4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	8833603eff	nginx: trust X-Forwarded-For only from TRUSTED_PROXIES (closes #64) ... nginx trusted X-Forwarded-For from every RFC1918 address, so a client reaching it from one could write a new address on each request and get a fresh rate-limit allowance. The container's TRUSTED_PROXIES now names the reverse proxies nginx trusts, none by default. bin/entrypoint.sh makes each entry a CIDR, checks it with the new "netwatch-server check-cidr", which runs the server's own TRUSTED_PROXIES parsing, and writes one set_real_ip_from line per entry into /etc/nginx/trusted-proxies.conf, which nginx.conf includes. The backend is started with TRUSTED_PROXIES=127.0.0.1/32, since nginx is its only client. The viewport test mounts an empty file there. Model: opus-5-5	2026-09-29 08:55:47 +02:00
clawbot	ced1956b06	nginx: listen on PORT, default 8080; server_tokens off (closes #26) ... nginx.conf is now a template the nginx image renders into conf.d at container start. bin/entrypoint.sh sets PORT to 8080 when unset or empty, and stops with an error before starting anything when PORT is not digits only: nginx would take a value such as localhost or unix:/tmp/x.sock as an address and start anyway. NGINX_ENVSUBST_FILTER limits the rendering to PORT, so $uri, $host and every other nginx variable pass through unchanged. server_tokens off drops the version from the Server header and error pages. script/frontend-viewport-test renders the template the same way. EXPOSE still documents 8080; the backend stays on 127.0.0.1:8081. Model: opus-5-5	2026-09-29 04:55:48 +02:00
clawbot	bbcc7d921d	build: one image, nginx in front of the backend on loopback (closes #52) ... The root Dockerfile builds the only image; Dockerfile.backend is gone. Its stages: lint, a Go stage that runs the tests and builds netwatch-server, the node stage, and an nginx runtime. nginx serves dist/ on 8080 and proxies /api/ and /.well-known/healthcheck to the backend on 127.0.0.1:8081. bin/entrypoint.sh starts both, turns TERM or INT into a stop of both, and exits non-zero when either exits on its own. The backend runs as user netwatch and keeps reports on the /data volume. New setting BIND_ADDRESS (empty: every interface). STOPSIGNAL is SIGTERM, since the nginx image's SIGQUIT would miss the entrypoint. script/docker is the org model verbatim. Model: opus-5-5	2026-09-29 02:59:33 +02:00
sneak	30895f4219	Hardcode port 8080, extract nginx config, fix host row overflow ... - Nginx: extract config from Dockerfile heredoc to nginx.conf, hardcode port 8080, remove envsubst templating - Host row: add bottom padding so stats line stays within the row well	2026-02-26 18:28:01 +07:00