serve user-defined assets

cmd/web-form/main.go

@@ -61,6 +61,7 @@ type Config struct {
 		Buffer int `long:"buffer" env:"BUFFER" description:"Buffer size before processing" default:"100"`
 	} `group:"Webhooks general configuration" namespace:"webhooks" env-namespace:"WEBHOOKS"`
 	HTTP struct {
+		Assets       string        `long:"assets" env:"ASSETS" description:"Directory for assets (static) files"`
 		Bind         string        `long:"bind" env:"BIND" description:"Binding address" default:":8080"`
 		DisableXSRF  bool          `long:"disable-xsrf" env:"DISABLE_XSRF" description:"Disable XSRF validation. Useful for API"`
 		TLS          bool          `long:"tls" env:"TLS" description:"Enable TLS"`
@@ -141,8 +142,12 @@ func run(ctx context.Context, config Config) error {
 		slog.Info("no authorization used")
 	}
 
-	// static dir is unprotected
+	// static dir and user-defined asset dir are unprotected
 	router.Mount("/static/", http.FileServer(http.FS(assets.Static)))
+	if config.HTTP.Assets != "" {
+		slog.Info("user-defined assets enabled", "assets-dir", config.HTTP.Assets)
+		router.Mount("/assets/", http.StripPrefix("/assets", http.FileServer(http.Dir(config.HTTP.Assets))))
+	}
 
 	// scan forms from file system
 	forms, err := schema.FormsFromFS(os.DirFS(config.Configs))

docker/Dockerfile

@@ -10,13 +10,16 @@ VOLUME /data
 VOLUME /migrations
 # for form definitions, can be RO
 VOLUME /configs
+# for user-defined static files avaiable via /assets/
+VOLUME /assets
 # pre-populate env
 ENV FILES_PATH="/data" \
     CONFIGS="/configs" \
     DB_MIGRATIONS="/migrations" \
     DB_MIGRATE="true" \
     STORAGE="files" \
-    HTTP_BIND="0.0.0.0:8080"
+    HTTP_BIND="0.0.0.0:8080" \
+    HTTP_ASSETS="/assets"
 
 ENTRYPOINT ["/usr/bin/web-form"]
 COPY --from=build /usr/share/zoneinfo /usr/share/zoneinfo

docs/configuration.md

@@ -43,6 +43,7 @@ HTTP server configuration:
 --http.cert=                    Public TLS certificate (default: server.crt) [$HTTP_CERT]
 --http.read-timeout=            Read timeout to prevent slow client attack (default: 5s) [$HTTP_READ_TIMEOUT]
 --http.write-timeout=           Write timeout to prevent slow consuming clients attack (default: 5s) [$HTTP_WRITE_TIMEOUT]
+--http.assets=                  Directory for assets (static) files [$HTTP_ASSETS]
 
 OIDC configuration:
 --oidc.enable                   Enable OIDC protection [$OIDC_ENABLE]
@@ -54,10 +55,8 @@ OIDC configuration:
 --oidc.redis-max-connections=   Redis maximum number of active connections (default: 10) [$OIDC_REDIS_MAX_CONNECTIONS]
 ```
 
-
 - By-default, by the root path `/` listing of all forms available. It can be disabled by `DISABLE_LISTING=true`
 
-
 ## HTTP and TLS
 
 Service supports HTTPS but doesn't support dynamic reload. If you are using short-lived certificates such as Let's
@@ -71,6 +70,28 @@ HTTP_KEY=/path/to/key.pem
 HTTP_CERT=/path/to/cert.pem
 ```
 
+### Assets
+
+since 0.2.0
+
+WebForms can handle user-defined static files (assets) via `/assets/` path if `--http.assets` flag is defined.
+By-default, it's disabled in CLI mode and enabled in [docker](docker.md) mode.
+
+It could be useful for embedding images or other things in templates. For example:
+
+
+```yaml
+---
+table: shop
+title: Order Pizza
+description: |
+  Welcome to our pizzeria!
+
+  ![](/assets/logo.png)
+  
+# other configuration
+```
+
 ### Security
 
 The service has incorporated built-in protection

docs/docker.md

@@ -5,6 +5,7 @@ By default, in docker mode:
 - database migrations are enabled and expected in `/migrations` dir
 - storage type is `files` and storage path is `/data`
 - configurations should be mounted to `/configs`
+- [assets](configuration.md#assets) files served from `/assets` dir (since 0.2.0)
 
 If storage is `database` and migration directory (`DB_MIGRATIONS`, default is `/migrations`) contains at least one
 SQL file (`.sql`) then migration will be applied automatically

examples/configs/shop.yaml

@@ -7,6 +7,8 @@ description: |
   Order HOT pizza RIGHT NOW and get
   **huge** discount!
   
+  ![](/assets/img/semweb.svg)
+  
   _T&C_ can be applied
 fields:
   - name: delivery_date

examples/docker-compose.yaml

@@ -17,4 +17,5 @@ services:
       - 127.0.0.1:8080:8080
     volumes:
       - ./configs:/configs:ro
-      - ./migrations:/migrations:ro
+      - ./migrations:/migrations:ro
+      - ./assets:/assets:ro