jonas/kirche-einfach
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: edge hardening, rootless containers, fail-closed frontend mode

Browse source
This commit is contained in:
Jonas Miederer 2026-09-14 21:35:06 +02:00
parent d903d0951f
commit e82ce391f6
15 changed files with 260 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

5
CHANGELOG.md
View file

@ -14,6 +14,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
removed (SSRF / cross-tenant / flow-chaining hardening);
continuations now resolve from the admin-authored definition.
- Frontend: `/app/*` routes require login; approver is the session user.
- Edge hardening: interactive API docs only with debug, security headers
(nosniff/frame/Referrer-Policy), 2 MiB body cap, per-IP run throttle,
generic upstream-error responses, magic links never logged.
- Containers run rootless (api/vite as uid 1000, lfx as `lfx` user);
frontend fails closed to preview mode unless `FRONTEND_MODE=dev`.
### Added
- Landing page: status-quo problem block, 5-step process with quote,
portal overview with admin areas, AI platform parts, exception tiers,