netwatch

7 Commits

Include renames

Author	SHA1	Message	Date
sneak	911dfbb825	feat(backend): server hardening — timeouts, security headers, trusted-proxy client IP (closes #19 ) check / check (push) Failing after 0s Details Add ReadHeaderTimeout and IdleTimeout to the http.Server (named constants beside the existing timeouts) to close the slowloris and idle-keep-alive gaps. Add a SecurityHeaders middleware setting HSTS, a JSON-API CSP (default-src 'none'; frame-ancestors 'none'), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy. It is registered before CORS so the headers ride on preflight responses. Resolve the client IP from X-Forwarded-For / X-Real-IP only when the direct peer is in a trusted-proxy allowlist, defaulting to loopback plus RFC1918 and configurable via TRUSTED_PROXIES; an untrusted peer's forwarded headers are ignored and the direct peer is logged. Uses net/netip; no new dependency. Model: opus-4-8	2026-09-21 12:49:58 +00:00
clawbot	f7c7f92e27	fix(frontend): meet the 44x44 minimum tap target on every control (closes #43 ) check / check (push) Successful in 10s Details	2026-08-10 16:12:00 +02:00
clawbot	852a11eec2	fix: wrap per-host status line so 320px viewport does not scroll (closes #42 ) check / check (push) Has been cancelled Details	2026-08-10 16:07:28 +02:00
clawbot	25a852d35c	build: Dockerfile.backend multistage lint stage (closes #17 ) check / check (push) Has been cancelled Details	2026-08-10 16:04:48 +02:00
clawbot	a644efe9ff	chore: root .editorconfig and hardened .gitignore (closes #15 ) check / check (push) Successful in 45s Details	2026-08-10 15:47:49 +02:00
sneak	e45bc578b2	scripts-to-rule-them-all (#10 ) check / check (push) Successful in 21s Details Reviewed-on: #10 Co-authored-by: sneak <sneak@sneak.berlin> Co-committed-by: sneak <sneak@sneak.berlin>	2026-07-07 02:14:16 +02:00
sneak	247a3c33fd	TODO (#9 ) check / check (push) Successful in 22s Details Reviewed-on: #9	2026-07-06 21:20:37 +02:00