History

mwiegand 908bca3687 fix(l4d2-web): ScriptBuilder — chmod script tmpfile to 0644 for sandbox read NamedTemporaryFile creates the script file at mode 0600 owned by the left4me web user. The sandbox runs as l4d2-sandbox and bwrap bind-mounts the file read-only at /script.sh, but the kernel still enforces the underlying file's permissions — l4d2-sandbox can't read 0600 left4me files, so /bin/bash /script.sh fails with "Permission denied". Script content is not a secret (it's stored in the DB and editable by the user), so 0644 is appropriate. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-08 16:18:00 +02:00
..
alembic	feat(l4d2-web): script overlay schema — add overlay.script + last_build_status, drop globals tables	2026-05-08 15:33:04 +02:00
routes	feat(l4d2-web): script overlay routes (script update / wipe / build)	2026-05-08 15:48:15 +02:00
services	fix(l4d2-web): ScriptBuilder — chmod script tmpfile to 0644 for sandbox read	2026-05-08 16:18:00 +02:00
static	feat(web): blueprint-prefilled create-server flow + empty-state CTA	2026-05-07 01:47:33 +02:00
templates	feat(l4d2-web): script overlay UI	2026-05-08 15:50:36 +02:00
tests	feat(l4d2-web): script overlay UI	2026-05-08 15:50:36 +02:00
__init__.py	chore(l4d2): flatten component layout	2026-05-05 23:47:06 +02:00
alembic.ini	chore(l4d2): flatten component layout	2026-05-05 23:47:06 +02:00
app.py	feat(l4d2-web): workshop overlay UI (routes + templates)	2026-05-07 16:50:54 +02:00
auth.py	fix(l4d2-web): reject encoded unsafe redirects	2026-05-06 13:24:04 +02:00
cli.py	refactor(l4d2-web): drop global-overlays subsystem in favor of script type	2026-05-08 15:43:41 +02:00
config.py	feat(web): forms in modals, edit/delete on detail pages, port auto-assign	2026-05-07 01:30:33 +02:00
db.py	feat(deploy): add production-like test deployment	2026-05-06 19:30:10 +02:00
models.py	feat(l4d2-web): script overlay schema — add overlay.script + last_build_status, drop globals tables	2026-05-08 15:33:04 +02:00
pyproject.toml	refactor(l4d2-web): drop global-overlays subsystem in favor of script type	2026-05-08 15:43:41 +02:00
README.md	feat(deploy): add production-like test deployment	2026-05-06 19:30:10 +02:00

README.md

l4d2-web-app

Flask web app for managing L4D2 servers through user-private blueprints.

Key v1 behaviors

Local username/password login; no public signup
Admin-managed overlay catalog
Private blueprints per user
Server creation from blueprints (live-linked; no per-server blueprint overrides)
Async job model with persisted command logs in job_logs
Desired vs actual state model
Live logs for jobs and servers via SSE endpoints
Host operations go through l4d2ctl via a local host command runner, not direct l4d2host imports

Frontend constraints

Server-rendered templates (Jinja)
Vendored HTMX (static/vendor/htmx.min.js)
Custom CSS only
Tokenized, consistent link and accent colors

Development

python3 -m venv .venv
.venv/bin/pip install -e .
.venv/bin/pytest tests -q

Configuration

The web app reads these settings from the environment:

DATABASE_URL: SQLAlchemy database URL, for example sqlite:////var/lib/left4me/left4me.db.
SECRET_KEY: Flask secret key used for sessions and CSRF-sensitive state.
JOB_WORKER_THREADS: number of background job worker threads.

In the systemd deployment, environment is loaded from /etc/left4me/host.env and /etc/left4me/web.env.

Admin Bootstrap

Create the first admin account with the Flask CLI. Provide the password through LEFT4ME_ADMIN_PASSWORD:

LEFT4ME_ADMIN_PASSWORD='change-me' flask create-user <username> --admin