B4L/buildfor_life_repair
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
82 Commits 1 Branch 0 Tags
dc9217f3b6548e95212069fa005da16c0e981ad1
Commit Graph
5 Commits
Author SHA1 Message Date
grabowskiandClaude Opus 4.6 0ceee55f9b Replace SvelteKit CSRF with custom multi-origin check
Deploy to LXC / deploy (push) Successful in 19s
Details 
SvelteKit's built-in CSRF only allows one origin, breaking access via
NetBird/Yggdrasil/Tor IPs. Now:
- Disabled checkOrigin in svelte.config.js
- Custom CSRF in hooks.server.ts checks Origin against ALLOWED_ORIGINS
- ALLOWED_ORIGINS env var: comma-separated list of trusted origins
- Caddy no longer needs to rewrite Host/Origin headers
- Each access method (public domain, NetBird IP, Yggdrasil, Tor onion)
  just needs its URL added to ALLOWED_ORIGINS

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 14:23:02 +07:00
grabowskiandClaude Opus 4.6 dbc140c1f9 Fix CSRF 403: override Origin header in Caddy proxy snippet
Deploy to LXC / deploy (push) Successful in 18s
Details 
SvelteKit checks the browser's Origin header, not just Host or
X-Forwarded-Proto. Rewrite Origin to https://collection.newedge.house
so CSRF passes on all non-public routes (NetBird, Yggdrasil, Tor).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 14:18:56 +07:00
grabowskiandClaude Opus 4.6 d41ff1112d Fix Caddy proxy: hardcode X-Forwarded-Proto to https on all routes
Deploy to LXC / deploy (push) Successful in 18s
Details 
SvelteKit expects ORIGIN=https://... so all routes must send
X-Forwarded-Proto: https regardless of actual connection scheme.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 14:15:02 +07:00
grabowskiandClaude Opus 4.6 392747e639 Update Caddy guide: upstream TLS, NetBird, Tor, Yggdrasil
Deploy to LXC / deploy (push) Successful in 19s
Details 
Rewritten for the actual architecture: separate upstream Caddy handles
TLS for public domain, LXC Caddy only does HTTP. Added NetBird
interface binding, explicit per-interface blocks, upstream Caddy
config snippet.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 14:08:28 +07:00
grabowskiandClaude Opus 4.6 e6c213f35c Add Caddy reverse proxy guide for internal, Tor, and Yggdrasil access
Deploy to LXC / deploy (push) Successful in 20s
Details 
Caddyfile config with shared proxy snippet that sets Host header for
CSRF compatibility. Handles:
- Public domain with auto HTTPS (Let's Encrypt)
- LAN/internal on port 80
- Tor hidden service via localhost:8880
- Yggdrasil IPv6 on port 80

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 14:02:01 +07:00