aprs.me

graham/aprs.me

Fork 0

Commit graph

Author	SHA1	Message	Date
Graham McIntire	2e101870d7	fix: compile-time config validation and egress policy Some checks failed Elixir CI / Build and test (push) Failing after 3m49s Details Elixir CI / Dialyzer (push) Successful in 6m45s Details Elixir CI / Build and Push Docker Image (push) Has been skipped Details - Remove url/live_view from config/config.exs (prevents dev config from baking into releases) - Move url/live_view to config/dev.exs and config/test.exs - Add validate_compile_env: false to release config in mix.exs - Fix egress network policy to allow DB at 10.0.19.30:6432 (PgBouncer) - Add RELEASE_VALIDATE_COMPILE_ENV to init container env	2026-08-06 17:20:34 -05:00
Graham McIntire	0f2195ef9d	security: CSP nonces, RemoteIp CIDR gating, rate limiting, NetworkPolicies, deadlock fixes Some checks failed Build and Push / Build and Push Docker Image (push) Failing after 2s Details - Content-Security-Policy: nonce-based per-request plug replacing unsafe-inline scripts - RemoteIp: CIDR-based trust gating via InetCidr, skips forwarded headers from untrusted peers - Rate limiting: auth pipeline (20/min), LiveView event handlers, existing mobile channel limits - NetworkPolicy: 4 k8s policies (web ingress, cluster, metrics, egress) for least-privilege networking - PartitionManager: deadlock retry with exponential backoff in drop_partition - Tests: reduced parallelism (max_cases 4), packets_test async:false to prevent trigger contention - k8s: APRS_PASSWORD -> APRS_PASSCODE secretRef, vendor/aprs submodule hardened	2026-07-26 14:04:56 -05:00

Author

SHA1

Message

Date

Graham McIntire

2e101870d7

fix: compile-time config validation and egress policy

Elixir CI / Build and test (push) Failing after 3m49s

Details

Elixir CI / Dialyzer (push) Successful in 6m45s

Details

Elixir CI / Build and Push Docker Image (push) Has been skipped

Details

- Remove url/live_view from config/config.exs (prevents dev config from baking into releases)
- Move url/live_view to config/dev.exs and config/test.exs
- Add validate_compile_env: false to release config in mix.exs
- Fix egress network policy to allow DB at 10.0.19.30:6432 (PgBouncer)
- Add RELEASE_VALIDATE_COMPILE_ENV to init container env

2026-08-06 17:20:34 -05:00

Graham McIntire

0f2195ef9d

security: CSP nonces, RemoteIp CIDR gating, rate limiting, NetworkPolicies, deadlock fixes

Build and Push / Build and Push Docker Image (push) Failing after 2s

Details

- Content-Security-Policy: nonce-based per-request plug replacing unsafe-inline scripts
- RemoteIp: CIDR-based trust gating via InetCidr, skips forwarded headers from untrusted peers
- Rate limiting: auth pipeline (20/min), LiveView event handlers, existing mobile channel limits
- NetworkPolicy: 4 k8s policies (web ingress, cluster, metrics, egress) for least-privilege networking
- PartitionManager: deadlock retry with exponential backoff in drop_partition
- Tests: reduced parallelism (max_cases 4), packets_test async:false to prevent trigger contention
- k8s: APRS_PASSWORD -> APRS_PASSCODE secretRef, vendor/aprs submodule hardened

2026-07-26 14:04:56 -05:00

2 commits