5 commits

Author	SHA1	Message	Date
Graham McIntire	0f2195ef9d	security: CSP nonces, RemoteIp CIDR gating, rate limiting, NetworkPolicies, deadlock fixes ... - Content-Security-Policy: nonce-based per-request plug replacing unsafe-inline scripts - RemoteIp: CIDR-based trust gating via InetCidr, skips forwarded headers from untrusted peers - Rate limiting: auth pipeline (20/min), LiveView event handlers, existing mobile channel limits - NetworkPolicy: 4 k8s policies (web ingress, cluster, metrics, egress) for least-privilege networking - PartitionManager: deadlock retry with exponential backoff in drop_partition - Tests: reduced parallelism (max_cases 4), packets_test async:false to prevent trigger contention - k8s: APRS_PASSWORD -> APRS_PASSCODE secretRef, vendor/aprs submodule hardened	2026-07-26 14:04:56 -05:00
Graham McIntire	5569d8e2a0	Add user-agent to request logging metadata	2026-06-04 16:19:47 -05:00
Graham McIntire	d0b9513b41	fix elixir type warnings	2026-05-29 14:00:29 -05:00
Graham McIntire	cf97bf236a	Add client IP to request log metadata ... Set Logger metadata from conn.remote_ip in the RemoteIp plug so request logs include the client address.	2026-02-20 17:48:15 -06:00
Graham McIntire	bb6c24856d	Add RemoteIp plug to show real client IP in K8s logs ... Extracts client IP from CF-Connecting-IP or X-Forwarded-For headers and sets conn.remote_ip before request logging, so K8s logs show the actual client address instead of the internal cluster/ingress IP.	2026-02-19 15:06:41 -06:00