Darkraise f385eeb27b fix(security): harden served-frontend CSP, drop unsafe-inline/eval
Tighten the Content-Security-Policy the backend sends when it serves the
SPA so injected inline scripts and eval are no longer allowed:

- script-src: 'self' + 'wasm-unsafe-eval' (for Ruffle's WASM) + a SHA-256
  hash of index.html's inline theme bootstrap, computed at startup from the
  served file. Drops 'unsafe-inline' and 'unsafe-eval'.
- style-src: keep 'unsafe-inline' — Radix/shadcn set inline style attributes
  at runtime, which hashes/nonces (style-src-attr) cannot cover.

The inline-script hash normalizes CRLF/CR to LF before hashing because the
HTML parser does the same before matching, so the hash holds on Windows
(CRLF) checkouts too.

Verified: 0 eval/new Function in the bundles; Ruffle loads as an external
same-origin script and only needs wasm-unsafe-eval; the hashed theme script
executes under the strict policy in a real browser with no CSP violation.
2026-08-11 16:02:06 +07:00
2026-01-31 17:29:07 +07:00
2026-01-28 19:21:02 +07:00
2026-01-28 19:21:02 +07:00
2026-02-11 23:29:04 +07:00
2026-01-13 10:09:15 +07:00
2026-02-14 11:48:35 +07:00

Flashpoint Web

A modern web interface for the Flashpoint Archive

Browse and play 200,000+ preserved Flash games and animations directly in your browser.

Node.js TypeScript React Express Vite Tailwind CSS SQLite Docker

License Node.js 20+ PRs Welcome


What is Flashpoint Web?

Flashpoint Web is a self-hosted web application for accessing your local Flashpoint Archive collection. It provides a modern, browser-based alternative to the Flashpoint Launcher with multi-user support, play tracking, and an intuitive interface.

Key Features

  • Browse & Search - Fast search across 200,000+ games with advanced filtering by platform, developer, tags, and more
  • Play in Browser - Flash games via Ruffle emulator, HTML5 games natively
  • Multi-User Support - Individual accounts with role-based permissions (admin, moderator, user, guest)
  • Play Tracking - Track playtime, completion status, and view play statistics
  • Playlists & Favorites - Organize your game collection with custom playlists
  • 22 Theme Palettes - Customizable dark/light modes with multiple color schemes
  • Responsive Design - Works on desktop and mobile devices
  • Database Hot-Reload - Automatically syncs when Flashpoint Launcher updates metadata

Getting Started

Prerequisites

1. Create a project directory

mkdir flashpoint-web && cd flashpoint-web

2. Create docker-compose.yml

services:
  flashpoint-web:
    image: darkraise/flashpoint-web:${IMAGE_TAG:-latest}
    container_name: flashpoint-web
    restart: unless-stopped
    ports:
      - "${WEB_PORT:-80}:3100"
    volumes:
      - ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH is required}:/data/flashpoint:ro
      - ${DATA_PATH:-./data}:/app/data
      - ${LOGS_PATH:-./logs}:/app/logs
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - NODE_ENV=production
      - TZ=${TZ:-UTC}
      - DOMAIN=${DOMAIN:-http://localhost:${WEB_PORT:-80}}
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET is required}
      - ENABLE_LOCAL_DB_COPY=${ENABLE_LOCAL_DB_COPY:-false}
      - SQLITE_CACHE_SIZE=${SQLITE_CACHE_SIZE:--64000}
      - SQLITE_MMAP_SIZE=${SQLITE_MMAP_SIZE:-268435456}
      - ENABLE_CACHE_PREWARM=${ENABLE_CACHE_PREWARM:-true}
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:3100/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

3. Create .env

# Required — path to your Flashpoint installation on the host machine
FLASHPOINT_HOST_PATH=/path/to/Flashpoint

# Required — secret key for JWT authentication (use a long random string)
JWT_SECRET=your-secure-secret-key

# Optional — uncomment and edit as needed
# WEB_PORT=80              # Host port for the app (UI + API) (default: 80)
# PUID=1000                # Host user ID (Linux — run 'id -u')
# PGID=1000                # Host group ID (Linux — run 'id -g')
# DOMAIN=http://localhost  # Public URL of the app
# LOG_LEVEL=info           # debug, info, warn, error
# TZ=UTC                   # Timezone
# DATA_PATH=./data         # Persistent app data
# LOGS_PATH=./logs         # Log files

# Database performance (for network storage / large collections)
# ENABLE_LOCAL_DB_COPY=false       # Copy flashpoint.sqlite to local storage
# SQLITE_CACHE_SIZE=-64000         # SQLite cache in KB (64MB default)
# SQLITE_MMAP_SIZE=268435456       # Memory-mapped I/O in bytes (256MB default)
# ENABLE_CACHE_PREWARM=true        # Pre-warm common queries on startup

4. Start the services

docker compose up -d

Open http://localhost in your browser. The first user to register automatically becomes the admin.

Default Ports

Service URL
Frontend http://localhost
Backend http://localhost:3100

Common Commands

docker compose up -d                # Start services
docker compose down                 # Stop services
docker compose logs -f              # View logs
docker compose logs -f backend      # Logs for a specific service
docker compose restart backend      # Restart a service
docker compose pull && docker compose up -d  # Update to latest images

Documentation

For architecture details, API reference, development setup, contributing guidelines, and more, visit the Wiki.

License

This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.

Acknowledgments

  • Flashpoint Team - For preserving web gaming history
  • Ruffle Contributors - For making Flash playable in modern browsers
  • Community - For testing, feedback, and contributions

S
Description
Self-hosted flash game arcade for Flashpoint Ultimate, focused on game discovery, game support coverage, and theming. Not affiliated with the Flashpoint project.
Readme GPL-3.0
47 MiB
Languages
TypeScript 93.8%
JavaScript 3.5%
Shell 1.1%
CSS 0.6%
HTML 0.3%
Other 0.7%