bvandeusenandClaude Opus 5.5
dbd6d5b8b5
CI & Build / Python lint (push) Successful in 2s
CI & Build / Plugin hooks (push) Successful in 11s
CI & Build / TypeScript typecheck (push) Successful in 37s
CI & Build / Python tests (push) Failing after 1m20s
CI & Build / integration (push) Successful in 2m27s
CI & Build / Build & push image (push) Skipped
grimoire/proxy.py is the one reader of X-Forwarded-For and X-Forwarded-Proto. It takes the entry TRUSTED_PROXY_HOPS in from the right (default 1; a shorter header reads its leftmost entry; 0 trusts no proxy), so an entry a client puts left of the proxy's is never believed. Before this, with TRUST_PROXY_HEADERS on, the leftmost X-Forwarded-For entry keyed the login, register, forgot and reset rate limits and the audit log, and a client could choose it. The session cookie is Secure, and HSTS (max-age=31536000) is sent, exactly when the request is HTTPS by the trusted proxy's word. Plain HTTP is untouched and nothing redirects. SECURE_COOKIES is gone (a startup warning says so when it is still set); TRUST_PROXY_HEADERS=false still maps to 0 hops, with a warning to move to TRUSTED_PROXY_HOPS. Admin audit lines now use the same client address instead of the socket peer. The placeholder-key refusal keyed on SECURE_COOKIES, so it now refuses either placeholder key outright; the instance makes its own key when none is set. Family idea #5004 (IsHTTPS, trusted-hop X-Forwarded-Proto), canon v2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
services:
|
|
app:
|
|
image: git.fabledsword.com/bvandeusen/fabledgrimoire:latest
|
|
environment:
|
|
DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-grimoire}:${DB_PASSWORD}@db:5432/${POSTGRES_DB:-grimoire}"
|
|
# A Swarm can start the app on another node, away from the key kept in
|
|
# a node-local /data volume, so a stack sets its key itself (or mounts
|
|
# a Docker secret and sets SECRET_KEY_FILE to its path).
|
|
SECRET_KEY: "${SECRET_KEY}"
|
|
LOG_LEVEL: "${LOG_LEVEL:-INFO}"
|
|
# Proxies in front of the app (Traefik = 1). The client address and
|
|
# HTTPS are read from that far in from the right of X-Forwarded-*.
|
|
TRUSTED_PROXY_HOPS: "1"
|
|
volumes:
|
|
- app_data:/data
|
|
networks:
|
|
- backend
|
|
|
|
db:
|
|
# Postgres 17 with the vector extension Grimoire needs.
|
|
image: pgvector/pgvector:pg17
|
|
stop_grace_period: 120s
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-grimoire}
|
|
POSTGRES_PASSWORD: "${DB_PASSWORD}"
|
|
POSTGRES_DB: ${POSTGRES_DB:-grimoire}
|
|
networks:
|
|
- backend
|
|
|
|
volumes:
|
|
pgdata:
|
|
name: ${PGDATA_VOLUME:-grimoire_pgdata}
|
|
app_data:
|
|
|
|
networks:
|
|
backend:
|
|
driver: overlay
|