gtiandClaude Opus 5.5
91a2dda969
GTI terminates TLS in its Nginx Proxy Manager (10.0.10.100), not on the Hub host, so the Hub must be reachable on the LAN — by the proxy only. - docker-compose.prod.yml passes FORWARDED_ALLOW_IPS (uvicorn then trusts X-Forwarded-For/-Proto from the proxy only: real client IPs in audit and session records, https scheme) and WEB_COOKIE_SECURE. Defaults keep the previous behaviour. - restrict_hub_port.sh + gti-fiscal-hub-port.service: Docker-published ports bypass UFW, so the source restriction lives in DOCKER-USER, matched on the conntrack original destination with --ctdir ORIGINAL, and is re-applied whenever docker.service starts (the chain is not persisted across reboots). - *.service forced to LF like *.sh; tests cover both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
7 lines
329 B
Plaintext
7 lines
329 B
Plaintext
# Shell scripts run on the Linux Hub host. With core.autocrlf=true on the
|
|
# Windows release machine, `git archive`/checkout would otherwise ship them
|
|
# with CRLF and `sh` rejects them ("set: Illegal option -").
|
|
*.sh text eol=lf
|
|
# systemd units are parsed on the same host; a trailing \r corrupts ExecStart.
|
|
*.service text eol=lf
|