Add release process

.gitea/workflows/docker-publish.yml

@@ -3,9 +3,11 @@ name: Docker Build and Publish
 on:
   push:
     branches: [ main ]
-    tags: [ 'v*' ]
+    tags: [ 'v*.*.*' ]
   pull_request:
     branches: [ main ]
+  release:
+    types: [published]
 
 jobs:
   build:
@@ -20,11 +22,11 @@ jobs:
         with:
           images: git.dws.rip/${{ github.repository }}
           tags: |
-            type=ref,event=branch
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=sha,format=long
             type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=sha
 
       - name: Login to Gitea Container Registry
         uses: docker/login-action@v2

README.md

@@ -114,4 +114,12 @@ spectra/
 
 - `FLASK_ENV`: Set to 'production' in production
 - `WORKERS`: Number of Gunicorn workers (default: 4)
-- `PORT`: Override default port (default: 5000)
+- `PORT`: Override default port (default: 5000)
+
+## Release Process
+
+To create a release:
+- Create and push a tag: `git tag v1.0.0 && git push origin v1.0.0`
+- Create a release in Gitea UI using that tag
+- The workflow will build and push the Docker image with appropriate version tags
+- The Docker image will be available at: `git.dws.rip/your-repo/image:v1.0.0`

app.py

@@ -11,7 +11,6 @@ from datetime import datetime
 from pathlib import Path
 from logging import getLogger
 import logging
-from logging import getLogger
 from logging.config import dictConfig
 
 import toml
@@ -31,13 +30,31 @@ from models import Session as DBSession
 from models import SiteConfig, init_db
 from steganography import embed_message, extract_message
 
+# Add this function to handle secret key persistence
+def get_or_create_secret_key():
+    """Get existing secret key or create a new one"""
+    secret_key_file = Path("secret.key")
+    try:
+        if secret_key_file.exists():
+            logger.info("Loading existing secret key")
+            return secret_key_file.read_bytes()
+        else:
+            logger.info("Generating new secret key")
+            secret_key = os.urandom(32)  # Use 32 bytes for better security
+            secret_key_file.write_bytes(secret_key)
+            return secret_key
+    except Exception as e:
+        logger.error(f"Error handling secret key: {e}")
+        # Fallback to a memory-only key if file operations fail
+        return os.urandom(32)
+
 DEFAULT_CONFIG = {
     "server": {"host": "0.0.0.0", "port": 5000},
     "directories": {"upload": "uploads", "thumbnail": "thumbnails"},
     "admin": {"password": secrets.token_urlsafe(16)},  # Generate secure random password
 }
 
-# Add this logging configuration before creating the Flask app
+# Configure logging
 dictConfig({
     'version': 1,
     'formatters': {
@@ -66,8 +83,9 @@ dictConfig({
 # Get logger for this module
 logger = getLogger(__name__)
 
+# Create Flask app with persistent secret key
 app = Flask(__name__)
-app.secret_key = os.urandom(24)
+app.secret_key = get_or_create_secret_key()
 
 def allowed_file(filename):
     return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
@@ -211,9 +229,6 @@ limiter = Limiter(
     storage_uri="memory://",
 )
 
-# Generate a strong secret key at startup
-app.secret_key = secrets.token_hex(32)
-
 @app.before_request
 def before_request():
     g.csp_nonce = secrets.token_hex(16)
@@ -274,7 +289,7 @@ def get_images():
     images = []
     for photo in photos:
         factor = random.randint(2, 3)
-        if photo.height < 4000 or photo.width < 4000:
+        if photo.height < 4000 and photo.width < 4000:
             factor = 1
         if photo.orientation == 6 or photo.orientation == 8:
             width, height = photo.height, photo.width