sami7777/dashcaddy
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

P7 Private Network (DC-140..DC-154 + judge fixes) #1

Merged
sami7777 merged 56 commits from p7-wave1 into main 2026-10-04 11:04:25 +02:00
Conversation 0 Commits 56 Files Changed 58
+16670 -9
sami7777 commented 2026-10-04 11:04:14 +02:00
Owner
Copy link
Copy source

Spec judged B; implementation judged A (r18, urn:ump:rgxdivsp2xf6zy5lsdoclvdgb7cuqd3qpwlszt2p7fu7xwa3zkkq). 30 commits, 58 files, +16,670. Full suite 3,399/3,399 (base 2,880).

Spec judged B; implementation judged A (r18, urn:ump:rgxdivsp2xf6zy5lsdoclvdgb7cuqd3qpwlszt2p7fu7xwa3zkkq). 30 commits, 58 files, +16,670. Full suite 3,399/3,399 (base 2,880).
sami7777 added 56 commits 2026-10-04 11:04:15 +02:00
P7 Private Network lane: product spec (Tailscale v1 + WireGuard self-hosted) + backlog tickets DC-140..DC-152 420fa2ba2a
DC-145: access map store (grants, effective access, change events) + /network/access routes + tests 09152dfde2
DC-141: people store (atomic JSON) + /network/people routes + last-admin guard + tests 4b560b9c40
P7 spec rev2: honest unblock semantics, WG addressing/keygen model (browser-side keygen, CIDR AllowedIPs), ticket-set fixes 2e6d535242
DC-140: network provider abstraction (src/network/) + tailscale provider + registry + tests 7ef3914730
Merge branch 'dc/DC-141' into dc/DC-148 5e03f120b4
Merge branch 'dc/DC-140' into dc/DC-148 b7df8f5fe0
merge dc/DC-140 into p7-wave1 45a2b6b07c
merge dc/DC-141 into p7-wave1 d3c1dfd996
merge dc/DC-145 into p7-wave1 26f4aa8ad0
Merge branch 'dc/DC-140' into dc/DC-143 2452bebfc9
Merge branch 'dc/DC-141' into dc/DC-143 5d786afcce
Merge branch 'dc/DC-145' into dc/DC-143 c09fc7b1ef
Merge branch 'dc/DC-140' into dc/DC-142 806d720af6
Merge branch 'dc/DC-141' into dc/DC-142 b2c70a0323
Merge branch 'dc/DC-145' into dc/DC-142 a78d0ef857
P7 spec rev3: X25519-only browser keygen (no ECDSA fallback), unblock row + honest semantics everywhere, three-zone WG firewall model 6e25001738
P7 spec rev3: X25519-only browser keygen (no ECDSA fallback), unblock row + honest semantics everywhere, three-zone WG firewall model 5f47e12f18
merge spec rev3 into p7-wave1 a8183459e7
DC-148: Tailscale ACL compiler + lockout guard + preview/push/rollback + drift detection + tests 486d0e8d11
merge dc/DC-148 into p7-wave1 97de94d496
DC-143: block/unblock/remove person + revoke device orchestration + tests 4e4306b00f
P7 spec rev4: pin provider-contract unblock wording, PKCS8-prefix X25519 private-key extraction, DC-143 authorization-vs-key-expiry distinction a4f961d609
DC-149: WireGuard hub provider (peer store, pool allocator, hub lifecycle) + tests fcfe5dff1b
DC-142: link-first invites routes via network provider + tests 88d34c6d7e
merge dc/DC-143 into p7-wave1 b7d9e2b983
merge dc/DC-149 into p7-wave1 151b42e0ea
merge dc/DC-142 into p7-wave1 f7c5ff1d0b
DC-151: WG nftables matrix compiler + transactional apply/rollback + tests 24ec88a30d
DC-144: DashCaddy-side groups + resources model/routes with cascade delete + tests 695794987b
merge dc/DC-151 into p7-wave1 3291f80d0c
merge dc/DC-144 into p7-wave1 de6a2fa4ae
DC-146: Technitium zone/record sync (idempotent upserts) + split-DNS gate + setup check + tests 9215037553
DC-150: WG invite redemption page (browser X25519 keygen, client-side config+QR) + public redeem API + tests b4e683a7fc
DC-147: named root CA with critical name constraints, leaf compliance assertions, install-page hardening, encrypted backup + tests d224a24566
merge dc/DC-146 into p7-wave1 c12bff597b
DC-152: Private Network setup wizard (mode/domain/connect/dns/ca/admin steps) + status API + tests 38af7ba224
merge dc/DC-147 into p7-wave1 178a2fbb9f
merge dc/DC-152 into p7-wave1 ae78e2e318
P7 integration: mount network routers (people/access/invites/lifecycle/groups/resources/wizard) with shared stores + lazy lifecycle proxy a443f030c0
P7 spec rev5: DC-150 ticket X25519-only (remove ECDSA fallback contradiction) a39602afe5
merge spec rev5 into p7-wave1 e8ef2a089b
merge dc/DC-150 into p7-wave1 5bcf4e99ee
merge dc/mount (network router mounts) into p7-wave1 2f14936970
P7: mount public WG invite redemption route (lazy provider, 503 when not wireguard) 88f7600693
DC-154: forward_auth enforcement endpoint (whois + access map + sensitive step-up) + tests aac2343df3
merge dc/DC-154 into p7-wave1 32998fe4b8
DC-153: provider.syncAccess enforcement wiring (tailscale ACL push + wireguard nftables apply) + contract tests 44567031eb
merge dc/DC-153 into p7-wave1 a5ef5b345e
P7 r2 fixes: drift guard wired through pushIfNoDrift (acl_drift_detected ProviderError, never overwrites drifted remote) + unknown-device forward_auth audit + drift regression tests d2d0d73477
P7 r3 fix: single-preview contract (syncAccess delegates drift-check+preview+push to pushIfNoDrift; acl_preview_failed mapped non-retryable) + test updates 1e606bf0f3
P7 r8 fix: forward_auth trust boundary (XFF/XFH honored only from trusted proxy; direct/spoofed requests use socket identity) + adversarial tests d4973f3af3
P7 r8 fixes: lazy mounts catch ProviderNotActiveError (503 not 500), wg redeem added to PUBLIC_ROUTES (redemption is sessionless), live-curl probe script 2e651bd84e
P7 live probes: real-HTTP transcripts for forward_auth (inactive 503; active: allow/deny/unknown-device/step-up) via seeded real stores + registry stub provider af0d6b2fe5
P7 r9: probes isolated (DATA_DIR tmp), self-authenticating (git stamp + asserts), try/finally cleanup, explicit exit 51ba85fc69
P7 r10: probes assert expected head + every outcome (nonzero exit on mismatch); phase-2 rejection-path cleanup guaranteed
CI / Security audit (pull_request) Canceled after 0s
Details
CI / Test & Lint (pull_request) Canceled after 0s
Details
75a0385c38
sami7777 merged commit e04787477a into main 2026-10-04 11:04:25 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
sami7777
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sami7777/dashcaddy#1