v2.31.0-dev3 cbca441

2026-04-03

cbca441Merge pull request #160 from bnema/fix/podman-rootless-friction merge GPG Unverifiedtag v2.31.0-dev3bnema
b33054eMerge branch 'main' into fix/podman-rootless-friction merge GPG Unverifiedbnema
e0293e4fix(podman): resolve named runtimes and detect container crashes GPG Verifiedbrice
8f1e1e6Merge pull request #159 from bnema/fix/preserve-x-forwarded-proto merge GPG Unverifiedbnema
17213faMerge branch 'main' into fix/preserve-x-forwarded-proto merge GPG Unverifiedbnema
01d3159fix(proxy): handle bare IPs in isTrustedSource RemoteAddr GPG Verifiedbrice
f9f7402fix(proxy): preserve X-Forwarded-Proto from trusted upstream proxies GPG Verifiedbrice
1fd432aMerge pull request #157 from bnema/chore/update-deps-2026-04-03 merge GPG Unverifiedbnema
339b92dchore(deps): update all Go dependencies GPG Verifiedbrice
2bb8b58Merge pull request #156 from bnema/refactor/human-readable-sizes merge GPG Unverifiedbnema
d913a6eMerge pull request #155 from bnema/feat/dedicated-access-log merge GPG Unverifiedbnema
3865a9dfix: correct docstring reference, wrap init errors, add control char escape tests GPG Verifiedbrice
6b418bdrefactor: move access log port to boundaries/out, fix hex arch violations GPG Verifiedbrice
7121811fix: escape all ASCII control chars in CLF/Combined access log fields GPG Verifiedbrice
01b6bc5fix: address coderabbit findings on access log GPG Verifiedbrice
be4bda7refactor: address simplify review findings for access log feature GPG Verifiedbrice
9e9308crefactor: reuse IsTrustedProxy for loopback check; promote go-systemd to direct dep GPG Verifiedbrice
c9b8983test: add outer-deny access log coverage for loopback and fail-closed paths GPG Verifiedbrice
2147872feat: wire access log config and middleware into application bootstrap GPG Verifiedbrice
aa3dd1dfeat: add access log middleware with health-check exclusion GPG Verifiedbrice
24781f9feat: add access log output adapter with JSON/CLF/Combined formats GPG Verifiedbrice
487e687fix: normalize client_ip to clean IP without port in all log fields GPG Verifiedbrice
64b95f6refactor: add bytesize.Format helper, use human-readable sizes everywhere GPG Verifiedbrice

2026-04-02

18b726bMerge pull request #152 from bnema/dependabot/go_modules/github.com/pelletier/go-toml/v2-2.3.0 merge GPG Unverifiedbnema
4b72742Merge pull request #154 from bnema/feat/http-ca-onboarding-hardening merge GPG Unverifiedtag v2.31.0-dev2bnema
ed50492fix: address PR review findings for HTTP CA onboarding hardening GPG Verifiedbrice
d69dfa0test: harden HTTP onboarding coverage GPG Verifiedbrice

2026-04-01

0b996abtest direct HTTP onboarding HEAD routes GPG Verifiedbrice
7fff706refactor: reuse trusted-or-local helper in HTTPS redirect GPG Verifiedbrice
6521b77fix: simplify onboarding redirect link handling GPG Verifiedbrice
39cdcd8docs: clarify HTTP onboarding comment intent GPG Verifiedbrice
29b9578refactor: consolidate RemoteAddr/trust helpers and host-port mapping GPG Verifiedbrice
8739892fix: remove unnecessary fmt.Sprintf around constant string GPG Verifiedbrice
6c74ee7http: add comment for ignored Atoi error, add request logging to onboarding gate GPG Verifiedbrice
ef180bcdocs: explain internal CA onboarding and client trust setup GPG Verifiedbrice
956a990feat(http): restrict direct HTTP to CA onboarding GPG Verifiedbrice
f0b7906fix(http): derive public redirect URLs from request host GPG Verifiedbrice
aab20abfix(onboarding): correct public URLs and client trust guidance GPG Verifiedbrice
67f96d9Merge pull request #153 from bnema/feat/internal-ca-ondemand-tls merge GPG Unverifiedtag v2.31.0-devbnema
937d56dfix(app): handle error from srv.Shutdown in closeStarted cleanup GPG Verifiedbrice
b1d7815fix(pki): derive cache expiry from real leaf NotAfter; extract validateLoadedIntermediate GPG Verifiedbrice

2026-03-31

29dcc3bfix: address CodeRabbit review findings GPG Verifiedbrice
2604a62fix: harden PKI lifecycle, middleware coverage, and startup cleanup GPG Verifiedbrice
67e87d2fix: address all findings from deep code review GPG Verifiedbrice
a6947b2feat(server): add custom TLS certs, HTTPS redirect, and atomic intermediate store GPG Verifiedbrice

2026-03-30

5bf3a89refactor(pki): simplify after code review GPG Verifiedbrice
450331cfix(pki): add control character check to domain validation GPG Verifiedbrice
63f113efeat(server): add tls_port=0 opt-out and use unprivileged default ports GPG Verifiedbrice

2026-03-29

30b9539security(pki): harden internal CA and onboarding endpoints GPG Verifiedbnema
6cb035cfix(pki): use append in RootFingerprint to satisfy gosec G602 GPG Verifiedbrice

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close