Graham McIntire
0f2195ef9d
Some checks failed
Build and Push / Build and Push Docker Image (push) Failing after 2s
- Content-Security-Policy: nonce-based per-request plug replacing unsafe-inline scripts - RemoteIp: CIDR-based trust gating via InetCidr, skips forwarded headers from untrusted peers - Rate limiting: auth pipeline (20/min), LiveView event handlers, existing mobile channel limits - NetworkPolicy: 4 k8s policies (web ingress, cluster, metrics, egress) for least-privilege networking - PartitionManager: deadlock retry with exponential backoff in drop_partition - Tests: reduced parallelism (max_cases 4), packets_test async:false to prevent trigger contention - k8s: APRS_PASSWORD -> APRS_PASSCODE secretRef, vendor/aprs submodule hardened
81 lines
2.4 KiB
Elixir
81 lines
2.4 KiB
Elixir
defmodule AprsmeWeb.Endpoint do
|
|
@moduledoc false
|
|
use Phoenix.Endpoint, otp_app: :aprsme
|
|
|
|
# The session will be stored in the cookie and signed,
|
|
# this means its contents can be read but not tampered with.
|
|
# Set :encryption_salt if you would also like to encrypt it.
|
|
@default_session_options [
|
|
store: :cookie,
|
|
key: "_aprs_key",
|
|
signing_salt: "0toQ/Ejk",
|
|
encryption_salt: "local-dev-only-encryption-salt",
|
|
secure: false,
|
|
http_only: true,
|
|
same_site: "Lax"
|
|
]
|
|
|
|
# Computed at compile-time by merging defaults with any endpoint config
|
|
@session_options Keyword.merge(
|
|
@default_session_options,
|
|
:aprsme
|
|
|> Application.compile_env(AprsmeWeb.Endpoint, [])
|
|
|> Keyword.get(:session_options, [])
|
|
)
|
|
|
|
def session_options, do: @session_options
|
|
|
|
socket "/live", Phoenix.LiveView.Socket,
|
|
websocket: [connect_info: [:peer_data, session: @session_options], timeout: 60_000],
|
|
longpoll: [connect_info: [:peer_data, session: @session_options]]
|
|
|
|
# Mobile API socket for iOS/Android apps
|
|
socket "/mobile", AprsmeWeb.MobileUserSocket,
|
|
websocket: [timeout: 60_000],
|
|
longpoll: false
|
|
|
|
# Serve at "/" the static files from "priv/static" directory.
|
|
#
|
|
# You should set gzip to true if you are running phx.digest
|
|
# when deploying your static files in production.
|
|
plug Plug.Static,
|
|
at: "/",
|
|
from: :aprsme,
|
|
gzip: true,
|
|
only: ~w(assets fonts images aprs-symbols favicon.ico robots.txt)
|
|
|
|
if Mix.env() == :dev do
|
|
plug Tidewave
|
|
end
|
|
|
|
# Code reloading can be explicitly enabled under the
|
|
# :code_reloader configuration of your endpoint.
|
|
if code_reloading? do
|
|
socket "/phoenix/live_reload/socket", Phoenix.LiveReloader.Socket
|
|
plug Phoenix.LiveReloader
|
|
plug Phoenix.CodeReloader
|
|
plug Phoenix.Ecto.CheckRepoStatus, otp_app: :aprsme
|
|
end
|
|
|
|
plug Phoenix.LiveDashboard.RequestLogger,
|
|
param_key: "request_logger",
|
|
cookie_key: "request_logger"
|
|
|
|
plug AprsmeWeb.Plugs.RemoteIp
|
|
plug Plug.RequestId
|
|
plug Plug.Telemetry, event_prefix: [:phoenix, :endpoint], log: {AprsmeWeb.Plugs.LogFilter, :log_level, []}
|
|
|
|
plug Plug.Parsers,
|
|
parsers: [:urlencoded, :multipart, :json],
|
|
pass: ["*/*"],
|
|
json_decoder: Phoenix.json_library()
|
|
|
|
plug Plug.MethodOverride
|
|
plug Plug.Head
|
|
plug Plug.Session, @session_options
|
|
|
|
# Health check endpoint
|
|
plug AprsmeWeb.Plugs.HealthCheck
|
|
|
|
plug AprsmeWeb.Router
|
|
end
|