6927987a0d
From the whole-codebase re-audit (deferred MEDIUM findings, Codex-reviewed): - poller: CredentialVault enforces a credential's disabled_at lock only at connect(), but PollMetrics reuses one long-lived SSH connection per server, so a credential disabled mid-run kept streaming metrics over the already-open session. Add Server::withActiveCredential() (whereHas credential whereNull disabled_at); the poller selects via it and prunes any cached client whose server left the active set, so a revocation drops the server on the next tick and closes its session promptly. - prod compose: add security_opt no-new-privileges:true to every service + a generous pids_limit (fork-bomb backstop). cap_drop/read_only are deliberately left out — they need a per-service prod smoke test (nginx :80 bind, entrypoint chown) before enabling; documented inline. - Caddyfile + compose: strengthen the TRUSTED_PROXY_CIDR guidance — an over-broad value in external-TLS mode lets any client forge X-Forwarded-For and defeat the IP-keyed throttles + ban. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| caddy | ||
| clusev | ||
| motd | ||
| nginx | ||
| php | ||
| release | ||
| restart-sentinel | ||
| supervisor | ||
| terminal | ||
| wg | ||
| entrypoint.sh | ||