security: Harden server, auth, rate limiting, and proxy config#78
Merged
security: Harden server, auth, rate limiting, and proxy config#78
Conversation
Assign a fixed system UID (65532) to the service user so the final scratch image runs under a predictable non-root identity regardless of host defaults. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Felix Matouschek <felix@matouschek.org>
Set ReadTimeout, WriteTimeout, and IdleTimeout on the HTTP server to limit resource exhaustion from slow or stalled clients. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: 0xFelix <felix@matouschek.org>
Add a maxBuckets cap (default 65536) to the per-IP token-bucket limiter. When the map is full, an eager idle sweep is attempted before inserting a new entry; if the map is still full after the sweep the request is rejected with 429. This prevents unbounded memory growth under IP spoofing or a large number of unique clients. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: 0xFelix <felix@matouschek.org>
Add a maxEntries cap (default 65536) to the per-IP lockout tracker. When full, an eager stale-entry sweep is run; if the map is still full an arbitrary entry is evicted before inserting the new key. Also adds a periodic sweep on IsBlocked and RecordFailure to age out stale entries even when the cap is never reached. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: 0xFelix <felix@matouschek.org>
Limit request body reads to maxRequestBodySize via MaxBytesReader and return 413 on overflow. Redact Authorization, X-Api-User, and X-Api-Key headers before printing to prevent credential leakage in debug logs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: 0xFelix <felix@matouschek.org>
Apply lockout tracking to CMD_API_SHOW_DOMAINS and use constant-time string comparison for username/password checks to prevent timing-based credential enumeration. Return 401 on auth failure and skip credentials check when both username and password are empty. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: 0xFelix <felix@matouschek.org>
Parse trustedProxies entries once at startup into []netip.Prefix, accepting both bare IPs (promoted to /32 or /128) and CIDR notation. The middleware now uses prefix.Contains for matching, making subnet-level proxy trust straightforward to configure. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: 0xFelix <felix@matouschek.org>
Add security callout covering plaintext HTTP and config file permissions. Document wildcard subdomain authorization, DynDNS2 nohost/lockout interaction, caller-supplied IP trust model, and updated TRUSTED_PROXIES description to reflect CIDR support. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: 0xFelix <felix@matouschek.org>
0xFelix
force-pushed
the
security-hardening
branch
from
5c8a877 to
6fd5279
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ReadTimeout(30s),WriteTimeout(30s), andIdleTimeout(120s)MaxBytesReader; redactAuthorization,X-Api-User,X-Api-Keyheaders before printingCMD_API_SHOW_DOMAINSuser authtrustedProxiesonce at startup into[]netip.Prefix, accepting both bare IPs and CIDR ranges; useprefix.Containsfor matching//nolint:gosecdirectives now flagged bynolintlintTRUSTED_PROXIESdescriptionTest plan
go test ./...passesgolangci-lint run ./...reports 0 issuesdocker run --rm ... id)TRUSTED_PROXIES=10.0.0.0/8accepts a forwarded header from10.1.2.3and ignores one from192.168.1.1🤖 Generated with Claude Code