bvandeusenandClaude Opus 5.5
dbd6d5b8b5
CI & Build / Python lint (push) Successful in 2s
CI & Build / Plugin hooks (push) Successful in 11s
CI & Build / TypeScript typecheck (push) Successful in 37s
CI & Build / Python tests (push) Failing after 1m20s
CI & Build / integration (push) Successful in 2m27s
CI & Build / Build & push image (push) Skipped
grimoire/proxy.py is the one reader of X-Forwarded-For and X-Forwarded-Proto. It takes the entry TRUSTED_PROXY_HOPS in from the right (default 1; a shorter header reads its leftmost entry; 0 trusts no proxy), so an entry a client puts left of the proxy's is never believed. Before this, with TRUST_PROXY_HEADERS on, the leftmost X-Forwarded-For entry keyed the login, register, forgot and reset rate limits and the audit log, and a client could choose it. The session cookie is Secure, and HSTS (max-age=31536000) is sent, exactly when the request is HTTPS by the trusted proxy's word. Plain HTTP is untouched and nothing redirects. SECURE_COOKIES is gone (a startup warning says so when it is still set); TRUST_PROXY_HEADERS=false still maps to 0 hops, with a warning to move to TRUSTED_PROXY_HOPS. Admin audit lines now use the same client address instead of the socket peer. The placeholder-key refusal keyed on SECURE_COOKIES, so it now refuses either placeholder key outright; the instance makes its own key when none is set. Family idea #5004 (IsHTTPS, trusted-hop X-Forwarded-Proto), canon v2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.3 KiB
YAML
41 lines
1.3 KiB
YAML
# Fabled Grimoire: the app and its database.
|
|
# docker compose up -d
|
|
# Then open http://localhost:5000. The first account registered becomes admin.
|
|
#
|
|
# Keep both volumes. app_data holds the instance's own SECRET_KEY, which seals
|
|
# saved credentials; pgdata holds everything else.
|
|
|
|
services:
|
|
app:
|
|
image: git.fabledsword.com/bvandeusen/fabledgrimoire:latest
|
|
ports:
|
|
- "5000:5000"
|
|
environment:
|
|
DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-grimoire}:${POSTGRES_PASSWORD:-grimoire}@db:5432/${POSTGRES_DB:-grimoire}"
|
|
LOG_LEVEL: "${LOG_LEVEL:-INFO}"
|
|
# Port 5000 is published straight to clients, so no proxy is trusted.
|
|
# Behind a reverse proxy, set 1 (one per proxy) and BASE_URL:
|
|
TRUSTED_PROXY_HOPS: "0"
|
|
# BASE_URL: "https://grimoire.example.com"
|
|
volumes:
|
|
- app_data:/data
|
|
depends_on:
|
|
- db
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
# Postgres 17 with the vector extension Grimoire needs.
|
|
image: pgvector/pgvector:pg17
|
|
stop_grace_period: 120s
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-grimoire}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-grimoire}
|
|
POSTGRES_DB: ${POSTGRES_DB:-grimoire}
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
app_data:
|
|
pgdata:
|