netwatch

61 Commits 8 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	95c6ec16b4	fix(backend): report ingest correctness — propagate storage failure, 413 on oversize, global body cap (closes #23 ) check / check (push) Failing after 1s Details A buffer failure on POST /api/v1/reports now returns 500 instead of a false {"status":"ok"}, so clients can retry. Decode errors are split: an over-limit body returns 413 (via errors.As on *http.MaxBytesError), malformed JSON stays 400. A new MaxBodyBytes middleware caps every route (1 MiB default; rejects an oversized Content-Length up-front and caps the read otherwise), replacing the per-route reader so the health check and future routes are bounded too. The raw attacker-controlled geo blob is no longer logged — only its byte length — and client_id and timestamp are length-bounded before logging. A decodeJSON handler helper is added per the HTTP server conventions. Panic recovery is now a local middleware that routes the stack through slog as structured JSON rather than chi's plain-text stderr. Error bodies still leak nothing internal. Chosen failure code for a storage failure: 500, since a full buffer or write error is server-side and retryable, not the client's fault. Model: opus-4-8	2026-09-21 13:17:59 +00:00
clawbot	f3895789d2	feat(backend): server hardening: timeouts, security headers, trusted-proxy client IP (closes #19 ) check / check (push) Failing after 1s Details Add ReadHeaderTimeout and IdleTimeout to the http.Server as named constants beside the existing timeouts. Add a SecurityHeaders middleware (HSTS, a JSON-API CSP of default-src 'none'; frame-ancestors 'none', X-Frame-Options DENY, nosniff, Referrer-Policy, Permissions-Policy), registered before CORS so preflight responses carry it. Resolve the client IP from X-Forwarded-For / X-Real-IP only when the direct peer is in the trusted-proxy allowlist (loopback plus RFC1918 by default, configurable via TRUSTED_PROXIES); an untrusted peer's forwarded headers are ignored. Uses net/netip; no new dependency. Model: opus-4-8 (implementation and review); claude-fable-5 (merge)	2026-09-21 15:05:25 +02:00
sneak	b57afeddbd	Add backend with buffered zstd-compressed report storage Introduce the Go backend (netwatch-server) with an HTTP API that accepts telemetry reports and persists them as zstd-compressed JSONL files. Reports are buffered in memory and flushed to disk when the buffer reaches 10 MiB or every 60 seconds.	2026-02-27 12:14:34 +07:00

Author

SHA1

Message

Date

sneak

95c6ec16b4

fix(backend): report ingest correctness — propagate storage failure, 413 on oversize, global body cap (closes #23 )

check / check (push) Failing after 1s

Details

A buffer failure on POST /api/v1/reports now returns 500 instead of a
false {"status":"ok"}, so clients can retry. Decode errors are split:
an over-limit body returns 413 (via errors.As on *http.MaxBytesError),
malformed JSON stays 400. A new MaxBodyBytes middleware caps every
route (1 MiB default; rejects an oversized Content-Length up-front and
caps the read otherwise), replacing the per-route reader so the health
check and future routes are bounded too. The raw attacker-controlled
geo blob is no longer logged — only its byte length — and client_id and
timestamp are length-bounded before logging. A decodeJSON handler helper
is added per the HTTP server conventions. Panic recovery is now a local
middleware that routes the stack through slog as structured JSON rather
than chi's plain-text stderr. Error bodies still leak nothing internal.

Chosen failure code for a storage failure: 500, since a full buffer or
write error is server-side and retryable, not the client's fault.

Model: opus-4-8

2026-09-21 13:17:59 +00:00

clawbot

f3895789d2

feat(backend): server hardening: timeouts, security headers, trusted-proxy client IP (closes #19 )

check / check (push) Failing after 1s

Details

Add ReadHeaderTimeout and IdleTimeout to the http.Server as named constants beside the existing timeouts. Add a SecurityHeaders middleware (HSTS, a JSON-API CSP of default-src 'none'; frame-ancestors 'none', X-Frame-Options DENY, nosniff, Referrer-Policy, Permissions-Policy), registered before CORS so preflight responses carry it. Resolve the client IP from X-Forwarded-For / X-Real-IP only when the direct peer is in the trusted-proxy allowlist (loopback plus RFC1918 by default, configurable via TRUSTED_PROXIES); an untrusted peer's forwarded headers are ignored. Uses net/netip; no new dependency.

Model: opus-4-8 (implementation and review); claude-fable-5 (merge)

2026-09-21 15:05:25 +02:00

sneak

b57afeddbd

Add backend with buffered zstd-compressed report storage

Introduce the Go backend (netwatch-server) with an HTTP API that
accepts telemetry reports and persists them as zstd-compressed JSONL
files. Reports are buffered in memory and flushed to disk when the
buffer reaches 10 MiB or every 60 seconds.

2026-02-27 12:14:34 +07:00