aprs.me

graham/aprs.me

Fork 0

Commit graph

Author	SHA1	Message	Date
Graham McIntire	0f2195ef9d	security: CSP nonces, RemoteIp CIDR gating, rate limiting, NetworkPolicies, deadlock fixes Some checks failed Build and Push / Build and Push Docker Image (push) Failing after 2s Details - Content-Security-Policy: nonce-based per-request plug replacing unsafe-inline scripts - RemoteIp: CIDR-based trust gating via InetCidr, skips forwarded headers from untrusted peers - Rate limiting: auth pipeline (20/min), LiveView event handlers, existing mobile channel limits - NetworkPolicy: 4 k8s policies (web ingress, cluster, metrics, egress) for least-privilege networking - PartitionManager: deadlock retry with exponential backoff in drop_partition - Tests: reduced parallelism (max_cases 4), packets_test async:false to prevent trigger contention - k8s: APRS_PASSWORD -> APRS_PASSCODE secretRef, vendor/aprs submodule hardened	2026-07-26 14:04:56 -05:00
Graham McIntire	0cd549652d	k8s: ensure zero-downtime deploys with 1 replica - maxSurge: 1 (explicit integer, avoid percentage rounding) - minReadySeconds: 30 (was 10) — new pod must be stable longer before old is killed - progressDeadlineSeconds: 600 — detect stuck rollouts - readinessProbe failureThreshold: 3 (was 2) — more tolerance after old pod is gone - Add PodDisruptionBudget minAvailable: 1 — prevents voluntary disruptions from dropping below 1 pod	2026-04-29 13:55:27 -05:00
Graham McIntire	a637b3b87c	Add k8s deployment manifests and FluxCD GitOps config Kubernetes manifests for deploying to home cluster in the aprs namespace with Forgejo Actions CI pipeline for building and pushing container images to git.mcintire.me registry.	2026-02-17 16:11:27 -06:00

Author

SHA1

Message

Date

Graham McIntire

0f2195ef9d

security: CSP nonces, RemoteIp CIDR gating, rate limiting, NetworkPolicies, deadlock fixes

Build and Push / Build and Push Docker Image (push) Failing after 2s

Details

- Content-Security-Policy: nonce-based per-request plug replacing unsafe-inline scripts
- RemoteIp: CIDR-based trust gating via InetCidr, skips forwarded headers from untrusted peers
- Rate limiting: auth pipeline (20/min), LiveView event handlers, existing mobile channel limits
- NetworkPolicy: 4 k8s policies (web ingress, cluster, metrics, egress) for least-privilege networking
- PartitionManager: deadlock retry with exponential backoff in drop_partition
- Tests: reduced parallelism (max_cases 4), packets_test async:false to prevent trigger contention
- k8s: APRS_PASSWORD -> APRS_PASSCODE secretRef, vendor/aprs submodule hardened

2026-07-26 14:04:56 -05:00

Graham McIntire

0cd549652d

k8s: ensure zero-downtime deploys with 1 replica

- maxSurge: 1 (explicit integer, avoid percentage rounding)
- minReadySeconds: 30 (was 10) — new pod must be stable longer before old is killed
- progressDeadlineSeconds: 600 — detect stuck rollouts
- readinessProbe failureThreshold: 3 (was 2) — more tolerance after old pod is gone
- Add PodDisruptionBudget minAvailable: 1 — prevents voluntary disruptions from dropping below 1 pod

2026-04-29 13:55:27 -05:00

Graham McIntire

a637b3b87c

Add k8s deployment manifests and FluxCD GitOps config

Kubernetes manifests for deploying to home cluster in the aprs
namespace with Forgejo Actions CI pipeline for building and
pushing container images to git.mcintire.me registry.

2026-02-17 16:11:27 -06:00

3 commits