Default WEBHOOKER_ENVIRONMENT to prod (closes #307)

Conversation 5 Commits 3 Files Changed 7

+39 -46

3 Commits

Author	SHA1	Message	Date
sneak	59a3728d89	Drop leftover reasoning from the old dev default check / check (push) Successful in 3m52s Details The README Docker and nginx examples no longer set WEBHOOKER_ENVIRONMENT=prod, which is now the default. The TRUSTED_PROXIES warning text in the README, config.go and its test now gives the real reason it ignores the environment: behind a proxy every client shares one bucket in dev and prod alike. Model: opus-5-5	2026-09-28 10:16:38 +00:00
sneak	bacd6f419f	Stop describing dev as the default environment check / check (push) Successful in 3m51s Details Comments in reqtls and session, and the README Quick Start and deployment checklist, still spoke as if an unset WEBHOOKER_ENVIRONMENT meant dev. The checklist now asks only that the environment is not dev (unset or prod); the Quick Start describes running from the clone. Model: opus-5-5	2026-09-28 09:19:12 +00:00
sneak	303fe42c86	Default WEBHOOKER_ENVIRONMENT to prod An unset WEBHOOKER_ENVIRONMENT now resolves to prod rather than dev, so an operator who forgets the variable is not silently permissive. The only behaviour dev still changes is the CORS middleware, which answers every origin with Access-Control-Allow-Origin: *; that is now off unless dev is set explicitly. Cookie Secure and CSRF strictness are decided per request from the transport and are unaffected. Updated resolveEnvironment and its comment, the README configuration table and prose, and tests covering the default and the explicit dev. Comments that justified behaviour by the old dev default (the TRUSTED_PROXIES warning, a CSRF test) were corrected; that warning still fires in every environment when TRUSTED_PROXIES is empty. Model: opus-4-8	2026-09-28 09:17:52 +00:00

Author

SHA1

Message

Date

sneak

59a3728d89

Drop leftover reasoning from the old dev default

check / check (push) Successful in 3m52s

Details

The README Docker and nginx examples no longer set
WEBHOOKER_ENVIRONMENT=prod, which is now the default. The
TRUSTED_PROXIES warning text in the README, config.go and its test now
gives the real reason it ignores the environment: behind a proxy every
client shares one bucket in dev and prod alike.

Model: opus-5-5

2026-09-28 10:16:38 +00:00

sneak

bacd6f419f

Stop describing dev as the default environment

check / check (push) Successful in 3m51s

Details

Comments in reqtls and session, and the README Quick Start and
deployment checklist, still spoke as if an unset WEBHOOKER_ENVIRONMENT
meant dev. The checklist now asks only that the environment is not dev
(unset or prod); the Quick Start describes running from the clone.

Model: opus-5-5

2026-09-28 09:19:12 +00:00

sneak

303fe42c86

Default WEBHOOKER_ENVIRONMENT to prod

An unset WEBHOOKER_ENVIRONMENT now resolves to prod rather than dev, so
an operator who forgets the variable is not silently permissive. The
only behaviour dev still changes is the CORS middleware, which answers
every origin with Access-Control-Allow-Origin: *; that is now off
unless dev is set explicitly. Cookie Secure and CSRF strictness are
decided per request from the transport and are unaffected.

Updated resolveEnvironment and its comment, the README configuration
table and prose, and tests covering the default and the explicit dev.
Comments that justified behaviour by the old dev default (the
TRUSTED_PROXIES warning, a CSRF test) were corrected; that warning
still fires in every environment when TRUSTED_PROXIES is empty.

Model: opus-4-8

2026-09-28 09:17:52 +00:00

Default WEBHOOKER_ENVIRONMENT to prod (closes #307) #322