4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	237f131367	Default WEBHOOKER_ENVIRONMENT to prod (closes #307) ... An unset WEBHOOKER_ENVIRONMENT now means prod, not dev. The only thing dev still changes is CORS, which then answers every origin with Access-Control-Allow-Origin: *, so an operator who forgets the variable is no longer silently permissive; dev must be set explicitly. Cookie Secure and CSRF strictness follow each request's transport and are unaffected. The README, comments and tests no longer describe dev as the default: the deployment checklist asks only that the environment is not dev, the Docker and nginx examples drop the now-redundant setting, and the TRUSTED_PROXIES warning gives its real reason for firing in every environment. Model: opus-4-8 (implementation); opus-5-5 (rework)	2026-09-28 12:47:31 +02:00
clawbot	7ed1588443	Document running webhooker under upaas (closes #323) ... Adds a "Running under upaas" section to the README: add no port mapping, since upaas publishes mapped ports on every host interface, and put the app on the reverse proxy's Docker network instead; one data volume at /var/lib/webhooker, created owned by UID 1000 before the first deploy; WEBHOOKER_ENVIRONMENT and TRUSTED_PROXIES; the health check upaas reads 60 seconds after a deploy; and where the first-run admin password appears and how to reset it. upaas bind-mounts a host directory it never creates, and one made by root stops the container at its data directory lock. The documented creation step removes that; the image is unchanged. Model: opus-5-5	2026-09-28 12:30:32 +02:00
clawbot	b051821370	Say max_retries is the total attempt count, not a retry count (closes #316) ... The help text under the field on both target forms and the max_retries rows in the README now say the number is the total number of delivery attempts: 0 is a single attempt with no retries and no circuit breaker, and N is N attempts in total. The delivery code already worked this way; only the wording was wrong, so an operator wanting one try plus two retries would have entered 2 instead of 3. A UI copy test renders both forms and pins the wording. Delivery behaviour is unchanged. Model: opus-4-8 (implementation); fable-5-1 (merge)	2026-09-21 18:33:09 +02:00
clawbot	39afa69bfc	Consolidate the data directory mode into one owner (closes #288) ... Two packages each declared the 0o750 mode for DATA_DIR and both created the directory. internal/datadir now exports DirPerm as the single definition, and internal/database uses it in both places it creates the directory. The value is unchanged, so existing deployments see no permission change. datadir owns it because guarding and creating DATA_DIR is that package's whole purpose and it imports nothing that would form a cycle. Model: opus-4-8 (implementation and review); fable-5-1 (merge)	2026-09-21 10:01:51 +02:00