update Spliit expense sharing app v1.19.1

Apps/Spliit/docker-compose.yml

@@ -1,45 +1,10 @@
 name: spliit
 services:
-  nginxhashlock:
-    image: ghcr.io/yundera/nginx-hash-lock:latest
-    container_name: spliit-nginxhashlock
-    restart: unless-stopped
-    user: "root"
-    environment:
-      AUTH_HASH: $AUTH_HASH
-      BACKEND_HOST: "spliit"
-      BACKEND_PORT: "3000"
-      LISTEN_PORT: "80"
-    expose:
-      - 80
-    labels:
-      caddy_0: spliit-${APP_DOMAIN}
-      caddy_0.import: gateway_tls
-      caddy_0.reverse_proxy: "{{upstreams 80}}"
-      caddy_1: spliit-${APP_PUBLIC_IP_DASH}.nip.io
-      caddy_1.import: gateway_tls
-      caddy_1.reverse_proxy: "{{upstreams 80}}"
-      caddy_2: spliit-${APP_PUBLIC_IP_DASH}.sslip.io
-      caddy_2.reverse_proxy: "{{upstreams 80}}"
-    depends_on:
-      - spliit
-      - db
-    deploy:
-      resources:
-        limits:
-          memory: 128M
-    cpu_shares: 80
-    networks:
-      - pcs
-    privileged: true
-    cap_add:
-      - SYS_ADMIN
-      - NET_ADMIN
-
   db:
-    image: postgres:16-alpine
+    image: postgres:16.13-alpine
     container_name: spliit-db
-    user: 0:0
+    user: "0:0"
+    cpu_shares: 50
     environment:
       POSTGRES_DB: spliit
       POSTGRES_USER: postgres
@@ -59,15 +24,28 @@ services:
     image: ghcr.io/spliit-app/spliit:1.19.0
     container_name: spliit
     restart: unless-stopped
+    user: "0:0"
+    cpu_shares: 50
+    expose:
+      - 80
+    labels:
+      caddy_0: spliit-${APP_DOMAIN}
+      caddy_0.import: gateway_tls
+      caddy_0.reverse_proxy: "{{upstreams 80}}"
+      caddy_1: spliit-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1.import: gateway_tls
+      caddy_1.reverse_proxy: "{{upstreams 80}}"
+      caddy_2: spliit-${APP_PUBLIC_IP_DASH}.sslip.io
+      caddy_2.reverse_proxy: "{{upstreams 80}}"
     environment:
+      PORT: "80"
       TZ: $TZ
       POSTGRES_PRISMA_URL: postgresql://postgres:$APP_DEFAULT_PASSWORD@db:5432/spliit
       POSTGRES_URL_NON_POOLING: postgresql://postgres:$APP_DEFAULT_PASSWORD@db:5432/spliit
+    depends_on:
+      - db
     networks:
       - pcs
-    cap_add:
-      - SYS_ADMIN
-      - NET_ADMIN
     deploy:
       resources:
         limits:
@@ -82,7 +60,7 @@ x-casaos:
   architectures:
     - amd64
     - arm64
-  main: nginxhashlock
+  main: spliit
   webui_port: 80
   author: Yundera Team
   category: Finance
@@ -93,8 +71,8 @@ x-casaos:
     - https://cdn.jsdelivr.net/gh/Yundera/AppStore@main/Apps/Spliit/screenshot-2.png
     - https://cdn.jsdelivr.net/gh/Yundera/AppStore@main/Apps/Spliit/screenshot-3.png
   thumbnail: https://cdn.jsdelivr.net/gh/Yundera/AppStore@main/Apps/Spliit/thumbnail.png
-  index: /?hash=$AUTH_HASH  
-  store_app_id: Spliit
+  index: /
+  store_app_id: spliit
   title:
     en_us: Spliit
   tagline:
@@ -106,15 +84,15 @@ x-casaos:
   description:
     en_us: |
       Split expenses with friends - no signup, no hassle. Spliit is the simplest way to share expenses. Whether splitting dinner bills, vacation costs, or household expenses, everyone can see who owes what instantly. No accounts needed - just create a group and share the link.
-      
+
       **Key features:**
       • Create expense groups in seconds
       • Add participants by name only
       • Split by percentage, shares, or exact amounts
       • See optimized settlements (who pays whom)
       • Works on any device
       • Complete privacy - data stays on your server
-      
+
       **Perfect for:** Roommates splitting rent, friends sharing vacation costs, couples managing household expenses, group dinners, or any shared activity.
     ko_kr: |
       친구와 비용 분할 - 가입 없이, 번거로움 없이. Spliit은 비용을 공유하는 가장 간단한 방법입니다. 저녁 식사비, 휴가 비용, 가계 지출 등 누가 얼마를 빚졌는지 즉시 확인할 수 있습니다.
@@ -134,7 +112,7 @@ x-casaos:
         3. Add people (just their names)
         4. Start adding expenses
         5. Check "Balances" to see who owes whom
-        -----------------------------        
+        -----------------------------
         Share the group link with friends - no signup needed!
       ko_kr: |
         -----------------------------
@@ -171,4 +149,4 @@ x-casaos:
         3. Ajoutez des personnes (juste les noms)
         4. Commencez à ajouter des dépenses
         5. Vérifiez "Soldes" pour voir qui doit à qui
-        -----------------------------
+        -----------------------------

Apps/Spliit/rationale.md

@@ -0,0 +1,26 @@
+# Spliit — Rationale
+
+## What deviation / exception is being requested
+1. Both services run as `user: 0:0` (root).
+2. Authentication is disabled — the app is publicly accessible without login.
+
+## Why it is necessary
+- **spliit**: The Node.js application runs Prisma database migrations on startup, which requires write access to the working directory. Running as non-root causes migration failures.
+- **db (PostgreSQL)**: Requires root for database initialization and file ownership in `/var/lib/postgresql/data`. Standard practice for PostgreSQL containers.
+- **No authentication**: Spliit is a collaborative expense-sharing app. Users create groups and share links with friends/family who need direct access without any account. Adding an authentication gate would break the core functionality — external participants would be unable to view or add expenses.
+
+## Security mitigations in place
+- All volumes map exclusively to `/DATA/AppData/$AppID/` — no access to user directories
+- No privileged mode on any service
+- Memory limits on all services (512M db, 1G app)
+- Database credentials use `$APP_DEFAULT_PASSWORD` (not hardcoded)
+- No sensitive data exposed — the app only handles expense group data
+- Each group has a unique random URL that acts as a capability-based access control
+
+## Alternatives considered and rejected
+- `user: $PUID:$PGID` — Prisma migrations fail without root; PostgreSQL init requires root for data directory ownership
+- AppShield / nginx-hash-lock authentication — blocks external participants from accessing shared expense groups, breaking the app's core use case
+
+## Data protection
+- PostgreSQL data persists in `/DATA/AppData/$AppID/pgdata/`
+- Data survives uninstall/reinstall