it syncs with GitHub, GitLab, Gitea and Forgejo. AGPL-3.0. I maintain it; the images are on ghcr.io for amd64 and arm64.

The app has two services:

• app: the web UI and API, published on 8480.
• compiler: TeX Live and latexmk. It runs untrusted LaTeX, so it sits on an internal: true network with no route to the internet, with cap_drop: ALL, no-new-privileges, mem_limit: 2g and pids_limit: 256.

Notes for review:

• Data lives in bind mounts under /DATA/AppData/$AppID/: data is shared by both services, secrets (accounts, sessions, keys) is mounted only into app.
• The compiler declares the secret variables the app reads (API keys, OAuth client secrets, tokens, the SMTP password, the Sentry DSN) as empty strings. That stops the global variables CasaOS injects from reaching the container that runs untrusted LaTeX.
• The image tags are literal. I'll open a PR that bumps the tags and version with each release.
• There is no login by default. AUTH_ENABLED=1 turns on accounts; the install tip says so.

How it was tested (on 0.14.4; 0.15.1 changes only the image tags and version in this file):

• docker compose -f Apps/Aldine/docker-compose.yml config -q passes, with and without AppID set.
• Started with Docker Compose 2.35 and AppID=aldine. /api/health answers. A project with a biblatex bibliography typesets to a two-page PDF with the citation resolved, and the second typeset uses the cached preamble.
• From inside aldine-compiler, example.com does not resolve, while the app reaches it. docker exec aldine-compiler env lists the secret variables with empty values.
• The compiler container has CapDrop [ALL], PidsLimit 256, a 2 GiB memory limit and no-new-privileges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud