BaaRai d0d153b768 fix(auth): trusted proxies for the login rate limit, 12 characters in reset-password.sh ...

- ARTEX_TRUSTED_PROXIES (comma-separated CIDRs, empty by default). When
  the TCP peer is listed, the login limit reads X-Forwarded-For from the
  right and keys on the first hop that is not a trusted proxy; otherwise
  the header is ignored. Without it every client behind a reverse proxy
  shares one bucket and an attacker can block the admin. Passed through
  by docker-compose.yml and listed in .env.example.
- README: nginx example sends X-Forwarded-For; document the variable;
  the binary's default listen address is 127.0.0.1:8787.
- reset-password.sh refuses passwords under 12 characters, counted in
  characters like the server.

2026-11-05 16:57:48 +01:00

..

main_test.go

fix(security): scrub startup secrets before any child can spawn

2026-11-03 22:14:35 +01:00

main.go

fix(auth): trusted proxies for the login rate limit, 12 characters in reset-password.sh

2026-11-05 16:57:48 +01:00