bvandeusenandClaude Opus 5.5
7a3f7869fe
#5035 "Sessions: lifetime applied, role and is_active re-read per request, logout is a POST, failed logins throttled". - steward/core/proxy.py: trusted_value / is_https / client_ip read X-Forwarded-Proto and -For only as far as the trusted proxy hops (Settings → General, default 1, 0 = trust none). - The session cookie is Secure, and HSTS is sent, only on requests that arrived over HTTPS by that rule; plain-HTTP and LAN use are unchanged and nothing redirects. - A login lasts Settings → General's session lifetime from when it began (session.permanent + a login_at stamp checked every request — the cookie's own age slides on every response). A deleted or deactivated user is logged out on their next request; a role change applies at once. - Logout is a POST (a form in the sidebar); GET /logout is gone. - Failed logins pause an address after login.max_failures within login.lockout_minutes (Settings → General; defaults 5 in 15 min), keyed by address so nobody can lock a user out by name. Failures are audited as auth.login_failed with the address. - to_access_cfg projects the new settings into app.config at startup and on save, beside the existing projections. - Integration tests seed real users and a login_at, since every request now re-reads the session's user. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
3.9 KiB
HTML
76 lines
3.9 KiB
HTML
{# steward/templates/settings/general.html #}
|
|
{% extends "base.html" %}
|
|
{% block title %}Settings — General — Steward{% endblock %}
|
|
{% block content %}
|
|
{% set active_tab = "general" %}
|
|
{% include "settings/_tabs.html" %}
|
|
|
|
<form method="post" action="/settings/general/">{{ csrf_field() }}
|
|
<div class="card" style="max-width:640px;">
|
|
<h2 class="section-title" style="margin-bottom:1.25rem;">General</h2>
|
|
|
|
<div class="form-group">
|
|
<label>Public base URL</label>
|
|
<input type="text" name="general.public_base_url"
|
|
value="{{ settings['general.public_base_url'] }}"
|
|
placeholder="https://monitor.example.com">
|
|
<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">
|
|
External URL where this Steward instance is reachable from the outside.
|
|
Leave blank to use whatever hostname you're currently browsing via.
|
|
Used by install scripts, share links, and alert notifications.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Trusted reverse proxies</label>
|
|
<input type="number" name="general.trusted_proxy_hops" min="0" max="5"
|
|
value="{{ settings['general.trusted_proxy_hops'] }}" style="max-width:120px;">
|
|
<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">
|
|
How many proxies sit in front of Steward (e.g. 1 for Traefik, 2 for Cloudflare in front of Traefik).
|
|
Steward believes their X-Forwarded-For and X-Forwarded-Proto headers up to that many hops: it marks
|
|
the login cookie Secure and sends HSTS only when they report HTTPS, and throttles logins by the address
|
|
they report. 0 trusts no proxy.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Session lifetime <span style="color:var(--text-muted);font-size:0.8rem;">(hours)</span></label>
|
|
<input type="number" name="session.lifetime_hours" min="1" max="720"
|
|
value="{{ settings['session.lifetime_hours'] }}" style="max-width:120px;">
|
|
<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">A login lasts this long; then Steward asks for the password again.</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Failed logins before a pause</label>
|
|
<div style="display:flex;gap:0.5rem;align-items:center;flex-wrap:wrap;">
|
|
<input type="number" name="login.max_failures" min="1" max="100"
|
|
value="{{ settings['login.max_failures'] }}" style="max-width:90px;">
|
|
<span style="font-size:0.85rem;color:var(--text-muted);">failures from one address pause its logins for</span>
|
|
<input type="number" name="login.lockout_minutes" min="1" max="1440"
|
|
value="{{ settings['login.lockout_minutes'] }}" style="max-width:90px;">
|
|
<span style="font-size:0.85rem;color:var(--text-muted);">minutes</span>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Data retention <span style="color:var(--text-muted);font-size:0.8rem;">(days)</span></label>
|
|
<input type="number" name="data.retention_days" min="1"
|
|
value="{{ settings['data.retention_days'] }}" style="max-width:120px;">
|
|
<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">Old ping/DNS results older than this are pruned by the cleanup job.</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Monitor poll interval <span style="color:var(--text-muted);font-size:0.8rem;">(seconds)</span></label>
|
|
<input type="number" name="monitors.poll_interval_seconds" min="10"
|
|
value="{{ settings['monitors.poll_interval_seconds'] }}" style="max-width:120px;">
|
|
<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">Requires restart to take effect.</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div style="margin-top:1rem;display:flex;align-items:center;gap:1rem;">
|
|
<button type="submit" class="btn">Save</button>
|
|
<span style="font-size:0.82rem;color:var(--text-muted);">Changes to session lifetime take effect immediately.</span>
|
|
</div>
|
|
</form>
|
|
{% endblock %}
|