fix(deploy): add security headers and body cap to Caddyfile-v2#26
Merged
Conversation
Port CSP, Referrer-Policy, Permissions-Policy, X-XSS-Protection, and the -Server header stripping from the legacy Caddyfile. Add request_body max_size 1MB to the api.rustokwallet.com block to limit large-POST abuse. I3 (redis persistence) is out of scope — Redis was removed from deploy-v2 in chore/deploy-v2-drop-redis.
temrjan
added a commit
that referenced
this pull request
Jun 22, 2026
## Why Changes landed in `core`/`meta` after 2026-06-15, but the `meta` docs (dated 06-15) lagged: they still described 13 crates, a Redis Streams event bus, and a `rustok-redis` service that no longer exist. ## What - **`docker-compose.yml`** — drop the dead `redis` service, `RUSTOK_REDIS_URL`, and `depends_on: redis`. Verified `core` reads **0** Redis refs (`config.rs` reads `RUSTOK_ALLOWED_CHAINS`/`ALCHEMY`/`RPC_URLS`, kept); `prod`/`obs` overlays don't reference redis; shape now matches `deploy-v2` (meta #25). - **`README.md`** — remove "+ Redis" from the base-stack description. - **`PROJECT-OVERVIEW.md`** — 13→12 crates (drop `events`); architecture diagram `Redis Streams → audit` → `direct → SQLite WAL`; add **Audit** bullet; drop `rustok-redis` from deploy/`docker ps`; date notes. - **`PROJECT-STATUS.md`** — 13→12 crates (×2); add a dated Completed row (2026-06-17→19) for the Redis decommission (#63/#64, deploy-v2 #25), hardening (#65/#67), CI (#66/#68, meta #26), and the mcp tails (#41/#42/#44/#45); mark the now-done Next-Steps items; date bump. ## Notes - Docs-only + one dead-config removal in the base compose. Fully reversible. - Redis decommissioned **2026-06-17** (core #63/#64; deploy-v2 meta #25). - Not validated with `docker compose config` locally (docker not installed) — YAML syntax checked; CI will validate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Port the remaining security headers and request-body limit from the legacy Caddyfile to deploy-v2/Caddyfile-v2.
Validated locally: caddy fmt --check && caddy validate for Caddyfile-v2.