Juan Denis 76c57c19d6 fix(security): harden nginx write path and certbot issuance trust bugs ...

- run wildcard/SAN certbot privileged and fail on non-zero exit instead
  of reporting unissued cert paths as success
- cloudflare DNS-01 credentials: unpredictable mkstemp file, 0600,
  always deleted (was predictable /tmp path, never cleaned up)
- route53 credentials via sudo env A=B (sudo env_reset strips env= kwarg)
- validate domains before they reach certbot argv or cert file paths
- validate reverse-proxy builder input (domains, upstreams, headers,
  locations, rate-limit/cache values) against nginx config injection
- write_vhost: refuse non-plain-filename site names and roll back the
  vhost when the reload itself fails, not only when nginx -t fails
- create_proxy API returns 400 on service errors instead of always 201

2026-08-27 23:54:01 -04:00

..

api

fix(security): harden nginx write path and certbot issuance trust bugs

2026-08-27 23:54:01 -04:00

data

feat(recipes): serverkit-recipes registry catalog with one-call installs

2026-08-22 14:20:55 -04:00

jobs

feat(restore-points): add generic checkpoint core

2026-08-23 16:07:09 -04:00

middleware

fix(authz): give every mutating route an explicit authorization decision

2026-08-19 21:44:17 -04:00

models

fix(servers): restore the Observed-mode surface lost in the recovery rebuild

2026-08-27 04:45:37 -04:00

notifications

feat(realtime): one room grammar + mirrored event constants (plan 77 E3)

2026-08-19 04:58:49 -04:00

plugins

fix(auth): resolve the caller through one identity door, not the raw JWT

2026-08-18 19:33:57 -04:00

plugins_sdk

feat(ai): add attachment resolver registry

2026-08-21 10:48:28 -04:00

queue_bus

feat(telemetry): unified system event stream with correlation

2026-06-21 20:19:57 -04:00

services

fix(security): harden nginx write path and certbot issuance trust bugs

2026-08-27 23:54:01 -04:00

utils

feat: add second-wave locale bundles

2026-08-20 23:22:32 -04:00

__init__.py

feat(restore-points): add surface adapters and checkpoints

2026-08-23 16:41:02 -04:00

agent_gateway.py

chore: drop the imports the door migrations orphaned

2026-08-19 10:10:40 -04:00

constants.py

feat(realtime): one room grammar + mirrored event constants (plan 77 E3)

2026-08-19 04:58:49 -04:00

core_blueprints.py

feat(restore-points): add authorized lifecycle API

2026-08-23 17:00:50 -04:00

cron_runner.py

chore: drop the imports the door migrations orphaned

2026-08-19 10:10:40 -04:00

error_reporting.py

fix(api): a crash the route caught must still reach /monitoring/errors

2026-08-18 20:38:20 -04:00

exceptions.py

feat(api): centralize typed errors and request correlation

2026-08-18 02:42:25 -04:00

paths.py

feat(wordpress): global plugin library for operator-owned plugins

2026-07-01 01:08:42 -04:00

sockets_rooms.py

feat(realtime): one room grammar + mirrored event constants (plan 77 E3)

2026-08-19 04:58:49 -04:00

sockets.py

feat(realtime): generalized run envelope — one stream door for every run kind (plan 77 E1)

2026-08-19 05:13:02 -04:00