7 Commits

Include renames

Author	SHA1	Message	Date
eboloandClaude Opus 5	c484014752	Harden the read path, forwarded headers and security docs ... Found while investigating an unrelated Gitea compromise: CaddyManager itself was not involved, but reviewing it turned up three things worth closing. Reading a configuration was the only file operation that did not validate the name. Saving, renaming and deleting all reject `..`, `/` and `\`, so the read path was the one way to leave the configuration directory and pull in any `*.caddy` file on the host. The HTTP API happened to be covered, because GET checks the name against the directory listing first, but the UI calls the service directly and nothing stopped it. Forwarded headers were trusted from any peer. That is correct only while the container port is unreachable except through the proxy; the moment it is published, a caller dictates the scheme, host and client address the app believes in. Loopback and private space cover a proxy on a Docker network or on the host, which is the documented deployment, and ignore everyone else. The README never said that the `X-Api-Key` check guards `/api/*` and nothing else, so the UI - which rewrites Caddyfiles and holds the Docker socket - reads as protected when it is not. It now says so, and warns about the specific shape that bit us: a second hostname added for machine callers whose only extra directive is a `tls` line, which serves the unauthenticated UI to anyone who can resolve it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-12 17:05:52 +07:00
ebolo	9f7cb79bad	feat(api): Add authenticated Caddy management API	2026-07-26 18:34:02 +07:00
ebolo	d5ea7b56cb	feat(caddy): support renaming configuration files	2026-07-26 12:55:50 +07:00
ebolo	7012193e04	feat: add tag extraction functionality to Caddy configuration and display in UI	2025-07-28 22:34:52 +07:00
ebolo	0beb3800b5	refactor: update Blazor testing guidelines and improve regex for hostname parsing in Caddy configuration	2025-07-23 15:33:18 +07:00
ebolo	063ed041b0	chore: refactor project structure by removing .cursorignore and updating references to use Contracts in test files	2025-07-23 11:50:12 +07:00
ebolo	ec454d0346	chore: update project structure with contracts and services for CaddyManager, including configuration and Docker integration	2025-07-23 10:37:51 +07:00