Juan DenisandClaude Opus 4.8 ada030553a feat(security): per-app WAF (ModSecurity v3 + OWASP CRS) ...

- WafPolicy model (per app: mode off/detect/block, paranoia level, anomaly
  threshold, disabled CRS rule ids).
- WafService: render_rules (SecRuleEngine + CRS include + paranoia/anomaly +
  SecRuleRemoveById), nginx_snippet, install/status (distro-aware,
  best-effort), apply() that writes per-app rules under
  /etc/nginx/serverkit-conf.d/waf and idempotently injects an include into
  the app vhost (graceful manual_include fallback), and audit-log event
  parsing.
- API /api/v1/waf: per-app policy GET/PUT, apply, events, install status.
- 29 tests: rule rendering per mode, rule-disable, nginx snippet, policy
  validation, audit-log parsing, API round-trip + auth.

Backend only; WAF UI + verified install on a real nginx+ModSecurity host are
follow-ups. Integration is additive — existing nginx/site management untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-19 14:02:24 -04:00

..

__init__.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

admin.py

feat: canonical domain + encryption key bootstrap

2026-06-19 01:34:02 -04:00

advanced_ssl.py

Add advanced SSL: wildcard, SAN, custom certs, health checks

2026-03-23 02:15:16 -04:00

agent_plugins.py

Add agent plugin system with full lifecycle management

2026-03-23 02:08:00 -04:00

agent_poll.py

fix(agent): fail-closed agent registration + surface stuck-command errors

2026-05-31 16:08:13 -04:00

ai.py

feat(ai): add core AI assistant primitive powered by Prompture

2026-06-01 02:39:05 -04:00

api_analytics.py

Add Services UI and service-detail pages

2026-03-07 12:15:02 -05:00

api_keys.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

apps.py

feat(docker): horizontal auto-scaling (CPU thresholds, min/max, cooldown)

2026-06-19 10:13:50 -04:00

auth.py

feat(auth): WebAuthn / Passkey support

2026-06-19 01:33:45 -04:00

backups.py

Add dev launcher; harden backups & storage

2026-03-02 22:48:29 -05:00

builds.py

feat(workspaces): extend per-site ACL grants across all app blueprints (#33)

2026-06-05 23:04:06 -04:00

cloud_provisioning.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00

connections.py

Unify credential encryption + add a read-only connection registry (#18)

2026-06-15 10:47:59 -04:00

cron.py

Add cron job editing and tabbed route support

2026-03-03 22:11:30 -05:00

databases.py

feat(workspace): scope domains/databases + reconcile workspace roles (#33)

2026-06-15 21:00:57 -04:00

ddns.py

feat(dns): dynamic DNS — token-authenticated A/AAAA updates

2026-06-19 03:12:07 -04:00

deploy.py

feat(workspaces): extend per-site ACL grants across all app blueprints (#33)

2026-06-05 23:04:06 -04:00

deployment_jobs.py

Add deployment jobs and remote deployment runner

2026-04-29 00:39:16 -04:00

dns_zones.py

Add DNS zone management with provider integrations

2026-03-23 02:18:26 -04:00

docker.py

Add bulk container stats and UI workspace revamp

2026-05-03 06:12:39 -04:00

docs.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

domains.py

feat(workspace): scope domains/databases + reconcile workspace roles (#33)

2026-06-15 21:00:57 -04:00

email.py

Add registrars, GitLab, DO/Godaddy DNS and SMTP relay

2026-06-15 09:19:56 -04:00

env_vars.py

Add environment variable management feature

2026-01-18 00:40:41 -05:00

environment_pipeline.py

feat(wordpress): Phase-A glue — WP-CLI actions UI, sanitization wiring, promotion rollback, deep-links

2026-05-31 21:37:38 -04:00

event_subscriptions.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

files.py

Add S3 bucket browsing to the Files app (#14, #15)

2026-06-15 10:21:39 -04:00

firewall.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

fleet_monitor.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00

fleet.py

Add agent capability probing and reporting

2026-05-01 00:37:48 -04:00

ftp.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

git.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

gpu.py

feat(system): NVIDIA GPU monitoring

2026-06-19 10:08:58 -04:00

image_updates.py

feat(docker): image-digest update detection

2026-06-19 09:22:18 -04:00

invitations.py

Add invitations, email models, admin APIs

2026-03-04 02:34:49 -05:00

logs.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

marketplace.py

Improve plugin loading, API client & marketplace UI

2026-05-03 17:17:32 -04:00

metrics.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

migrations.py

Add SSO/OAuth and DB migration framework

2026-03-04 01:37:22 -05:00

mobile.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00

monitoring.py

Monitoring UI, public page & slug validation

2026-05-03 20:10:18 -04:00

nginx_advanced.py

Add Nginx advanced config: reverse proxy, load balancing, caching

2026-03-23 02:19:33 -04:00

nginx.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

notifications.py

Add database query runner and notification preferences

2026-01-18 03:10:55 -05:00

pairing.py

fix(pairing): require developer role for claim/lookup (audit L1)

2026-06-12 18:35:43 -04:00

performance.py

Add performance optimization: Redis caching and background jobs

2026-03-23 02:27:52 -04:00

php.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

plugins.py

Address Copilot review: plugin security + correctness

2026-05-17 11:21:08 -04:00

private_urls.py

feat(workspaces): extend per-site ACL grants across all app blueprints (#33)

2026-06-05 23:04:06 -04:00

processes.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

python.py

feat(workspaces): make python.py grant-aware — every app blueprint now covered (#33)

2026-06-05 23:08:44 -04:00

registrars.py

Add registrars, GitLab, DO/Godaddy DNS and SMTP relay

2026-06-15 09:19:56 -04:00

secrets_webhooks.py

feat: add secrets manager and inbound webhook gateway

2026-06-19 01:33:46 -04:00

security.py

feat(security): per-image CVE scanning (grype) and SBOM generation (syft)

2026-06-19 01:33:45 -04:00

server_templates.py

Add server templates with config drift detection and compliance

2026-03-23 02:11:16 -04:00

servers.py

feat(workspace): scope domains/databases + reconcile workspace roles (#33)

2026-06-15 21:00:57 -04:00

source_connections.py

Add registrars, GitLab, DO/Godaddy DNS and SMTP relay

2026-06-15 09:19:56 -04:00

ssl.py

Add standalone WordPress and SSL management UI

2026-01-25 22:48:12 -05:00

sso.py

Add audit fallback, builtin extensions, and ports

2026-05-03 15:57:02 -04:00

status_pages.py

Add status pages with health checks and incident management

2026-03-23 02:22:53 -04:00

system.py

feat: canonical domain + encryption key bootstrap

2026-06-19 01:34:02 -04:00

templates.py

feat(workspaces): extend per-site ACL grants across all app blueprints (#33)

2026-06-05 23:04:06 -04:00

tunnels.py

feat(remote-access): NAT-traversing WireGuard tunnels to expose private services

2026-06-15 23:20:00 -04:00

two_factor.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

uptime.py

Add server uptime tracking and visualization

2026-01-17 13:37:40 -05:00

waf.py

feat(security): per-app WAF (ModSecurity v3 + OWASP CRS)

2026-06-19 14:02:24 -04:00

wordpress_sites.py

feat(wordpress): finish Phase-A glue — create hardening, real URLs, offsite snapshots, push-to-deploy, API keys

2026-05-31 22:39:57 -04:00

wordpress.py

feat(wordpress): per-site PHP-fatals analytics from the WP_DEBUG log (#25)

2026-06-15 22:06:58 -04:00

workflows.py

Add workflow automation engine and triggers

2026-03-23 01:30:51 -04:00

workspaces.py

feat(workspace): scope domains/databases + reconcile workspace roles (#33)

2026-06-15 21:00:57 -04:00