Claude b860ce2e9b Give the three console guards one answer to "is this the console?" ... The hostname guard, the network allowlist and the public-site switch each decided for themselves, by testing the path against admin/*. That works only while the console sits under /admin. It is also a trap: the moment the console moves to the root of its own hostname, PublicSiteGate stops recognising it, and with the public site hidden the console answers 503 to the very person trying to sign in and switch it back on. The guard does not fail loudly — it silently stops matching. AdminArea is now the single answer. It has two modes and no third: a console hostname is configured, in which case the console IS that host and answers at its root; or nothing is configured, in which case the console stays under /admin on any host exactly as before, so upgrading cannot lock anyone out of a system that was working. RestrictAdminHost gains the half it was missing. Binding console routes to a hostname does not stop the customer routes from answering there too, because they are registered without one — so the console's hostname would still serve portal pages wherever the paths did not collide. It now enforces both directions, with the endpoints both sides genuinely share written out as a list rather than inferred. Nothing changes yet for an installation with no ADMIN_HOSTS set, which is every development machine and every fresh checkout. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-27 04:52:21 +02:00
..
Actions	fix(billing): hold only what cannot be matched, and let migrations roll back	2026-07-26 13:57:11 +02:00
Console	feat(security): a way back into the console that does not need the console	2026-07-27 03:09:13 +02:00
Http	Give the three console guards one answer to "is this the console?"	2026-07-27 04:52:21 +02:00
Livewire	Report the estate from the database, and print the traffic that is sold	2026-07-27 04:48:51 +02:00
Mail	fix(admin): confirm maintenance delivery via MessageSent (retryable until sent); guard resend/cancel on derived state; fix flaky non-unique host wg_ip	2026-07-25 16:14:01 +02:00
Models	Report the estate from the database, and print the traffic that is sold	2026-07-27 04:48:51 +02:00
Notifications	fix(engine-b): default-deny firewall, disk-based capacity, synchronous credential mail	2026-07-25 12:39:15 +02:00
Policies	fix(vpn): losing the operator roles closes the owner doors by itself	2026-07-25 22:50:13 +02:00
Providers	feat(security): the console decides who may reach it, and the owner keeps the list	2026-07-26 20:27:26 +02:00
Provisioning	fix(billing): a paid order opens a contract, and provisioning obeys it	2026-07-26 11:10:00 +02:00
Services	feat(deploy): releases you can pin to, and a version that tells the truth	2026-07-26 15:21:38 +02:00
Support	Give the three console guards one answer to "is this the console?"	2026-07-27 04:52:21 +02:00