graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
713 commits 1 branch 0 tags 50 MiB
Commit graph

8 commits

Author SHA1 Message Date
Graham McIntire
303196bb8e
Add design doc for sudo mode MFA-only verification 2026-02-01 13:50:34 -06:00
Graham McIntire
77e62df9da
Move CaptureTimezone plug to browser pipeline 
The plug was incorrectly placed in the endpoint, causing it to run on
all requests including APIs. Moved to :browser pipeline where it belongs,
and removed redundant fetch_session call since the pipeline handles it.
 2026-02-01 11:15:51 -06:00
Graham McIntire
45f8bc7459
Add design for Cloudflare timezone detection on signup 
Documents approach to automatically populate user timezone from cf-timezone
header during registration, with UTC fallback when header is not present.
 2026-02-01 10:56:07 -06:00
Graham McIntire
61a06fc11c
Add firmware version tracking system 
- Add firmware context module with upsert, query, and logging functions
- Add FirmwareVersionFetcherWorker to fetch MikroTik RSS daily
- Add Oban cron schedules (2 AM dev, 4 AM prod)
- Add version change detection to Discovery module
- Track firmware history with PubSub broadcasts
- All tests passing

Phase 3-5 of firmware tracking implementation complete.
Next: LiveView UI indicators.
 2026-02-01 10:46:27 -06:00
Graham McIntire
b30f2cf5af
filter more honeybadger alerts, format dates to users time zone, email template cleanup 2026-02-01 09:27:42 -06:00
Graham McIntire
43fe8cd326
Add design document for HIBP password breach checking 2026-01-31 17:16:58 -06:00
Graham McIntire
0388637b65
Update infrastructure documentation with Valkey restart fix 
Documents the root cause analysis and solution for the Valkey pod
restart issue. The problem was a race condition during node restarts,
not a Flannel failure.

Resolution:
- Added system-cluster-critical priority class to Valkey
- Application-level Redis health checks provide additional resilience
- Monitoring ongoing to verify stability over 24-48 hours

🤖 Generated with Claude Code
 2026-01-19 15:41:11 -06:00
Graham McIntire
5e9032314b
Add comprehensive Pangolin security rules 
Created 30+ security rules to protect against common web attacks:

Protection categories:
- SQL injection (UNION, OR/AND, comments)
- XSS (script tags, event handlers)
- Path traversal (directory traversal, absolute paths)
- Common exploits (WordPress, PHPMyAdmin, admin panels)
- Malicious bots (scanners, scrapers, empty user agents)
- Shell injection (commands, ShellShock)
- File upload exploits (PHP, double extensions)
- Information disclosure (.git, .env, backups, configs)
- Protocol attacks (HTTP/0.9, TRACE, TRACK)
- Known CVEs (Log4Shell, SSRF, XXE)

Features:
- Allowlist for legitimate traffic (health checks, agents, monitoring)
- Detailed documentation with examples
- Testing and troubleshooting guides
- Performance impact analysis
- Compliance mapping (OWASP, PCI DSS, SOC 2)

Documentation: docs/PANGOLIN_SECURITY.md
Configuration: pangolin-security-rules.toml
 2026-01-15 12:25:21 -06:00