netwatch

66 Commits 8 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	de4e86c433	build: unify the gate so root make check covers the backend (closes #16 ) check / check (push) Successful in 11s Details Root make check, and with it the pre-commit hook, now gates the Go backend too. The backend's Makefile targets are shims over backend/script/*; script/cibuild builds both images and is the workflow's only build step. Root make test runs both halves within one 30-second timeout. Root make lint runs golangci-lint only in Docker, by building the lint stage of Dockerfile.backend without the cache; the .golangci.yml drift check moved into backend/script/lint. script/bootstrap installs no linter: it reuses a Go at least as new as backend/go.mod asks for, otherwise installs the pinned, hash-verified release, linked into ~/.local/bin without replacing anything it did not create. With VERSION unset or empty, the backend version falls back to git describe inside a git checkout, then to dev. Model: opus-5-5	2026-09-29 01:22:08 +02:00
clawbot	f3895789d2	feat(backend): server hardening: timeouts, security headers, trusted-proxy client IP (closes #19 ) check / check (push) Failing after 1s Details Add ReadHeaderTimeout and IdleTimeout to the http.Server as named constants beside the existing timeouts. Add a SecurityHeaders middleware (HSTS, a JSON-API CSP of default-src 'none'; frame-ancestors 'none', X-Frame-Options DENY, nosniff, Referrer-Policy, Permissions-Policy), registered before CORS so preflight responses carry it. Resolve the client IP from X-Forwarded-For / X-Real-IP only when the direct peer is in the trusted-proxy allowlist (loopback plus RFC1918 by default, configurable via TRUSTED_PROXIES); an untrusted peer's forwarded headers are ignored. Uses net/netip; no new dependency. Model: opus-4-8 (implementation and review); claude-fable-5 (merge)	2026-09-21 15:05:25 +02:00
sneak	4ad2573532	Add CI workflow and backend repo standard files check / check (push) Failing after 26s Details Add .gitea/workflows/check.yml that builds both the root and backend Docker images on push. Add LICENSE and README.md to the backend subproject to match repo standards.	2026-02-27 12:18:35 +07:00

Author

SHA1

Message

Date

clawbot

de4e86c433

build: unify the gate so root make check covers the backend (closes #16 )

check / check (push) Successful in 11s

Details

Root make check, and with it the pre-commit hook, now gates the Go
backend too. The backend's Makefile targets are shims over
backend/script/*; script/cibuild builds both images and is the
workflow's only build step. Root make test runs both halves within one
30-second timeout.

Root make lint runs golangci-lint only in Docker, by building the lint
stage of Dockerfile.backend without the cache; the .golangci.yml drift
check moved into backend/script/lint. script/bootstrap installs no
linter: it reuses a Go at least as new as backend/go.mod asks for,
otherwise installs the pinned, hash-verified release, linked into
~/.local/bin without replacing anything it did not create. With VERSION
unset or empty, the backend version falls back to git describe inside a
git checkout, then to dev.

Model: opus-5-5

2026-09-29 01:22:08 +02:00

clawbot

f3895789d2

feat(backend): server hardening: timeouts, security headers, trusted-proxy client IP (closes #19 )

check / check (push) Failing after 1s

Details

Add ReadHeaderTimeout and IdleTimeout to the http.Server as named constants beside the existing timeouts. Add a SecurityHeaders middleware (HSTS, a JSON-API CSP of default-src 'none'; frame-ancestors 'none', X-Frame-Options DENY, nosniff, Referrer-Policy, Permissions-Policy), registered before CORS so preflight responses carry it. Resolve the client IP from X-Forwarded-For / X-Real-IP only when the direct peer is in the trusted-proxy allowlist (loopback plus RFC1918 by default, configurable via TRUSTED_PROXIES); an untrusted peer's forwarded headers are ignored. Uses net/netip; no new dependency.

Model: opus-4-8 (implementation and review); claude-fable-5 (merge)

2026-09-21 15:05:25 +02:00

sneak

4ad2573532

Add CI workflow and backend repo standard files

check / check (push) Failing after 26s

Details

Add .gitea/workflows/check.yml that builds both the root and
backend Docker images on push. Add LICENSE and README.md to the
backend subproject to match repo standards.

2026-02-27 12:18:35 +07:00