20 Commits

Author	SHA1	Message	Date
Gan, Jimmy	a0354c335b	fix: trust docker gateway IP for reverse proxy auth	2026-02-27 23:48:34 +08:00
Gan, Jimmy	3888a57642	chore: secure dashboard proxy endpoint and decouple lan checks	2026-02-27 23:41:36 +08:00
Gan, Jimmy	c676c84bc1	feat: add chat group daily summarizer ... - Telegram collector (Telethon MTProto) with checkpoint-based message fetching - Claude API summarization via proxy (haiku model) - Dashboard page with date picker, markdown summary, raw message drill-down - Separate container lifecycle from dashboard for stable Telethon sessions - Shared SQLite DB mounted read-only into dashboard	2026-02-27 02:51:52 +08:00
Gan, Jimmy	7f94013bf9	feat: add Caddy VPS terminal connection	2026-02-27 00:26:01 +08:00
Gan, Jimmy	394a1aa367	security: harden dashboard (SSH keys, auth, uploads, CORS, non-root) ... Remove SSH private keys from git, add SECRET_KEY validation, move WS auth from query string to first message, add session limits/idle timeout, PBKDF2 Fernet key, refresh token rotation, TOTP replay protection, file upload size limit + filename sanitization, symlink safety check, restrict CORS methods, IP-gate OpenClaw token, run container as non-root, rate-limit refresh/passkey endpoints, sanitize Gitea path params. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-02-26 17:22:25 +08:00
Gan, Jimmy	332696689a	fix: support port 8443 origin for WebAuthn passkeys and CORS	2026-02-26 02:00:29 +08:00
Gan, Jimmy	87fdabcd50	Fix OpenClaw: auto-include gateway token in dashboard link	2026-02-22 18:30:34 +08:00
Gan, Jimmy	be1f3b3ad6	Add security improvements: refresh tokens, passkeys, CSP, audit logging, TOTP encryption ... - Shorten access token to 30min with 7-day refresh token flow - Add WebAuthn passkey registration and login with TOTP fallback - Add Content-Security-Policy header - Add audit logging middleware to /volume1/docker/nas-dashboard/audit.log - Block /volume1/docker/ in files endpoint - Encrypt TOTP secret at rest with Fernet (derived from SECRET_KEY) - New deps: py_webauthn, cryptography	2026-02-22 11:04:40 +08:00
Gan, Jimmy	b1dee47126	Add CORS, rate limiting, security headers, and files endpoint protection	2026-02-21 11:18:29 +08:00
Gan, Jimmy	dd3e8e0d2c	security: remove hardcoded secrets, add health endpoint, add security headers	2026-02-20 22:04:01 +08:00
Gan, Jimmy	b063382085	feat: add container monitor & telegram alerts ... Added asyncio monitoring task to main.py to watch Docker container state transitions and send Telegram notifications on failures.	2026-02-20 10:31:18 +08:00
Gan, Jimmy	a882f45f2e	Add multi-host terminal: NAS + VPS side-by-side	2026-02-20 00:53:29 +08:00
Gan, Jimmy	197b7c1cbb	Fix session expiry: use config value, increase to 7 days ... - LOGIN was ignoring ACCESS_TOKEN_EXPIRE_MINUTES (hardcoded 15min default) - Pass expires_delta from config in login route - Increase token lifetime from 30min to 7 days	2026-02-19 19:44:30 +08:00
Gan, Jimmy	ee2e5dcb3c	Terminal: SSH to NAS host instead of container shell ... - Rewrite terminal.py to use asyncssh instead of pty/fork - Add SSH key pair for dashboard container auth - Mount SSH key and add SSH config vars in docker-compose - Install openssh-client in Dockerfile - Add asyncssh to requirements.txt	2026-02-19 19:24:38 +08:00
Gan, Jimmy	4036292273	Bump version to v1.3 — runner DNS fixed	2026-02-19 10:26:40 +08:00
Gan, Jimmy	91c8d1b775	Bump version to v1.2 — CI/CD pipeline test	2026-02-19 10:18:32 +08:00
Gan, Jimmy	7aeabe1839	Test CI/CD: add version comment	2026-02-19 10:15:14 +08:00
Gan, Jimmy	75c89b1ef9	Fix auth crashes + add CI/CD workflow ... - Fix jose->pyjwt import mismatch - Fix bcrypt->pbkdf2 password hashing - Fix Sidebar logout prop (ReferenceError) - Add .gitea/workflows/deploy.yml for automated deployment	2026-02-19 10:04:38 +08:00
Gan, Jimmy	651bc0580e	Phase 7: Auth & Security upgrade (JWT, 2FA, Login UI)	2026-02-19 03:47:48 +08:00
Gan, Jimmy	70aa421d7f	Add NAS dashboard MVP: Docker mgmt, Gitea, Files, Terminal	2026-02-19 01:59:50 +08:00