4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	d140cab2f1	Entrypoint acts as root on nothing outside /data (closes #80) ... `bin/entrypoint.sh` now runs `netwatch-server prepare-data-dir`, which refuses a `DATA_DIR` that is not `/data` or a path below it written in full, then creates `DATA_DIR`, gives `/data` and everything in it to `netwatch` and sets mode 750 on `/data` and `DATA_DIR`. Every step goes through a Go `os.Root` opened on `/data`, which follows a symbolic link only when it is relative and stays inside `/data`, so neither a link already there nor one a host process swaps in while the container starts can make root create or change anything outside `/data`. The README says which `DATA_DIR` values are accepted. Model: opus-5-5	2026-10-03 13:19:19 +00:00
clawbot	e6d6815ecb	Remove Buildarch: read the architecture at run time (closes #83) ... The architecture is no longer passed in at build time. The Buildarch variable and field are gone from main and globals, script/build no longer stamps it in with -X, and the startup and listen log lines report runtime.GOARCH under the key "arch". The Dockerfile comment and backend/README.md no longer describe an architecture being stamped in. Model: opus-5-5	2026-10-02 01:05:09 +02:00
clawbot	8833603eff	nginx: trust X-Forwarded-For only from TRUSTED_PROXIES (closes #64) ... nginx trusted X-Forwarded-For from every RFC1918 address, so a client reaching it from one could write a new address on each request and get a fresh rate-limit allowance. The container's TRUSTED_PROXIES now names the reverse proxies nginx trusts, none by default. bin/entrypoint.sh makes each entry a CIDR, checks it with the new "netwatch-server check-cidr", which runs the server's own TRUSTED_PROXIES parsing, and writes one set_real_ip_from line per entry into /etc/nginx/trusted-proxies.conf, which nginx.conf includes. The backend is started with TRUSTED_PROXIES=127.0.0.1/32, since nginx is its only client. The viewport test mounts an empty file there. Model: opus-5-5	2026-09-29 08:55:47 +02:00
sneak	8ca57746df	Move backend Dockerfile to repo root for git access ... Place the backend Dockerfile at repo root as Dockerfile.backend so the build context includes .git, giving git describe access for version stamping. Fix .gitignore pattern to anchor /netwatch-server so it does not exclude cmd/netwatch-server/. Remove .git from .dockerignore. Update CI workflow and backend Makefile docker target.	2026-02-27 12:45:38 +07:00