graham/aprs.me
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
1627 commits 1 branch 0 tags 7.3 MiB
Commit graph

3 commits

Author SHA1 Message Date
Graham McIntire
0f2195ef9d
security: CSP nonces, RemoteIp CIDR gating, rate limiting, NetworkPolicies, deadlock fixes
Some checks failed
Build and Push / Build and Push Docker Image (push) Failing after 2s
Details 
- Content-Security-Policy: nonce-based per-request plug replacing unsafe-inline scripts
- RemoteIp: CIDR-based trust gating via InetCidr, skips forwarded headers from untrusted peers
- Rate limiting: auth pipeline (20/min), LiveView event handlers, existing mobile channel limits
- NetworkPolicy: 4 k8s policies (web ingress, cluster, metrics, egress) for least-privilege networking
- PartitionManager: deadlock retry with exponential backoff in drop_partition
- Tests: reduced parallelism (max_cases 4), packets_test async:false to prevent trigger contention
- k8s: APRS_PASSWORD -> APRS_PASSCODE secretRef, vendor/aprs submodule hardened
 2026-07-26 14:04:56 -05:00
Graham McIntire
3937dfede7
Configure CSP headers to allow Sentry and CDN scripts 
- Added custom content-security-policy to put_secure_browser_headers
- Allowed script sources:
  - https://js.sentry-cdn.com for Sentry SDK
  - https://cdnjs.cloudflare.com for OverlappingMarkerSpiderfier
- Allowed connect sources for Sentry error reporting:
  - https://*.ingest.sentry.io
  - https://*.sentry.io
- Removed custom ContentSecurityPolicy plug in favor of built-in configuration

This properly configures the Content Security Policy to allow all necessary
external resources while maintaining security.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-07-18 15:30:36 -05:00
Graham McIntire
dade93ee5c
Implement Sentry JavaScript integration with proper CSP configuration 
- Restored Sentry JavaScript SDK script tag
- Created custom ContentSecurityPolicy plug to allow Sentry domains
- Added proper CSP headers allowing:
  - js.sentry-cdn.com for the SDK
  - *.ingest.sentry.io and *.sentry.io for error reporting
- Initialized Sentry in app.js with:
  - Proper DSN configuration
  - Browser tracing integration
  - 10% transaction sampling rate
  - Filter for non-critical ResizeObserver errors
- Added CSP plug to router pipeline after put_secure_browser_headers

This properly integrates Sentry for JavaScript error tracking while
maintaining security through explicit CSP configuration.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-07-18 15:17:35 -05:00