sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
87 Commits 1 Branch 0 Tags
188bcfbda02d42bc2d13d133730f2782a90a6dec
Commit Graph

6 Commits

Author SHA1 Message Date
Sami
188bcfbda0 fix: exempt dashboard-critical endpoints from rate limiter 
License status, services list, config, and license feature checks
were being rate-limited (429) after ~14 minutes of dashboard polling,
causing the license to show FREE TIER and services to fail loading.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-31 18:45:25 -07:00
Sami
6c3848102b refactor: Phase 1 code cleanup - constants, logging, and repository organization 2026-03-28 18:54:39 -07:00
Sami
6d098fd96f Exempt DNS logs from rate limiting and hide Tokens button when no DNS configured 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-17 19:31:12 -07:00
Sami
f2f33b4b40 Make DNS servers fully dynamic from config.json 
DNS server IDs (dns1, dns2, dns3) were hardcoded throughout the frontend
and backend. Now config.json's dnsServers object is the single source of
truth — adding or removing a DNS server in config automatically updates
the dashboard cards, credential modal, health checks, and probes.

- credentials.js: rebuild modal sections dynamically from SITE.dnsServers
- globals.js: add getPrimaryDnsId() helper for primary DNS lookups
- service-create.js, service-infrastructure.js: use dynamic DNS ID
- startup-validator.js: dynamic topCardServices from config
- middleware.js: add license endpoints to public routes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-17 16:55:07 -07:00
Sami
59b6d7d360 Fix 16 HIGH/MEDIUM security bugs across API 
HIGH fixes:
- TOTP disable now requires valid code verification
- TOTP secret removed from plaintext file storage
- Container ID validated before update/check-update/logs operations
- DNS server parameter restricted to configured servers (SSRF prevention)
- Backup export no longer includes encryption key
- Backup restore of sensitive files requires TOTP re-authentication

MEDIUM fixes:
- Session cookie Secure flag added
- Caddy reload errors no longer leaked to client
- saveConfig uses atomic locked updates via configStateManager
- Log file path traversal prevented via symlink resolution
- Credential cache entries now expire after 5 minutes
- _httpFetch enforces 10MB response size limit
- External URL path injection into Caddyfile blocked
- Custom volume host paths validated against allowed roots
- Error logs endpoint no longer returns stack traces
- Logo delete path traversal prevented via path.basename()

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 00:15:28 -08:00
Sami
f61e85d9a7 Initial commit: DashCaddy v1.0 
Full codebase including API server (32 modules + routes), dashboard frontend,
DashCA certificate distribution, installer script, and deployment skills.
 2026-03-05 02:26:12 -08:00