Harden Docker production build

.dockerignore

@@ -0,0 +1,5 @@
+node_modules
+cache
+*.log
+.DS_Store
+.git

.gitea/workflows/release.yml

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - 'main'
+    tags:
+      - 'v*.*.*'
+
+jobs:
+  release:
+    uses: Wavyzz/ci-workflows/.github/workflows/docker-build-publish.yml@v1
+    with:
+      registry_host: ${{ secrets.REGISTRY_HOST }}
+      images: |
+        [
+          {
+            "name": "cf-bypass-fast",
+            "cache_ref": "cf-bypass-fast:buildcache",
+            "dockerfile": "./Dockerfile",
+            "context": "./"
+          }
+        ]
+    secrets:
+      registry_user: ${{ secrets.REGISTRY_USER }}
+      registry_password: ${{ secrets.REGISTRY_PASSWORD }}
+      ci_token: ${{ secrets.CI_GITEA_TOKEN }}
+

.gitignore

@@ -0,0 +1,10 @@
+node_modules/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+.DS_Store
+.env
+.env.*
+!.env.example

Dockerfile

@@ -1,29 +1,43 @@
-FROM node:20-slim
+FROM node:20.12.2-slim
+
+ENV NODE_ENV=production
 
 # Install Chrome and dependencies
-RUN apt update && apt install -y \
-    wget gnupg ca-certificates xvfb \
-    fonts-liberation libappindicator3-1 libasound2 libatk-bridge2.0-0 \
-    libatk1.0-0 libxss1 libnss3 libxcomposite1 libxdamage1 libxrandr2 libgbm1 \
-    && wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb \
-    && apt install -y ./google-chrome-stable_current_amd64.deb \
-    && rm google-chrome-stable_current_amd64.deb
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates wget gnupg xvfb fonts-liberation \
+    && wget -qO- https://dl.google.com/linux/linux_signing_key.pub \
+    | gpg --dearmor -o /usr/share/keyrings/google-linux-signing-keyring.gpg \
+    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-linux-signing-keyring.gpg] https://dl.google.com/linux/chrome/deb/ stable main" \
+    > /etc/apt/sources.list.d/google-chrome.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends google-chrome-stable \
+    && apt-get purge -y --auto-remove wget gnupg \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN corepack enable
+
+# Create a non-root user for running the app
+RUN useradd --create-home --home-dir /app --shell /bin/sh appuser
 
 # Set working directory
 WORKDIR /app
 
+# Entrypoint script
+COPY docker-entrypoint.sh /usr/local/bin/
+RUN chmod 755 /usr/local/bin/docker-entrypoint.sh
+
 # Copy and install dependencies
-COPY package*.json ./
-RUN npm install
+COPY --chown=appuser:appuser package.json pnpm-lock.yaml ./
+USER appuser
+RUN corepack prepare pnpm@9.0.0 --activate \
+    && pnpm install --frozen-lockfile --prod \
+    && pnpm store prune
 
 # Copy app code
-COPY . .
+COPY --chown=appuser:appuser . .
 
 # Expose port (match your app's port)
 EXPOSE 10000
 
 # Start Xvfb and run the bot
-CMD rm -f /tmp/.X99-lock && \
-    Xvfb :99 -screen 0 1024x768x24 & \
-    export DISPLAY=:99 && \
-    npm start
+CMD ["/usr/local/bin/docker-entrypoint.sh"]

README.md

@@ -75,12 +75,14 @@ Bypass Cloudflare protection and get cookies/tokens.
 {
   "mode": "iuam",
   "domain": "https://olamovies.watch/generate",
+  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
 }
 ```
 
 #### Parameters
 - **`mode`** (required): `"iuam"` or `"turnstile"`
 - **`domain`** (required): Target website URL
+- **`user_agent`** (optional): User-Agent to use for the browser session
 - **`proxy`** (optional): Proxy configuration object
 
 #### Response (Success)

docker-entrypoint.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+
+rm -f /tmp/.X99-lock
+Xvfb :99 -screen 0 1024x768x24 &
+xvfb_pid=$!
+
+export DISPLAY=:99
+
+npm start &
+app_pid=$!
+
+term_handler() {
+  kill "$app_pid" 2>/dev/null || true
+  kill "$xvfb_pid" 2>/dev/null || true
+}
+
+trap term_handler INT TERM
+
+while kill -0 "$app_pid" 2>/dev/null; do
+  if ! kill -0 "$xvfb_pid" 2>/dev/null; then
+    echo "Xvfb exited; stopping app." >&2
+    kill "$app_pid" 2>/dev/null || true
+    wait "$app_pid" 2>/dev/null || true
+    exit 1
+  fi
+  sleep 1
+done
+
+wait "$app_pid"
+app_status=$?
+kill "$xvfb_pid" 2>/dev/null || true
+wait "$xvfb_pid" 2>/dev/null || true
+exit "$app_status"

index.js

@@ -97,6 +97,9 @@ app.post('/cloudflare', async (req, res) => {
   if (!data || typeof data.mode !== 'string') {
     return res.status(400).json({ message: 'Bad Request: missing or invalid mode' })
   }
+  if (data.user_agent && typeof data.user_agent !== 'string') {
+    return res.status(400).json({ message: 'Bad Request: invalid user_agent' })
+  }
   if (authToken && data.authToken !== authToken) {
     return res.status(401).json({ message: 'Unauthorized' })
   }
@@ -126,6 +129,9 @@ app.post('/cloudflare', async (req, res) => {
     page = ctx.page
 
     await page.goto('about:blank')
+    if (data.user_agent) {
+      await page.setUserAgent(data.user_agent)
+    }
 
     switch (data.mode) {
       case "turnstile":
@@ -167,4 +173,4 @@ app.use((req, res) => {
 
 if (process.env.NODE_ENV === 'development') {
   module.exports = app
-}
+}