mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
af4b17cc37
Replace the long-lived DOCS_REPO_TOKEN personal access token with short-lived installation tokens minted per-job from the sencho-token-app GitHub App (owned by the AnsoCode org, installed on both Sencho and sencho-docs). Why this is better than the PAT: - Scoped per-job to only the repo the job actually touches, not one token that works everywhere. update-screenshots and release-please mint against Sencho; sync-docs mints against sencho-docs. - Scoped per-job to only the permission scopes the job actually needs (contents:write and sometimes pull-requests:write), not the broader scope a PAT carries. - Auto-revoked at job end by the action's post-run step, so a leaked log line or artifact is useful for at most the remainder of that job. - Not tied to any individual user account: no more risk of the token silently dying when the human who minted it leaves or rotates keys. - Like a PAT but unlike GITHUB_TOKEN, installation tokens DO trigger downstream workflow runs, so the release-please tag push still cascades into docker-publish.yml exactly as before. Jobs migrated: - release-please.yml: single mint, passed to release-please-action. - ci.yml update-screenshots: one mint reused by checkout, peter-evans create-pull-request, and the gh pr merge step. - ci.yml sync-docs: one mint targeting sencho-docs, fed to the git clone URL as x-access-token. DOCS_REPO_TOKEN can be deleted from repo secrets after the first full release cycle under this migration validates release-please, update-screenshots, and sync-docs all succeed end-to-end. actions/create-github-app-token pinned to v3.0.0 at SHA f8d387b68d61c58ab83c6c016672934102569859, consistent with the SHA-pinning convention established in the supply-chain hardening PR.
Sencho
A self-hosted Docker Compose management dashboard. Manage your stacks, containers, images, volumes, and networks through a modern web UI.
Features
- Stack Management - Create, edit, start, stop, and remove Docker Compose stacks with a built-in Monaco code editor
- Multi-Node Support - Manage remote Sencho instances through a transparent HTTP/WebSocket proxy (Distributed API model)
- App Store - One-click deployment from LinuxServer.io templates with editable ports, volumes, and environment variables
- Resource Hub - Browse and manage images, volumes, and networks with managed/external/unused classification
- Live Logs - Aggregated real-time log streaming across all containers with search and filtering
- Dashboard - Container stats, CPU/RAM metrics, health checks, and image update notifications
- Alerts - Configurable threshold alerts for CPU, RAM, and disk usage
- Terminal - In-browser host console and container exec via WebSocket
Quick Start
services:
sencho:
image: saelix/sencho:latest
container_name: sencho
restart: unless-stopped
ports:
- "3000:3000"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./data:/app/data
# 1:1 Compose Path Rule: host path MUST match container path
- /opt/docker:/opt/docker
environment:
- COMPOSE_DIR=/opt/docker
- DATA_DIR=/app/data
docker compose up -d
Then open http://your-server:3000 and create your admin account.
See the full documentation for configuration details, multi-node setup, and more.
Development
# Backend (Express + TypeScript)
cd backend && npm install && npm run dev
# Frontend (React + Vite)
cd frontend && npm install && npm run dev
The frontend dev server proxies /api requests to the backend on port 3000.
Contributing
See CONTRIBUTING.md for development setup and PR guidelines.
Security
See SECURITY.md for vulnerability reporting. Do not open public issues for security vulnerabilities.
License
Sencho is licensed under the Business Source License 1.1. You may use, modify, and redistribute the code freely, including for production use. The only restriction is offering Sencho as a competing hosted or managed service. On 2030-03-25, the license automatically converts to Apache 2.0.