8 Commits

Include renames

Author	SHA1	Message	Date
Hermes	bda08b592e	fix: idempotent Caddy subpath config, increase Docker pull timeout to 120s, extend health check to 60s ... - helpers.js: treat 'No changes to apply' as success (config already exists = idempotent) - constants.js: Docker pull timeout 30s → 120s (large images need more time) - deploy.js: health check 40s → 60s (some apps like filebrowser are slow to start)	2026-06-10 16:43:34 -07:00
Krystie	0c658a26a8	fix(routes): complete post-refactor dependency wiring cleanup	2026-05-04 16:44:18 -07:00
SamiandClaude Opus 4.6	f865790fe1	fix(routes): restore ctx access in 15 route files broken by Phase 2.1 refactor ... The modular refactor changed function signatures to destructured deps but left internal ctx.* references intact, causing "ctx is not defined" errors on /api/config, /api/logo, and many other endpoints. Also implements loadTotpConfig and saveTotpConfig which were left as stubs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-30 03:01:29 -07:00
Krystie	a4788c3f28	Refactor apps routes: explicit dependency injection ... - Updated all apps route modules to use destructured dependencies - Added JSDoc comments for factory functions - Replaced ctx. references with direct parameter access - Updated apps/index.js to extract and pass explicit dependencies - All files pass syntax validation Files refactored: - routes/apps/deploy.js (18k lines) - routes/apps/helpers.js (17k lines) - routes/apps/removal.js - routes/apps/restore.js - routes/apps/templates.js - routes/apps/index.js (orchestrator)	2026-03-29 21:36:15 -07:00
SamiandClaude Opus 4.6	59b6d7d360	Fix 16 HIGH/MEDIUM security bugs across API ... HIGH fixes: - TOTP disable now requires valid code verification - TOTP secret removed from plaintext file storage - Container ID validated before update/check-update/logs operations - DNS server parameter restricted to configured servers (SSRF prevention) - Backup export no longer includes encryption key - Backup restore of sensitive files requires TOTP re-authentication MEDIUM fixes: - Session cookie Secure flag added - Caddy reload errors no longer leaked to client - saveConfig uses atomic locked updates via configStateManager - Log file path traversal prevented via symlink resolution - Credential cache entries now expire after 5 minutes - _httpFetch enforces 10MB response size limit - External URL path injection into Caddyfile blocked - Custom volume host paths validated against allowed roots - Error logs endpoint no longer returns stack traces - Logo delete path traversal prevented via path.basename() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 00:15:28 -08:00
SamiandClaude Opus 4.6	6979302fb7	Fix 7 critical security bugs and 1 high-severity data loss bug ... - CSRF: HMAC-signed double-submit cookie (server-bound, not raw compare) - Keychain: execFileSync with arg arrays to prevent command injection - Caddy config: always use structured generation, never accept raw config - Templates: replace {{GENERATED_SECRET}} with crypto.randomBytes - Caddyfile removal: move regex inside ctx.caddy.modify() to fix TOCTOU race - Credentials: proper-lockfile for all file operations, fix key rotation to decrypt with old key before generating new key - Service removal: filter by ID only, not AND with appTemplate Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-06 23:08:30 -08:00
SamiandClaude Opus 4.6	77030931b7	Add subdirectory routing mode for public domain deployments ... Apps can now be served at domain.com/appname/ instead of requiring subdomain DNS records (appname.domain.com). Supports three subpath modes per template: native (URL base env var), strip (handle_path), and none (incompatible warning). Tested on Linux with deploy/removal lifecycle verified. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-06 03:03:17 -08:00
Sami	f61e85d9a7	Initial commit: DashCaddy v1.0 ... Full codebase including API server (32 modules + routes), dashboard frontend, DashCA certificate distribution, installer script, and deployment skills.	2026-03-05 02:26:12 -08:00