The single header-wide help icon (added last release) pointed at a
per-page doc guess, but a page can have several cards covering different
topics. Removed it and added a small help icon directly to each card
that has real corresponding doc content, linking straight to that doc:
Proxy List + Add/Edit host modal (hosts.ejs), Add DNS Provider + Dynamic
A Records (dns.ejs), Add New User + User List (users.ejs), Add
Permission + Permissions (permissions.ejs), Add Group (groups.ejs).
Bumps to v1.1.11.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KDEx8ghuZR61pqPXc6da9C
- A ? icon in the top-right header deep-links to the doc most relevant to
the current page (client-side path mapping, same pattern already used
for top-nav active-link highlighting -- no server-side "current section"
local exists to key off of instead). Falls back to the docs index.
- GET /docs/search does a plain line-substring search over the existing
allowlisted doc set. No new dependency, stays usable with no internet
access.
Bumps to v1.1.10.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KDEx8ghuZR61pqPXc6da9C
- Plain hosts can now be renamed after creation (wildcard/child/cache hosts
stay locked, since other records reference them by name). Migrates the
cert cache key on rename.
- Along the way, found and fixed a real bug in the vendored model-redis
library: its rename path leaves a stray, incomplete hash behind under
the old key when an `always`-type field (updated_on) is defined earlier
in the schema than the primary key -- silently blocking that hostname
from ever being reused. Worked around at the Host model level (can't
patch node_modules).
- Host list now shows who created each host, and when.
- Host modal's tabs now scroll horizontally on narrow screens instead of
overflowing awkwardly.
- Added missing inline help text (Target SSL, wildcard matching behavior).
Bumps to v1.1.9.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KDEx8ghuZR61pqPXc6da9C
- Host.prototype.update() had no challengeType handling (only create() did),
so selecting "Parent Wildcard" on an existing host's edit form silently
did nothing. Added the same wildcard-parent lookup to update(), using a
new Host.lookUpWildcardParent() -- the existing lookUp() can't be reused
here since an already-created host resolves to its own leaf rather than
falling through to a sibling wildcard.
- A wildcard's issued cert covers both the base domain and *.base domain
(altNames), but the lookup tree stores the wildcard one level below its
base -- looking up the bare base domain landed on an empty parent node
and found nothing. buildLookUpObj() now also stamps that parent node,
order-independent (a real host explicitly created at that exact name
always still wins).
Verified both fixes against a real Redis-backed Host model (not just the
mocked lookup-tree tests) -- see PR description.
Bumps to v1.1.8.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KDEx8ghuZR61pqPXc6da9C
Same treatment as the sso-manager-node companion PR: replaced the
generic jekyll-theme-cayman theme with a custom layout mirroring the
actual app UI -- dark fixed navbar with the theta42 logo, Bootstrap 5
+ Font Awesome (same stack the app uses), content in a card, dark
footer matching bottom.ejs. Keeps this repo's own favicon.svg
(confirmed genuinely distinct SVG artwork from the shared theta42
logo, not a duplicate) as the browser-tab icon.
- New cross-page nav (Home/Installation/Architecture/API/Docker/
Contributing/Changelog).
- SEO: jekyll-seo-tag + jekyll-sitemap, per-page meta description,
OG/Twitter card tags, canonical URLs, JSON-LD, sitemap.xml,
robots.txt.
- Mobile: Bootstrap's responsive grid + collapsible navbar; the
screenshot pairs in index.md stack to full-width below 576px.
Verified with a real Jekyll build (jekyll/jekyll Docker image) +
Playwright: desktop and mobile (375px) screenshots, mobile nav
toggle, active-link highlighting, zero console/page errors, and
confirmed real SEO output + the correct (non-shared) favicon via curl
against the served site.
The three auth_mode radios (Off / Basic / SSO) had no shared [name]
attribute, so per the HTML spec each was its own independent group --
clicking one didn't uncheck the others, letting multiple options
appear selected at once despite the page's own text saying "basic
auth and SSO can't both be enabled."
Added name="auth_mode" to restore native browser radio-group
behavior. The original comment claimed the radios were deliberately
kept nameless to avoid polluting the submitted form data (formAJAX
serializes every [name] field in the form), but that reasoning
doesn't hold: model-redis's processKeys() rebuilds the saved object
strictly from the Host model's own _keyMap, so an unrecognized
auth_mode field is silently stripped before anything is ever
persisted -- confirmed directly with model-redis's own
object_validate.js. Updated the stale comment accordingly.
jq-repeat 2.1.0 (release notes: https://github.com/wmantly/jq-repeat/releases/tag/v2.1.0)
brings real fixes (throttled-update race conditions, sorted-list
reverse() leaking elements, nested-scope isolation) and a few
behavior changes. Audited every usage in this repo against the
changelog before upgrading:
- push()/unshift() now return the new array length -- every call
site in this repo is a bare statement, none consume the return
value. No risk.
- update() is now trailing-edge throttled (~50ms) even on the first
call, not just rapid subsequent ones -- no code in this repo reads
DOM/item state immediately after calling update(), so no risk here
(unlike sso-manager-node's companion PR, which needed a fix).
- jr-order-reverse and nested jq-repeat templates: not used anywhere
in this repo.
Real breakage found and fixed: users.ejs/groups.ejs/permissions.ejs
called $.scope.X.__setPut(fn)/__setTake(fn) as setter METHODS -- that
API is gone in 2.1.0. Insert/remove hooks are now set via direct
property assignment ($.scope.X.__put = fn), per the current README.
Verified live (real dev server + Playwright): before the fix, all
three pages threw "__setTake is not a function" and the
insert/remove row animations were broken; after, zero errors and the
hooks fire correctly.
<title>, the navbar brand text, and the logo were all hardcoded
"Proxy - Theta 42"/"Dynamic Proxy". New conf.name/conf.logo keys
(defaults matching current text/asset) thread through the existing
values object pattern in routes/render.js and routes/docs.js, and
top.ejs now renders <%- name %>/<%- logo %> for the title and a new
navbar logo image.
Footer (copyright, theta42.com link, GitHub/license links) and the
existing favicon.svg are left as-is -- open-source attribution and a
distinct, already-working icon asset, not deployment branding.
GitHub Releases already carried real changelog notes per tag, but
those require internet access to view -- exactly what the /docs
route exists to avoid. CHANGELOG.md is a committed, Keep-a-Changelog
style file (backfilled from the v1.1.0/v1.1.1/v1.1.2 release notes),
linked from README and served at /docs/changelog alongside the rest
of the project's docs.
GitHub Releases already carried real changelog notes per tag, but
those require internet access to view -- exactly what the /docs
route exists to avoid. CHANGELOG.md is a committed, Keep-a-Changelog
style file (backfilled from the v1.1.0/v1.1.1/v1.1.2 release notes),
linked from README and served at /docs/changelog alongside the rest
of the project's docs.
Public route reading from disk on every request with no throttling
-- add a per-IP limiter matching the routes/auth.js/routes/host.js
convention already used elsewhere in this repo.
Air-gap:
- DynamicRecord.refreshAll() called getPublicIp() (api.ipify.org,
icanhazip.com, ifconfig.me) every 4h on a timer regardless of
whether any dynamic records were configured -- the one background
call in the repo not actually gated by feature use. Now skips the
lookup entirely when there's nothing to refresh.
- Removed the stray, unauthenticated GET /test page (a leftover
jq-repeat demo) that loaded jQuery + Mustache from external CDNs.
- Removed a dead IE<9-only html5shim script tag pointing at a domain
that no longer resolves.
Docs:
- New GET /docs (index) and /docs/:slug routes render this project's
own README, DEPLOYMENT, api.md, and docs/*.md server-side via
marked (new dependency) -- so the documentation is readable from
the running app with no route to GitHub Pages, where it otherwise
only lives. Public, no auth, same tier as the health endpoint.
- .dockerignore/Dockerfile updated: docs/, DEPLOYMENT.md, and
nodejs/api.md were previously excluded from the image entirely
("served via GitHub Pages, not from the image") -- now copied in
alongside README.md/tos.md-style, since they're needed at runtime.
listDomains() used to validate the token by calling DuckDNS's update
endpoint with ip/ipv6 omitted, which makes DuckDNS auto-detect and
apply this host's public IP -- so adding a provider instantly
repointed the domain. Validate via a fixed TXT marker instead, which
DuckDNS's API supports independently and doesn't touch routing.
ops/backup.sh snapshots Redis (BGSAVE, dynamic RDB path lookup) and
./config for standalone deployments, with retention. A background
service polls GitHub releases every 24h and surfaces an admin-only
banner in the UI when a newer version is published.
- Rewrite docs/index.md as a short landing page (what it is, screenshots,
why this over the alternatives, features, a minimal "get it" snippet)
instead of a full documentation dump — full docs live in the repo
(README, docs/*.md) and are linked from here.
- Cross-link to SSO Manager and theta-env's own Pages sites.
- Screenshots are now clickable (open full size) on both the Pages site
and the README.
- Disable show_downloads in docs/_config.yml — the Cayman theme's
"Download .zip/.tar.gz" buttons are gone; "View on GitHub" (which links
back to the repo) is the only header link now.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Captured from a fresh theta-env install with demo data, via headless
Chrome + Playwright (scripted login, no manual UI interaction needed to
reproduce).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
CodeQL flagged POST/PUT/DELETE /api/host* as missing rate limiting despite
performing authorization -- same authLimiter pattern routes/auth.js already
uses, applied here with a higher ceiling since legitimate admin work (bulk
edits) is expected on these routes.
CodeQL also flagged utils/basicauth.js's SHA-1 hashing as reachable from the
new basicauth-user route -- this is the existing, documented htpasswd-
compatible {SHA} scheme (see the comment on hashPassword), not something
this PR changes; left as-is per that comment's existing "follow-up" note,
since swapping it requires a coordinated change to
ops/nginx_conf/hostfeatures.lua's verification and a migration path for
already-stored hashes.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- ops/nginx_conf/targetinfo.lua's wildcard-subdomain lookup fallback used
classic LuaSocket (require("socket.unix")) instead of an OpenResty
cosocket. LuaSocket is blocking, and called from an nginx worker it
stalls the ENTIRE worker — every other in-flight connection on it — for
the round-trip to the Node app. Worse, the Node side never
newline-terminated its response, so the old blocking receive() only ever
returned via its read-timeout-then-partial-read fallback, meaning every
single cache-miss lookup paid a fixed timeout penalty while blocking the
whole worker. Replaced with an ngx.socket.tcp() cosocket (unix-domain via
"unix:/path", the only cosocket API this lua-nginx-module ships) and
newline-terminated the Node service's responses so receive() actually
completes instead of timing out. Verified against a live container:
previously this crashed OpenResty's Lua VM entirely
(ngx.socket.unix doesn't exist); fixed version resolves fresh wildcard
subdomains in ~2ms.
- Add gzip compression (`compression` middleware) and far-future
Cache-Control on static assets (7d for vendor libs under
/static-modules, 1h for the app's own /static JS/CSS, which isn't
cache-busted). The admin UI is a traditional multi-page app that loads
~13 separate vendor/app JS+CSS files on every full navigation; previously
none of them were compressed and Cache-Control was `max-age=0` (Express's
default), forcing a revalidation round-trip for every asset on every page
view.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
wmantly