clawbot e5d245fbc8 Default-block Azure WireServer's public address (closes #245) ...

Add 168.63.129.16 to blockedNetworks, the default blocklist, not
alwaysBlockedNetworks: it is public unicast, so an operator who lists
it in ALLOWED_EGRESS_CIDRS can reach it again. The default-blocklist
refusal no longer says "private/reserved", which this address is not.

Sources:
- Fixed, Microsoft-owned address:
  https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16
- WireServer there bootstraps VM credentials and serves secrets:
  https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/overview

147.75.207.243 (Equinix Metal) is not added: Equinix's metadata page
names only the hostname metadata.platformequinix.com, not the address,
and says Equinix Metal was sunset on 2026-06-30.

Model: opus-5-5

2026-09-29 07:16:45 +00:00

..

archive_sweeper_test.go

Bound shutdown hooks by their stop context (closes #102)

2026-08-14 06:18:33 +02:00

archive_sweeper.go

Bound shutdown hooks by their stop context (closes #102)

2026-08-14 06:18:33 +02:00

circuit_breaker_test.go

Make deliveries refused while half-open wait a cooldown (closes #306)

2026-09-29 05:48:20 +02:00

circuit_breaker.go

Make deliveries refused while half-open wait a cooldown (closes #306)

2026-09-29 05:48:20 +02:00

client_ssrf_test.go

Harden operator-set target headers (closes #233) (#242)

2026-08-20 10:54:43 +02:00

engine_integration_test.go

Close the two remaining delivery terminal-state gaps (closes #107)

2026-08-24 05:12:02 +02:00

engine_lifecycle_test.go

Close archive writers when the delivery engine stops (closes #280)

2026-09-29 08:30:22 +02:00

engine_test.go

Send Content-Type once on a delivery (closes #246)

2026-09-29 07:11:55 +02:00

engine.go

Close archive writers when the delivery engine stops (closes #280)

2026-09-29 08:30:22 +02:00

event_db_isolation_test.go

Close the two remaining delivery terminal-state gaps (closes #107)

2026-08-24 05:12:02 +02:00

event_timestamp_test.go

Render unknown for a zero CreatedAt in Slack/Mattermost messages (closes #298)

2026-08-24 17:52:25 +02:00

export_test.go

Fail a pending delivery whose target was deleted (closes #293)

2026-09-29 06:48:19 +02:00

inflight_test.go

Do not resend a delivery that restart recovery already sent (closes #299)

2026-09-29 04:12:14 +02:00

inflight.go

Open SQLite with WAL and bound delivery re-dispatch by ownership (closes #256)

2026-08-24 03:49:17 +02:00

metrics_test.go

Make deliveries refused while half-open wait a cooldown (closes #306)

2026-09-29 05:48:20 +02:00

queue_depth_gormlog_test.go

Open SQLite with WAL and bound delivery re-dispatch by ownership (closes #256)

2026-08-24 03:49:17 +02:00

queue_depth.go

Read queue depths with Find, not Scan (closes #234) (#237)

2026-08-20 07:55:20 +02:00

recovery_durability_test.go

Open SQLite with WAL and bound delivery re-dispatch by ownership (closes #256)

2026-08-24 03:49:17 +02:00

redirect_test.go

Send Content-Type once on a delivery (closes #246)

2026-09-29 07:11:55 +02:00

redirect.go

Harden operator-set target headers (closes #233) (#242)

2026-08-20 10:54:43 +02:00

ssrf_allowlist_test.go

Default-block Azure WireServer's public address (closes #245)

2026-09-29 07:16:45 +00:00

ssrf_test.go

Add an egress CIDR allowlist to the SSRF guard (closes #204) (#217)

2026-08-20 10:34:42 +02:00

ssrf.go

Default-block Azure WireServer's public address (closes #245)

2026-09-29 07:16:45 +00:00

target_config_edit.go

Add a target edit form with headers and timeout fields (closes #127) (#229)

2026-08-20 07:24:12 +02:00

target_config_view_test.go

Name a deleted target on its historical deliveries (closes #211)

2026-08-24 02:03:23 +02:00

target_config_view.go

Name a deleted target on its historical deliveries (closes #211)

2026-08-24 02:03:23 +02:00

target_database_archive_gormlog_test.go

Route GORM's logger through slog and bound it (closes #178)

2026-08-18 07:17:43 +02:00

target_database_archive.go

Open SQLite with WAL and bound delivery re-dispatch by ownership (closes #256)

2026-08-24 03:49:17 +02:00

target_database_evict_test.go

Close archive writers when the delivery engine stops (closes #280)

2026-09-29 08:30:22 +02:00

target_database_test.go

Evict archive writers on deletion and sweep idle archives (closes #89) (#95)

2026-08-10 15:52:20 +02:00

target_database.go

Close archive writers when the delivery engine stops (closes #280)

2026-09-29 08:30:22 +02:00

target_headers_test.go

Send Content-Type once on a delivery (closes #246)

2026-09-29 07:11:55 +02:00

target_headers.go

Harden operator-set target headers (closes #233) (#242)

2026-08-20 10:54:43 +02:00

target_http.go

Send Content-Type once on a delivery (closes #246)

2026-09-29 07:11:55 +02:00

target_log.go

Open SQLite with WAL and bound delivery re-dispatch by ownership (closes #256)

2026-08-24 03:49:17 +02:00

target_redact_test.go

Render delivery attempt detail in the event log (closes #202) (#219)

2026-08-20 08:36:25 +02:00

target_redact.go

Render delivery attempt detail in the event log (closes #202) (#219)

2026-08-20 08:36:25 +02:00

target_slack.go

Render unknown for a zero CreatedAt in Slack/Mattermost messages (closes #298)

2026-08-24 17:52:25 +02:00

target.go

Expose delivery metrics on /metrics (closes #209) (#224)

2026-08-20 07:19:04 +02:00

terminal_state_test.go

Fail a pending delivery whose target was deleted (closes #293)

2026-09-29 06:48:19 +02:00

url_mask_test.go

Add an egress CIDR allowlist to the SSRF guard (closes #204) (#217)

2026-08-20 10:34:42 +02:00

url_mask.go

Mask the webhook credential in delivery errors and logs (closes #118)

2026-08-11 15:11:57 +02:00