Conversation
Authentication & secrets - Require auth tokens and shared secrets via environment variables; the proxy now refuses to start when a referenced secret variable is unset instead of expanding it to an empty string. - Handle secrets through the secrecy/zeroize crates so token material is wrapped and zeroed rather than left in plain config structs. - mTLS no longer falls back to using a cert CN as the role; unmatched certs are denied unless default_role is set (fail-closed). - Serve the Prometheus metrics endpoint only after authentication. Rules & request handling - Add global.trusted_proxies (CIDR list); when the direct peer is trusted, client_ip rules derive the address from X-Real-Ip / X-Forwarded-For / Forwarded, using the rightmost untrusted XFF hop. - Support nested or-condition groups and detect bind mounts via both HostConfig.Binds and HostConfig.Mounts. - Document that response filters do not cover streaming exec sessions. Hot reload - SIGHUP now rebinds the listener using the new bind/port/tls settings so network and TLS changes take effect on reload. Setup, release & packaging - Publish and verify SHA256SUMS for release artifacts; optional GPG signing via DOCKER_PROXY_SIGNING_KEY producing SHA256SUMS.asc. - Expand the setup wizard rule templates (14 -> 16) and refresh the install/update scripts and example configs. - systemd unit: grant ReadWritePaths for /var/log for the audit log. Docs - Rework README quick start (download-then-inspect), document artifact verification, trusted proxies, metrics auth, and the mTLS role change.
- ci.yml: fmt, clippy, tests, script syntax checks, cross-compile build matrix, and an api_e2e job that runs the proxy against the runner Docker socket to verify auth, a deny rule, and the metrics endpoint - release.yml: v*.*.* tag triggers cross-compile of all four targets, SHA256SUMS generation, optional GPG signing, and a GitHub Release whose asset names match what setup downloads - README: one-line install, token retrieval, config-change steps, plus Continuous integration and Releasing sections - fix clippy lints flagged by CI: unnecessary_sort_by in config.rs and while_let_loop in the unix SIGHUP reloader in main.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I think I've fixed some of the bugs, god bless claude.