Claude 2bb1d7cc3b Make the private hostnames look like nothing is there, and close the way past the proxy ... An empty 404 is itself information: it says something terminates TLS here and chose not to answer. The console and the websocket endpoint now close the connection instead, which is what a hostname that serves nothing looks like. The websocket endpoint answers a genuine upgrade — verified live, 101 — and nothing else; a browser opening it gets a closed connection. Reviewing that turned up two holes that mattered more than the thing being reviewed. The compose defaults published the application and Reverb on every interface. Docker publishes ports ahead of UFW, so those backends were reachable from the internet with the firewall closed — and reaching a backend directly skips the proxy, and with it every hostname and address rule keeping the console private. The defaults are loopback now, and an update rebinds an existing installation that is behind a proxy actually running and holding 443. A development box without one is left alone, because taking its port away would look like the machine had broken. And the console's own "open" switch was emitting 0.0.0.0/0 into the proxy's allowlist. One click would have put the console on the public internet, which is the exact state the owner's rule exists to prevent. Switching it off relaxes the application's check; the proxy keeps its list, always. The reference proxy config carries the arrangement: QUIC early data off, since an address-based decision taken on 0-RTT can answer 425 and some browsers do not retry — an intermittent lockout from the console is the worst kind — and explicit handling for plain HTTP, whose automatic redirect otherwise announces both hidden names to anyone who asks. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-27 11:26:48 +02:00
..
Actions	fix(billing): hold only what cannot be matched, and let migrations roll back	2026-07-26 13:57:11 +02:00
Console	Make the private hostnames look like nothing is there, and close the way past the proxy	2026-07-27 11:26:48 +02:00
Http	Let the console keep its recovery hostnames without breaking route caching	2026-07-27 06:20:44 +02:00
Livewire	Serve the console inside the tunnel, without publishing the internal network	2026-07-27 10:14:33 +02:00
Mail	fix(admin): confirm maintenance delivery via MessageSent (retryable until sent); guard resend/cancel on derived state; fix flaky non-unique host wg_ip	2026-07-25 16:14:01 +02:00
Models	Move the console off /admin, give the status page its own address, and measure monitoring	2026-07-27 06:05:40 +02:00
Notifications	fix(engine-b): default-deny firewall, disk-based capacity, synchronous credential mail	2026-07-25 12:39:15 +02:00
Policies	fix(vpn): losing the operator roles closes the owner doors by itself	2026-07-25 22:50:13 +02:00
Providers	Land a sign-in where it was performed, not always in the customer portal	2026-07-27 06:15:16 +02:00
Provisioning	Move the console off /admin, give the status page its own address, and measure monitoring	2026-07-27 06:05:40 +02:00
Services	Manage the Stripe key from the console, behind a password and a test	2026-07-27 09:01:16 +02:00
Support	Make the console's access list reach the proxy, price in euros, and answer errors	2026-07-27 06:51:05 +02:00