Juan DenisandClaude Fable 5 4c76d43cb7 feat(security): cloud-metadata egress guard for app containers ...

Default-on (opt-out) DOCKER-USER drop rule for 169.254.169.254 with an
nftables fallback, toggleable from Security > Firewall. Kills the
SSRF-to-cloud-IAM credential-theft class on cloud VPSes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-03 14:23:11 -04:00

..

__init__.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

admin.py

feat(settings): manage the base-domain registry from Settings → Site

2026-07-01 00:27:30 -04:00

advanced_ssl.py

Add advanced SSL: wildcard, SAN, custom certs, health checks

2026-03-23 02:15:16 -04:00

agent_plugins.py

Add agent plugin system with full lifecycle management

2026-03-23 02:08:00 -04:00

agent_poll.py

fix(agent): fail-closed agent registration + surface stuck-command errors

2026-05-31 16:08:13 -04:00

ai.py

feat(ai): add core AI assistant primitive powered by Prompture

2026-06-01 02:39:05 -04:00

api_analytics.py

Add Services UI and service-detail pages

2026-03-07 12:15:02 -05:00

api_keys.py

feat: Phase 1 foundation — status aggregator, API scopes, onboarding, template magic vars

2026-06-23 18:23:47 -04:00

app_volumes.py

feat(services): first-class managed volumes for apps

2026-07-01 01:57:07 -04:00

apps.py

refactor(plugins): add WordPress bridge + flagship/multi-blueprint plumbing

2026-07-01 23:45:22 -04:00

auth.py

Normalize emails, add panel_origin & domain-aware URLs

2026-06-22 14:37:44 -04:00

backups.py

refactor(unify): §8 Phase B5 — generic backup-policy CRUD for every target

2026-06-24 14:27:08 -04:00

buildpacks.py

feat: Phase 2 developer experience — build packs, config snapshots, catalog certification

2026-06-23 18:49:04 -04:00

builds.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

cloud_provisioning.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00

connections.py

feat(connections): authenticate private container registry pulls

2026-07-01 01:35:44 -04:00

container_status.py

feat: Phase 1 foundation — status aggregator, API scopes, onboarding, template magic vars

2026-06-23 18:23:47 -04:00

cron.py

Add cron job editing and tabbed route support

2026-03-03 22:11:30 -05:00

databases.py

feat(databases): track managed databases as first-class resources

2026-07-01 09:44:48 -04:00

ddns.py

feat(dns): dynamic DNS — token-authenticated A/AAAA updates

2026-06-19 03:12:07 -04:00

deploy.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

deployment_jobs.py

Add deployment jobs and remote deployment runner

2026-04-29 00:39:16 -04:00

deployments.py

refactor(unify): §3 — canonical DeploymentJob links + unified /deployments surface

2026-06-24 14:52:04 -04:00

dns_zones.py

feat(domains): unify domains & DNS into one surface + admin-only Connections

2026-06-23 00:34:55 -04:00

docker.py

Protect ServerKit containers from lifecycle actions

2026-06-24 01:43:29 -04:00

docs.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

domains.py

feat(sites): per-base wildcard HTTPS + base-domain registry API

2026-07-01 00:11:18 -04:00

env_vars.py

feat: per-service targeting for the compose env overlay

2026-06-23 23:19:41 -04:00

environments.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

event_subscriptions.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

files.py

Add S3 bucket browsing to the Files app (#14, #15)

2026-06-15 10:21:39 -04:00

firewall.py

feat(security): cloud-metadata egress guard for app containers

2026-07-03 14:23:11 -04:00

fleet_monitor.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00

fleet.py

Add agent capability probing and reporting

2026-05-01 00:37:48 -04:00

ftp.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

git.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

gpu.py

feat(system): NVIDIA GPU monitoring

2026-06-19 10:08:58 -04:00

image_updates.py

feat(docker): image-digest update detection

2026-06-19 09:22:18 -04:00

invitations.py

Add invitations, email models, admin APIs

2026-03-04 02:34:49 -05:00

jobs.py

feat(jobs): unified background-job orchestration on the Queue Bus

2026-06-21 20:44:12 -04:00

logs.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

marketplace.py

refactor(marketplace): retire the legacy Extension catalog (#51)

2026-07-02 02:21:45 -04:00

metrics.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

migrations.py

Add SSO/OAuth and DB migration framework

2026-03-04 01:37:22 -05:00

mobile.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00

modules.py

feat(extensions): Phase 1 — seed marketplace (GPU + Workflow), module toggles

2026-07-01 21:34:54 -04:00

monitoring.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

nginx_advanced.py

Add Nginx advanced config: reverse proxy, load balancing, caching

2026-03-23 02:19:33 -04:00

nginx.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

notifications.py

refactor(unify): §6 Phase C6b — Postfix relay backed by EmailProviderConnection

2026-06-24 14:36:08 -04:00

pairing.py

fix(pairing): require developer role for claim/lookup (audit L1)

2026-06-12 18:35:43 -04:00

performance.py

feat(jobs): unified background-job orchestration on the Queue Bus

2026-06-21 20:44:12 -04:00

php.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

plugins.py

feat(extensions): per-plugin config store + Configure form (#49)

2026-07-02 02:09:39 -04:00

previews.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

private_urls.py

feat(workspaces): extend per-site ACL grants across all app blueprints (#33)

2026-06-05 23:04:06 -04:00

processes.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

projects.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

proxy.py

feat: make the ingress-plane boundary explicit (host Nginx vs proxy stack)

2026-06-23 20:57:40 -04:00

python.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

queue_bus.py

Workspace and queue bus improvements

2026-06-22 01:16:00 -04:00

registrars.py

Add registrars, GitLab, DO/Godaddy DNS and SMTP relay

2026-06-15 09:19:56 -04:00

secrets_webhooks.py

Truncate large telemetry payloads & UI robustness fixes

2026-06-22 01:45:15 -04:00

security.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

server_templates.py

Add server templates with config drift detection and compliance

2026-03-23 02:11:16 -04:00

servers.py

fix(agent-install): paged version discovery, checksum verify, busybox support (A1-A3)

2026-07-02 18:00:24 -04:00

shared_resources.py

feat: per-service targeting for the compose env overlay

2026-06-23 23:19:41 -04:00

snapshots.py

refactor(unify): §8 Phase B4 — surface DeploymentSnapshot as "Config Checkpoint"

2026-06-24 14:24:13 -04:00

source_connections.py

feat(connections): GitLab/Gitea/Bitbucket repo pickers + path selector

2026-06-21 00:20:10 -04:00

ssl.py

refactor(backend): extract reusable format_bytes, admin_required, and validate_app_name

2026-06-21 02:11:47 -04:00

sso.py

Add audit fallback, builtin extensions, and ports

2026-05-03 15:57:02 -04:00

status_pages.py

Add status pages with health checks and incident management

2026-03-23 02:22:53 -04:00

system.py

feat(files): Stack quick link follows the real install dir

2026-07-02 22:19:14 -04:00

telemetry.py

feat(telemetry): unified system event stream with correlation

2026-06-21 20:19:57 -04:00

templates.py

feat: Phase 1 foundation — status aggregator, API scopes, onboarding, template magic vars

2026-06-23 18:23:47 -04:00

tunnels.py

feat(remote-access): NAT-traversing WireGuard tunnels to expose private services

2026-06-15 23:20:00 -04:00

two_factor.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

uptime.py

Add server uptime tracking and visualization

2026-01-17 13:37:40 -05:00

waf.py

feat(security): per-app WAF (ModSecurity v3 + OWASP CRS)

2026-06-19 14:02:24 -04:00

webhooks.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

workflows.py

feat(jobs): run workflow executions as a workflow.execute unified job (Phase 6)

2026-06-21 21:13:55 -04:00

workspaces.py

feat(workspaces): enforce server quotas and add nav permissions UI

2026-06-21 18:44:08 -04:00