webhooker

6 Commits

Include renames

Author	SHA1	Message	Date
clawbot	515c359e56	Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333 ) check / check (push) Waiting to run Details Unset or empty, TRUSTED_PROXIES now defaults to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, so a reverse proxy reaching webhooker from one of those ranges gets per-client rate-limit buckets with nothing set. A set value replaces the default entirely; an unparseable one still fails startup. The startup warning for an empty list is gone. The README gives the default, one rule (if any client can reach webhooker, or the proxy in front of it, from an RFC 1918 source address, set the list to the proxy's address alone), and where to find that address: the remoteIP field of the http request log line. Loopback is not in the default. Model: opus-5-5	2026-10-02 00:41:36 +02:00
clawbot	b9f7db6901	Fail loudly on an unparseable SENTRY_DSN and a malformed .env (closes #283 ) check / check (push) Successful in 2m54s Details	2026-08-24 04:25:29 +02:00
clawbot	62576f6fc6	Bind the app port deliberately and document the proxy deployment (closes #268 ) (closes #226 ) check / check (push) Successful in 3m4s Details	2026-08-24 03:38:44 +02:00
clawbot	03cd1859d7	Add an egress CIDR allowlist to the SSRF guard (closes #204 ) (#217 ) check / check (push) Successful in 3m1s Details	2026-08-20 10:34:42 +02:00
clawbot	d8f9d149b5	Warn when TRUSTED_PROXIES is empty in production (closes #149 ) check / check (push) Successful in 2m40s Details With no trusted proxies configured, every client behind the reverse proxy production requires shares one rate-limit bucket per limit, so five POSTs per minute from anywhere holds the login limit full and denies the admin login until restart. The default is still correct; it was the consequence that was invisible. Startup now warns, and the README no longer claims the login limit is per-IP unconditionally.	2026-08-12 13:49:39 +02:00
clawbot	45890d4f82	Fail loudly on set-but-unparseable env config values (closes #80 ) (#92 ) check / check (push) Superseded by a newer commit; never tested Defaults now apply only to unset or empty environment variables; a set-but- unparseable value aborts startup with an error naming the key and the value. envInt is gone, envBool parses with strconv.ParseBool, and PORT is bounded.	2026-08-10 16:06:12 +02:00