9 Commits

Include renames

Author	SHA1	Message	Date
eboloandClaude Opus 5	c484014752	Harden the read path, forwarded headers and security docs ... Found while investigating an unrelated Gitea compromise: CaddyManager itself was not involved, but reviewing it turned up three things worth closing. Reading a configuration was the only file operation that did not validate the name. Saving, renaming and deleting all reject `..`, `/` and `\`, so the read path was the one way to leave the configuration directory and pull in any `*.caddy` file on the host. The HTTP API happened to be covered, because GET checks the name against the directory listing first, but the UI calls the service directly and nothing stopped it. Forwarded headers were trusted from any peer. That is correct only while the container port is unreachable except through the proxy; the moment it is published, a caller dictates the scheme, host and client address the app believes in. Loopback and private space cover a proxy on a Docker network or on the host, which is the documented deployment, and ignore everyone else. The README never said that the `X-Api-Key` check guards `/api/*` and nothing else, so the UI - which rewrites Caddyfiles and holds the Docker socket - reads as protected when it is not. It now says so, and warns about the specific shape that bit us: a second hostname added for machine callers whose only extra directive is a `tls` line, which serves the unauthenticated UI to anyone who can resolve it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-12 17:05:52 +07:00
ebolo	9f7cb79bad	feat(api): Add authenticated Caddy management API	2026-07-26 18:34:02 +07:00
ebolo	96f0112449	ci(build): target .NET 10 Alpine with low-memory tuning	2026-07-26 16:15:00 +07:00
ebolo	d0687c9134	feat(docker): Gracefully reload Caddy configuration	2026-07-26 11:39:59 +07:00
ebolo	57a5b0d58d	fix: update README links to point to the new GitHub repository and enhance installation instructions for Docker Compose	2025-07-16 10:13:43 +07:00
ebolo	ee32425930	feat: update roadmap to reflect completion of caddy file parsing feature	2025-07-16 07:01:37 +07:00
ebolo	2e1d309c54	fix: update links	2025-01-26 12:57:05 +07:00
ebolo	a8a0475917	feat: omit the user repo in container registry	2025-01-26 12:32:10 +07:00
ebolo	70b1416b77	fix: move README outside	2025-01-26 12:00:51 +07:00