From a5f51e4a0c814681e5348eb3bed2a8d9386a090e Mon Sep 17 00:00:00 2001
From: Krystie <krystie@sami.ai>
Date: Wed, 1 Jul 2026 03:10:53 -0700
Subject: [PATCH] =?UTF-8?q?DC-023:=20operational=20fixes=20=E2=80=94=20DNS?=
 =?UTF-8?q?,=20rate=20limiter,=20version=20sync?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- VERSION: bump from 1.14.4 to 1.14.6 to match package.json (HEAD had stale value)
- middleware.js: apply existing totpLimiter (10/15min) to /totp/setup endpoint
  (was previously unmetered, allowing secret enumeration)
- dashcaddy-update.sh: hook post-deploy-patches.sh into the update flow
  so the container can survive transitions between broken → fixed tarballs
- start.sh: add --add-host flags for get.dashcaddy.net and get2.dashcaddy.net
  so the container can resolve the release server (was failing with ENOTFOUND)
---
 VERSION                                   |  2 +-
 dashcaddy-api/src/utilities/middleware.js |  5 +++++
 scripts/dashcaddy-update.sh               | 15 +++++++++++++++
 start.sh                                  |  2 ++
 4 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 4e00d0a..c6ba3bc 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.14.4
+1.14.6
diff --git a/dashcaddy-api/src/utilities/middleware.js b/dashcaddy-api/src/utilities/middleware.js
index 2a8c660..aacb6fb 100644
--- a/dashcaddy-api/src/utilities/middleware.js
+++ b/dashcaddy-api/src/utilities/middleware.js
@@ -473,6 +473,11 @@ module.exports = function configureMiddleware(app, {
   });
   app.use('/api/v1/totp/verify', totpLimiter);
   app.use('/api/v1/totp/verify-setup', totpLimiter);
+  // /totp/setup was previously unmetered — an attacker could enumerate
+  // secrets or DoS the QR generator. Apply the same 10/15min limit as the
+  // other TOTP endpoints. The standardHeaders config above emits
+  // RateLimit-Limit / RateLimit-Remaining for clients to see.
+  app.use('/api/v1/totp/setup', totpLimiter);
 
   // ── Audit logging middleware (logs non-GET API requests) ──
   app.use(auditLogger.middleware());
diff --git a/scripts/dashcaddy-update.sh b/scripts/dashcaddy-update.sh
index b6de496..2980442 100755
--- a/scripts/dashcaddy-update.sh
+++ b/scripts/dashcaddy-update.sh
@@ -306,6 +306,21 @@ main() {
     echo "$commit" > "$api_source_dir/VERSION"
   fi
 
+  # 3a. Apply post-deploy patches — fix upstream bugs in released tarballs
+  # (e.g. v1.14.4 has broken require paths and missing license-keygen module).
+  # Runs AFTER staging copy, BEFORE docker build. Idempotent.
+  local patch_script="/opt/dashcaddy/scripts/dashcaddy-post-deploy-patches.sh"
+  if [[ -x "$patch_script" ]]; then
+    log "Applying post-deploy patches..."
+    if "$patch_script" "$api_source_dir"; then
+      log "Post-deploy patches applied successfully"
+    else
+      log "WARNING: Post-deploy patches exited non-zero — continuing build anyway"
+    fi
+  else
+    log "NOTE: $patch_script not found or not executable — skipping post-deploy patches"
+  fi
+
   # 3b. Sync frontend
   if [[ -z "$frontend_staging_dir" ]]; then
     parent_staging=$(dirname "$staging_dir")
diff --git a/start.sh b/start.sh
index 22333b3..289a0d3 100755
--- a/start.sh
+++ b/start.sh
@@ -22,6 +22,8 @@ fi
 
 echo "[start.sh] Creating container with full config..."
 docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
+  --add-host=get.dashcaddy.net:194.233.88.206 \
+  --add-host=get2.dashcaddy.net:194.233.88.206 \
   --dns ${DNS_PRIMARY} \
   --dns ${DNS_FALLBACK} \
   -p 127.0.0.1:3001:3001 \