4 Commits

Include renames

Author	SHA1	Message	Date
Krystie	95f558c49f	DC-030: bake /etc/hosts overrides into start.sh (fix git.sami resolution in container) ... The container's health-checker runs against Caddy via /etc/hosts resolution. The node:20-alpine base image has no entries for *.sami, so without explicit --add-host flags every *.sami probe resolves via the configured DNS server (100.121.150.22 Technitium or 8.8.8.8) — both of which DO resolve *.sami but return the WAN/Tailscale IP. That works for most services because Caddy on DNS2:443 handles them. BUT: a previous container run passed --add-host=git.sami:100.81.59.99 (DNS3's Tailscale IP). DNS3 does NOT serve HTTPS on 443 — Gitea listens on :3030 only. So git.sami health checks inside the container hit DNS3:443, get ECONNREFUSED, and the dashboard shows git.sami as down even though Caddy on DNS2:443 correctly routes git.sami → 100.81.59.99:3030. Fix: inject the correct --add-host flags from start.sh (the source of truth for container setup) so future recreates get consistent resolution. git.sami is intentionally left OUT — Caddy on DNS2:443 is the only correct ingress for git.sami traffic. Also documents the rationale so the next person doesn't reintroduce the git.sami override by accident. Live verified: - container /etc/hosts has all needed entries except git.sami - curl https://git.sami/ from inside container → 200 (via Caddy on :443) - curl https://sync.sami/ from inside container → 302 (upstream redirect) - curl https://router.sami/ from inside container → 302 (upstream redirect)	2026-07-03 00:08:55 -07:00
Krystie	fef7e07b49	DC-026/027/028: close 3 more auth security holes + rate limit /auth/* + audit credential exposures ... [DC-026] routes/auth/sso-gate.js — fix sessionDuration='never' bypass Both /auth/gate/:serviceId and /auth/app-token/:serviceId had a session check gated on `sessionDuration !== 'never'`. An admin setting TOTP to never-expire accidentally created an authentication-free path to credential injection (Basic Auth, X-Api-Key, Plex/Prowlarr tokens). Patched: session required whenever TOTP is enabled, period. Added 8 regression tests. [DC-027] src/utilities/middleware.js — rate limit /auth/* New authLimiter (20 req / 15 min) on /auth/keys, /auth/jwt, /auth/gate, /auth/app-token. These endpoints expose credentials and were unmetered. Without this, an attacker with a guessed session cookie could burn through every credential-touching endpoint. Added 5 tests. [DC-028] src/security/audit-logger.js — log credential exposures /auth/gate and /auth/app-token were in SKIP_PATHS, silently dropping every credential-exposure event from the audit log. Combined with the GET-skip rule, NONE of these events were being recorded. Now logged with named actions: auth.credential-injection, auth.app-token-issue, auth.api-key-generate, auth.api-key-revoke, auth.jwt-mint. Added 9 tests. [start.sh] Disable in-container self-updater DASHCADDY_UPDATE_ENABLED=false. Without this, the container kept writing trigger.json every 30 min and clobbered my in-progress host edits. The path unit on the host is still active for manual triggers, but the container won't auto-update itself — only when an admin clicks the update button or a new release is manually published. [package.json] Bump to 1.14.7 Test results: 1066/1066 passing across 39 suites (added 22 new tests).	2026-07-01 04:20:57 -07:00
Krystie	a5f51e4a0c	DC-023: operational fixes — DNS, rate limiter, version sync ... - VERSION: bump from 1.14.4 to 1.14.6 to match package.json (HEAD had stale value) - middleware.js: apply existing totpLimiter (10/15min) to /totp/setup endpoint (was previously unmetered, allowing secret enumeration) - dashcaddy-update.sh: hook post-deploy-patches.sh into the update flow so the container can survive transitions between broken → fixed tarballs - start.sh: add --add-host flags for get.dashcaddy.net and get2.dashcaddy.net so the container can resolve the release server (was failing with ENOTFOUND)	2026-07-01 03:10:53 -07:00
Krystie	44af47d344	feat: add Sami Files logPath to template + mount in start.sh	2026-06-19 18:16:34 -07:00