6927987a0d
From the whole-codebase re-audit (deferred MEDIUM findings, Codex-reviewed): - poller: CredentialVault enforces a credential's disabled_at lock only at connect(), but PollMetrics reuses one long-lived SSH connection per server, so a credential disabled mid-run kept streaming metrics over the already-open session. Add Server::withActiveCredential() (whereHas credential whereNull disabled_at); the poller selects via it and prunes any cached client whose server left the active set, so a revocation drops the server on the next tick and closes its session promptly. - prod compose: add security_opt no-new-privileges:true to every service + a generous pids_limit (fork-bomb backstop). cap_drop/read_only are deliberately left out — they need a per-service prod smoke test (nginx :80 bind, entrypoint chown) before enabling; documented inline. - Caddyfile + compose: strengthen the TRUSTED_PROXY_CIDR guidance — an over-broad value in external-TLS mode lets any client forge X-Forwarded-For and defeat the IP-keyed throttles + ban. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Console/Commands | ||
| Enums | ||
| Events | ||
| Http | ||
| Jobs | ||
| Livewire | ||
| Models | ||
| Notifications | ||
| Providers | ||
| Rules | ||
| Services | ||
| Support | ||