Juan DenisandClaude Opus 4.8 ada030553a feat(security): per-app WAF (ModSecurity v3 + OWASP CRS) ...

- WafPolicy model (per app: mode off/detect/block, paranoia level, anomaly
  threshold, disabled CRS rule ids).
- WafService: render_rules (SecRuleEngine + CRS include + paranoia/anomaly +
  SecRuleRemoveById), nginx_snippet, install/status (distro-aware,
  best-effort), apply() that writes per-app rules under
  /etc/nginx/serverkit-conf.d/waf and idempotently injects an include into
  the app vhost (graceful manual_include fallback), and audit-log event
  parsing.
- API /api/v1/waf: per-app policy GET/PUT, apply, events, install status.
- 29 tests: rule rendering per mode, rule-disable, nginx snippet, policy
  validation, audit-log parsing, API round-trip + auth.

Backend only; WAF UI + verified install on a real nginx+ModSecurity host are
follow-ups. Integration is additive — existing nginx/site management untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-19 14:02:24 -04:00

..

__init__.py

feat(security): per-app WAF (ModSecurity v3 + OWASP CRS)

2026-06-19 14:02:24 -04:00

agent_plugin.py

Add agent plugin system with full lifecycle management

2026-03-23 02:08:00 -04:00

ai.py

feat(ai): add core AI assistant primitive powered by Prompture

2026-06-01 02:39:05 -04:00

api_key.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

api_usage.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

application.py

feat(docker): container auto-sleep (policy, manual sleep/wake, idle sweep)

2026-06-19 09:54:40 -04:00

audit_log.py

Add audit fallback, builtin extensions, and ports

2026-05-03 15:57:02 -04:00

cloud_server.py

Backend fixes, API renames, and style utilities

2026-03-23 21:25:40 -04:00

container_scale_policy.py

feat(docker): horizontal auto-scaling (CPU thresholds, min/max, cooldown)

2026-06-19 10:13:50 -04:00

container_sleep_policy.py

feat(docker): container auto-sleep (policy, manual sleep/wake, idle sweep)

2026-06-19 09:54:40 -04:00

ddns_host.py

feat(dns): dynamic DNS — token-authenticated A/AAAA updates

2026-06-19 03:12:07 -04:00

deployment_job.py

Add deployment jobs and remote deployment runner

2026-04-29 00:39:16 -04:00

deployment.py

Refactor to consistently use app.root_path and update deployment model

2026-01-18 04:20:30 -05:00

dns_zone.py

Add DNS zone management with provider integrations

2026-03-23 02:18:26 -04:00

domain.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

email.py

Add registrars, GitLab, DO/Godaddy DNS and SMTP relay

2026-06-15 09:19:56 -04:00

env_variable.py

Add environment variable management feature

2026-01-18 00:40:41 -05:00

environment_activity.py

Add WordPress environment pipeline API and models

2026-01-27 19:35:21 -05:00

event_subscription.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

exposed_service.py

feat(remote-access): NAT-traversing WireGuard tunnels to expose private services

2026-06-15 23:20:00 -04:00

image_scan.py

feat(security): per-image CVE scanning (grype) and SBOM generation (syft)

2026-06-19 01:33:45 -04:00

image_update.py

feat(docker): image-digest update detection

2026-06-19 09:22:18 -04:00

invitation.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

marketplace.py

Add plugin contributions system, SDK, and integration

2026-05-03 13:54:40 -04:00

metric_alert.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

metrics_history.py

Add WordPress environment pipeline API and models

2026-01-27 19:35:21 -05:00

notification_preferences.py

Add database query runner and notification preferences

2026-01-18 03:10:55 -05:00

oauth_identity.py

Add SSO/OAuth and DB migration framework

2026-03-04 01:37:22 -05:00

passkey.py

feat(auth): WebAuthn / Passkey support

2026-06-19 01:33:45 -04:00

pending_agent.py

Add short-code agent pairing flow

2026-04-29 03:08:21 -04:00

plugin.py

Add plugin contributions system, SDK, and integration

2026-05-03 13:54:40 -04:00

promotion_job.py

Add WordPress environment pipeline API and models

2026-01-27 19:35:21 -05:00

registrar_connection.py

Encrypt provider secrets at rest + add Namecheap registrar (#16, #17)

2026-06-15 10:33:09 -04:00

sanitization_profile.py

Add WordPress environment pipeline API and models

2026-01-27 19:35:21 -05:00

secret_vault.py

feat: add secrets manager and inbound webhook gateway

2026-06-19 01:33:46 -04:00

security_alert.py

Implement security features: key rotation, IP allowlist, anomaly detection

2026-01-22 18:11:22 -05:00

server_template.py

Add server templates with config drift detection and compliance

2026-03-23 02:11:16 -04:00

server.py

feat(workspaces): workspace_id scoping foundation + safe backfill (#33)

2026-06-01 03:36:24 -04:00

source_connection.py

Add registrars, GitLab, DO/Godaddy DNS and SMTP relay

2026-06-15 09:19:56 -04:00

status_page.py

feat(wordpress): per-site uptime + auto-incidents (#26)

2026-06-01 00:47:26 -04:00

system_settings.py

Add admin panel with user, settings, and audit log management

2026-01-18 05:01:49 -05:00

tunnel.py

feat(remote-access): NAT-traversing WireGuard tunnels to expose private services

2026-06-15 23:20:00 -04:00

user.py

feat(auth): WebAuthn / Passkey support

2026-06-19 01:33:45 -04:00

waf_policy.py

feat(security): per-app WAF (ModSecurity v3 + OWASP CRS)

2026-06-19 14:02:24 -04:00

webhook_gateway.py

feat: add secrets manager and inbound webhook gateway

2026-06-19 01:33:46 -04:00

webhook.py

Add git webhook and deployment management APIs

2026-01-21 21:31:57 -05:00

wordpress_site.py

feat(wordpress): monthly client reports — persisted per-month rollups (#33)

2026-06-01 03:04:03 -04:00

workflow.py

Add workflow engine, models, API & UI

2026-03-23 01:10:28 -04:00

workspace.py

feat(workspaces): per-resource access grants — per-site ACL backend (#33)

2026-06-01 11:59:34 -04:00