sami7777/dashcaddy
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
634 Commits 43 Branches 13 Tags
75a0385c38b8f78183e36f75e464ef71656a0ae2
Commit Graph
450 Commits
Author SHA1 Message Date
Hermes 75a0385c38 P7 r10: probes assert expected head + every outcome (nonzero exit on mismatch); phase-2 rejection-path cleanup guaranteed
CI / Test & Lint (pull_request) Canceled after 0s
Details
CI / Security audit (pull_request) Canceled after 0s
Details
2026-10-04 00:07:56 -07:00
Hermes 51ba85fc69 P7 r9: probes isolated (DATA_DIR tmp), self-authenticating (git stamp + asserts), try/finally cleanup, explicit exit 2026-10-03 23:47:43 -07:00
Hermes af0d6b2fe5 P7 live probes: real-HTTP transcripts for forward_auth (inactive 503; active: allow/deny/unknown-device/step-up) via seeded real stores + registry stub provider 2026-10-03 23:39:01 -07:00
Hermes 2e651bd84e P7 r8 fixes: lazy mounts catch ProviderNotActiveError (503 not 500), wg redeem added to PUBLIC_ROUTES (redemption is sessionless), live-curl probe script 2026-10-03 23:34:00 -07:00
Hermes d4973f3af3 P7 r8 fix: forward_auth trust boundary (XFF/XFH honored only from trusted proxy; direct/spoofed requests use socket identity) + adversarial tests 2026-10-03 23:25:23 -07:00
Hermes 1e606bf0f3 P7 r3 fix: single-preview contract (syncAccess delegates drift-check+preview+push to pushIfNoDrift; acl_preview_failed mapped non-retryable) + test updates 2026-10-03 22:55:22 -07:00
Hermes d2d0d73477 P7 r2 fixes: drift guard wired through pushIfNoDrift (acl_drift_detected ProviderError, never overwrites drifted remote) + unknown-device forward_auth audit + drift regression tests 2026-10-03 22:47:27 -07:00
Hermes a5ef5b345e merge dc/DC-153 into p7-wave1 2026-10-03 22:34:32 -07:00
Hermes 44567031eb DC-153: provider.syncAccess enforcement wiring (tailscale ACL push + wireguard nftables apply) + contract tests 2026-10-03 22:34:02 -07:00
Hermes aac2343df3 DC-154: forward_auth enforcement endpoint (whois + access map + sensitive step-up) + tests 2026-10-03 22:30:23 -07:00
Hermes 88f7600693 P7: mount public WG invite redemption route (lazy provider, 503 when not wireguard) 2026-10-03 22:08:52 -07:00
Hermes 2f14936970 merge dc/mount (network router mounts) into p7-wave1 2026-10-03 22:08:44 -07:00
Hermes 5bcf4e99ee merge dc/DC-150 into p7-wave1 2026-10-03 22:05:39 -07:00
Hermes a443f030c0 P7 integration: mount network routers (people/access/invites/lifecycle/groups/resources/wizard) with shared stores + lazy lifecycle proxy 2026-10-03 21:52:14 -07:00
Hermes ae78e2e318 merge dc/DC-152 into p7-wave1 2026-10-03 21:49:08 -07:00
Hermes 178a2fbb9f merge dc/DC-147 into p7-wave1 2026-10-03 21:48:27 -07:00
Hermes 38af7ba224 DC-152: Private Network setup wizard (mode/domain/connect/dns/ca/admin steps) + status API + tests 2026-10-03 21:47:34 -07:00
Hermes c12bff597b merge dc/DC-146 into p7-wave1 2026-10-03 21:47:32 -07:00
Hermes d224a24566 DC-147: named root CA with critical name constraints, leaf compliance assertions, install-page hardening, encrypted backup + tests 2026-10-03 21:43:11 -07:00
Hermes b4e683a7fc DC-150: WG invite redemption page (browser X25519 keygen, client-side config+QR) + public redeem API + tests 2026-10-03 21:40:09 -07:00
Hermes 9215037553 DC-146: Technitium zone/record sync (idempotent upserts) + split-DNS gate + setup check + tests 2026-10-03 21:39:33 -07:00
Hermes de6a2fa4ae merge dc/DC-144 into p7-wave1 2026-10-03 21:38:34 -07:00
Hermes 3291f80d0c merge dc/DC-151 into p7-wave1 2026-10-03 21:37:39 -07:00
Hermes 695794987b DC-144: DashCaddy-side groups + resources model/routes with cascade delete + tests 2026-10-03 21:37:13 -07:00
Hermes 24ec88a30d DC-151: WG nftables matrix compiler + transactional apply/rollback + tests 2026-10-03 21:35:15 -07:00
Hermes f7c5ff1d0b merge dc/DC-142 into p7-wave1 2026-10-03 21:34:22 -07:00
Hermes 151b42e0ea merge dc/DC-149 into p7-wave1 2026-10-03 21:33:37 -07:00
Hermes b7d9e2b983 merge dc/DC-143 into p7-wave1 2026-10-03 21:32:45 -07:00
Hermes 88d34c6d7e DC-142: link-first invites routes via network provider + tests 2026-10-03 21:31:57 -07:00
Hermes fcfe5dff1b DC-149: WireGuard hub provider (peer store, pool allocator, hub lifecycle) + tests 2026-10-03 21:31:09 -07:00
Hermes 4e4306b00f DC-143: block/unblock/remove person + revoke device orchestration + tests 2026-10-03 21:29:41 -07:00
Hermes 486d0e8d11 DC-148: Tailscale ACL compiler + lockout guard + preview/push/rollback + drift detection + tests 2026-10-03 21:26:29 -07:00
Hermes a78d0ef857 Merge branch 'dc/DC-145' into dc/DC-142 2026-10-03 21:23:43 -07:00
Hermes b2c70a0323 Merge branch 'dc/DC-141' into dc/DC-142 2026-10-03 21:23:42 -07:00
Hermes c09fc7b1ef Merge branch 'dc/DC-145' into dc/DC-143 2026-10-03 21:23:14 -07:00
Hermes 5d786afcce Merge branch 'dc/DC-141' into dc/DC-143 2026-10-03 21:23:14 -07:00
Hermes 26f4aa8ad0 merge dc/DC-145 into p7-wave1 2026-10-03 21:20:41 -07:00
Hermes d3c1dfd996 merge dc/DC-141 into p7-wave1 2026-10-03 21:20:40 -07:00
Hermes b7df8f5fe0 Merge branch 'dc/DC-140' into dc/DC-148 2026-10-03 21:20:01 -07:00
Hermes 5e03f120b4 Merge branch 'dc/DC-141' into dc/DC-148 2026-10-03 21:20:00 -07:00
Hermes 7ef3914730 DC-140: network provider abstraction (src/network/) + tailscale provider + registry + tests 2026-10-03 21:16:20 -07:00
Hermes 4b560b9c40 DC-141: people store (atomic JSON) + /network/people routes + last-admin guard + tests 2026-10-03 21:14:20 -07:00
Hermes 09152dfde2 DC-145: access map store (grants, effective access, change events) + /network/access routes + tests 2026-10-03 21:12:35 -07:00
DashCaddy Polish Loop 65a447e27e DC-130 rev3: log.error on unexpected bridge status in /status + test asserting the log call (13 tests green)
CI / Test & Lint (push) Canceled after 0s
Details
CI / Security audit (push) Canceled after 0s
Details
2026-09-14 04:19:55 -07:00
DashCaddy Polish Loop 121caef488 DC-130 rev2: fail-fast bridge bindings (host), /status gateway-error mapping (401/403/unreachable -> 502, probe-failure stays ok:false) + 3 new tests (13 total)
CI / Test & Lint (push) Canceled after 0s
Details
CI / Security audit (push) Canceled after 0s
Details
2026-09-14 04:11:30 -07:00
DashCaddy Polish Loop 1fc61c3fdb DC-130: shipdeck deploys panel — bridge-proxied source deploys (routes + tests, opt-in via SHIPDECK_BRIDGE_URL) 2026-09-14 03:33:31 -07:00
DashCaddy Polish Loop 70e252c8a5 [grade=A urn:ump:seyasvbntxsjibq5jiaqmfowc6xgchwe4jvcc54jd6355ujgm75q] DC-122: self-updater hardening + auto-update on + docker disk discipline (v1.16.0)
CI / Test & Lint (push) Canceled after 0s
Details
CI / Security audit (push) Canceled after 0s
Details 
- _isNewer: same-version releases are never 'newer' (commit labels are
  opaque stamps) — kills the same-version auto-apply regression loop
- _autoCheckAndApply: identical version@sha256 never re-applied
- dashcaddy-update.sh: truthful rollback verdicts (failed rebuild/health
  = exit 1 + failure result), exact frontend snapshot/restore (incl.
  update-introduced owned subtrees), contents-copy cp fallbacks with
  manifest reconciliation, JSON-encoded results/meta/stamp, prune on
  every exit path
- self-updater: frontend-only Linux releases fail loudly (no more silent
  no-op success stuck in 'applying')
- start.sh: DASHCADDY_UPDATE_ENABLED=true (Sami 2026-09-13), json-file
  log caps 10M x3, source->webroot sync via update-stamp contract
- tests: _isNewer regression suite, functional cycle + json/escape suites
  (scripts/test-frontend-cycle.sh, scripts/test-json-escape.sh)

15 judge rounds: C,C,D,D,C,C,D,C,C,C,D,C,A
 2026-09-13 05:32:14 -07:00
DashCaddy Polish Loop 939fdbb68b fix(services): commit deployed sec.sami card addition (staged during last night's deploy, missed the commit) 2026-09-13 05:32:13 -07:00
DashCaddy Polish Loop fad51c81b2 [grade=A] Register sec.sami dashboard in DashCaddy login-page map 
Add 'sec' to the buildLoginPage pages map in sso-gate.js. Without it,
/api/v1/auth/login-page?service=sec returned 404 'Unknown service' — the
TOTP login page is built from a hardcoded per-service map, so adding sec
to services.json (runtime config, gitignored) alone was not enough.

sec needs no app-token (plain web app behind the TOTP gate): after
check-session verifies the session it redirects to /?direct=1, bypassing
the Caddy @needsAutoLogin loop.

Codex grade A (urn:ump:p3jkreyxpqikwt54uxgpl7sybkbsnklbs5kdonq5ejfqyh27udla).
 2026-09-13 05:32:13 -07:00
Hermes c28322eb46 [grade=B] api: fix undeclared 'format' runtime bug in routes/ca.js + 10 lint errors 
- routes/ca.js: declare format before pfx/pem/crt dispatch (was ReferenceError
  on every request that passed validation); add CA_CERT_FORMATS single source
  of truth + hardened format extraction (string-coerce, whitelist)
- routes/caddycode.js: fix upstream-validation regexes (control-char classes)
- routes/logs.js: SSE/validation lint fixes
- routes/openclaw.js: remove useless regex escape in ALLOWED_PATH_RE
- fleet-validation.js + http-caddy-admin-origin test: eslint-disable for
  intentional control-regex security sentinels
- ca-dc076.routes.test.js: regression test for declared format + behavioral
  coverage of format validation (now pre-PKI)

Judge: Qwen lane (qwen3.8-max) grade B, 0 blocking, verdict
/tmp/judge-batch1-verdict.json. API suite 2859/2859 green.
 2026-08-31 23:37:00 -07:00