Proxy / base-URL:
- ORCHESTRAD_TRUSTED_PROXIES now defaults to "local", trusting reverse
proxies in loopback + RFC1918 + link-local/ULA ranges out of the box, so
X-Forwarded-* (client IP, scheme, host) is honored behind an edge proxy
without extra config. New keywords: local/private, all/any, none.
- OIDC redirect URI derivation now uses the trust-gated request base URL
instead of reading X-Forwarded-Proto directly, and audit client IP now
trusts the middleware-rewritten RemoteAddr rather than the raw (spoofable)
X-Forwarded-For header. Both honor forwarded values only from trusted
peers.
Schedules:
- Seed eight built-in schedules on startup (every 5/15/30 min, hourly,
every 6/12h, daily, weekly), idempotent by name, so operators have
ready-made cadences in the Schedules page and the rule editor's schedule
dropdown without hand-building one.
Test covers the trusted-proxy keyword expansion.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two server-layer changes that were developed together because they
share the same routing rewrite:
- proxy.go: TrustedProxy middleware inspects RemoteAddr against the
operator-configured CIDR list (ORCHESTRAD_TRUSTED_PROXIES) and, only
when the peer matches, rewrites r.RemoteAddr and r.URL.Scheme from
X-Forwarded-For / X-Forwarded-Proto. Untrusted peers are ignored so
downstream handlers and the audit log see the direct connection
address, preventing header spoofing.
- server.go: /api/v1 is split into a public surface (version, health,
auth login/logout/csrf) and an authenticated group that now wraps
/users, /credentials, /ad-connections, /schedules, /rules, /rule-runs,
/backups, /api-keys, /audit, /settings, /dashboard, and /config with
AuthMiddleware. Previously only /auth/me and two /api-keys routes
were protected; every other administrative endpoint was reachable
without a token, which was a real security bug.
Alphaeus Mote