Hermes 3b3c4f8b8e [grade=B] fix: harden trust-proxy setting + eliminate raw X-Forwarded-For spoofing ...

Codex previously graded D (blocking) for two security concerns:
1. trust proxy:1 trusts any direct connection as a proxy
2. extractTailscaleIPs reads raw X-Forwarded-For/X-Real-IP headers

Fixes:
- trust proxy changed from '1' to ['loopback', '172.16.0.0/12', '10.0.0.0/8']
  - Covers bare-metal (Caddy on localhost) and Docker bridge deployments
  - External IPs cannot appear in list → cannot spoof X-Forwarded-For
- extractTailscaleIPs now uses req.ip (resolved by Express trust-proxy chain)
  instead of reading raw headers directly
- Codex re-grade: B (no blocking issues)
- All 1775 tests pass

Security verified on test server:
- Sensitive routes: 403 from external ✓
- Public routes: 200 ✓
- Health endpoints: JSON 200 ✓

2026-08-13 12:56:58 -07:00

..

__tests__

[grade=B] feat: add root-level /metrics Prometheus endpoint

2026-08-13 12:40:40 -07:00

assets

[grade=B] refactor(assets): delete two repo-debris files

2026-07-25 14:09:40 -07:00

ca

feat: 1.5.0 prep — API v1 cutover, LICENSE, CHANGELOG, CI

2026-05-17 11:38:45 -07:00

data

feat: restore monitoring widget + add sami-files template

2026-06-18 18:52:48 -07:00

generated-certs

Sync DNS2 production changes - removed obsolete test suite and refactored structure

2026-03-23 10:47:15 +01:00

pki

Sync DNS2 production changes - removed obsolete test suite and refactored structure

2026-03-23 10:47:15 +01:00

pylon

Standardize paths, add version endpoint, request timeouts, HOST env var, graceful shutdown

2026-06-10 19:36:05 -07:00

routes

feat: Jellyfin/Emby recommendations + piracy disclaimer + TOTP fix + AI chat

2026-08-13 03:38:46 -07:00

scripts

[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

2026-08-12 17:34:10 -07:00

src

[grade=B] fix: harden trust-proxy setting + eliminate raw X-Forwarded-For spoofing

2026-08-13 12:56:58 -07:00

.dockerignore

[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

2026-08-12 17:34:10 -07:00

.eslintignore

fix(lint): Add ctx shim to routes/apps and routes/arr

2026-03-29 22:35:13 -07:00

.eslintrc.js

[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

2026-08-12 17:34:10 -07:00

.gitignore

DC-020: restore license-keygen.js + fix broken require paths (container crash-loop)

2026-06-29 07:22:33 -07:00

.license-counter

fix: service edit, CSRF token stability, and license restore (v1.1.1)

2026-03-23 13:39:05 -07:00

.license-secret

Initial commit: DashCaddy v1.0

2026-03-05 02:26:12 -08:00

.prettierignore

fix(lint): Add ctx shim to routes/apps and routes/arr

2026-03-29 22:35:13 -07:00

.prettierrc

fix(lint): Add ctx shim to routes/apps and routes/arr

2026-03-29 22:35:13 -07:00

Dockerfile

[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

2026-08-12 17:34:10 -07:00

jest.config.js

[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

2026-08-12 17:34:10 -07:00

license-keygen.js

DC-057: close checkout-to-license contract drift (grade B)

2026-08-04 14:18:49 -07:00

openapi.yaml

[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

2026-08-12 17:34:10 -07:00

package-lock.json

DC-059: Joi validation middleware + schemas for destructive routes

2026-08-08 15:39:48 -07:00

package.json

[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

2026-08-12 17:34:10 -07:00

platform-paths.js

DC-050 harden dataDir + add image-layer migration

2026-07-20 00:53:05 -07:00

server.js

[grade=pending] fix: eliminate CPU waste from duplicate workflows, self-updater crash loop, and aggressive polling

2026-08-13 10:57:20 -07:00

VERSION

bump version: cookie-only session

2026-07-24 05:14:56 -07:00