4 Commits

Include renames

Author	SHA1	Message	Date
sneak	355ea53b32	Trust reverse proxies at private addresses by default (closes #198) ... With TRUSTED_PROXIES unset, the server now trusts reverse proxies in the private ranges of RFC 1918. A proxy such as traefik on a Docker network is then believed. /ip/, the home page's curl card and the request log give the client's address from X-Forwarded-For instead of the proxy's address. A list in TRUSTED_PROXIES replaces the default. TRUSTED_PROXIES set but empty trusts no proxy, so the config package reads it with os.LookupEnv. A direct client at a public address still cannot choose its address with a forged header. Model: opus-5-5	2026-10-27 18:07:20 +00:00
clawbot	ad67e3ca1e	Show the IP information API on the home page (closes #156) ... The home page gets an IP information API card. It shows the curl command that looks up the visitor's own address at /ip/{addr}. The page then makes that same request and shows the JSON answer, pretty-printed. An error answer, such as a 404 for an address with no route, is shown the same way. A request that fails shows an error line. The server gives the page the visitor's address, found as /ip/ finds it, so a trusted proxy's X-Forwarded-For is honoured. The command takes its origin from the browser, so it names the host the visitor used. Model: opus-5-5	2026-10-27 05:27:23 +01:00
clawbot	f489321e3a	Answer HEAD requests and give 405 a plain message (closes #111) ... Every route was registered for GET only, so HEAD answered 405, and on the JSON routes that 405 said "Internal server error". chi's GetHead now serves HEAD with the GET handler; /ip and /ip/ register HEAD themselves, as GetHead does not reach them. The /api/v1 and /ip route groups answer a path they lack with a JSON 404 "Not found", and the other methods the router knows (POST, PUT, PATCH, DELETE, OPTIONS, TRACE, CONNECT) with a JSON 405 "Method not allowed" whose Allow header names GET and HEAD. JSONValidationMiddleware gives a 4xx sent without a JSON body the status's standard text instead of "Internal server error". Model: opus-5-5	2026-10-20 03:06:23 +02:00
clawbot	89bdda18a5	Add the HTTP hardening the policy requires before 1.0 (closes #108) ... Every answer carries the six security headers REPO_POLICIES.md lists. The Content-Security-Policy allows inline content only with a nonce made for that answer; the pages put it on their style and script blocks and drop their four style attributes. The request log and /ip/ take a forwarded address only from a proxy listed in TRUSTED_PROXIES, which stops the start when set but invalid: the last X-Forwarded-For entry that is not a trusted proxy. X-Real-IP and True-Client-IP are no longer read. The JSON routes and the health check send fixed messages in place of database, parser and resolver errors, and log the detail. Model: opus-5-5	2026-10-20 01:36:18 +02:00