backmeupplz/groceries
Watch
1
0
Fork
You've already forked groceries
 0
Code Issues Pull requests Projects Releases 5 Packages Wiki Activity Actions
No description
13 commits 1 branch 5 tags 58 KiB
  • JavaScript 60%
  • HTML 39%
  • Dockerfile 1%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Nikita Kolmogorov e3fd768277
 Pin Node 24.22.1 (Node.js Oct 2026 security release) (#1) 
Fixes CVE-2026-111497 (Brotli RCE) and the TLS hostname-check bypasses
from https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 07:53:03 -07:00
.github Add funding links 2026-10-08 15:24:51 -07:00
.dockerignore Security hardening, Docker image 2026-10-01 10:45:16 -07:00
.gitignore Ignore logs 2026-10-01 09:58:41 -07:00
Dockerfile Pin Node 24.22.1 (Node.js Oct 2026 security release) (#1) 2026-10-21 07:53:03 -07:00
index.html Confirm before deleting an item 2026-10-01 11:55:19 -07:00
README.md Security hardening, Docker image 2026-10-01 10:45:16 -07:00
server.js Edit/delete items, quantities, non-ASCII case folding 2026-10-01 11:49:41 -07:00
test.js Edit/delete items, quantities, non-ASCII case folding 2026-10-01 11:49:41 -07:00

README.md

groceries

Shared shopping lists (tabs on top, all shared between users). Tap to tick, tap a ticked item (or a suggestion) to re-add. Live sync between everyone logged in.

Zero dependencies, Node 22.13+ (uses built-in node:sqlite). The whole frontend is ~2.5KB gzipped.

ADMIN_USER=me ADMIN_PASSWORD=change-me-please node server.js   # http://localhost:3000
node test.js                                                    # tests

ADMIN_USER / ADMIN_PASSWORD create the first user on an empty database (ignored afterwards). Add more users from the users icon in the top bar. PORT and DB (SQLite path) are optional.

Docker

docker run -d -p 3000:3000 -v groceries:/data -e ADMIN_USER=me -e ADMIN_PASSWORD=change-me-please ghcr.io/backmeupplz/groceries

Also available as an app on MyGround.

Security notes

  • Every user is an equal admin: anyone logged in can add/remove users and lists.
  • Behind an HTTPS proxy, pass X-Forwarded-Proto: https so the session cookie becomes Secure/__Host-.
  • On plain-http host:port setups, browsers share cookies across ports, so other apps on the same host can see the session cookie. Give it its own hostname if you don't trust the neighbours.