4 Commits

Include renames

Author	SHA1	Message	Date
pmb	da4fa18525	Add FINGER_BAN_ALLOWLIST to exempt trusted front-end IPs from banning ... The per-IP ban tracker treats every globally-routable client equally, but an aggregating front-end like the finger-web proxy funnels the whole internet's federated lookups through a single IP. A burst from any one client of the proxy (or a load test) is then attributed to the proxy's IP and, once it crosses the failure threshold, the daemon blocks the proxy — taking out finger lookups for everyone. Per-client abuse protection for the proxied path belongs in the proxy (which now rate-limits per real client IP), so the daemon should trust it. Add a FINGER_BAN_ALLOWLIST env var (comma-separated IPs). Allowlisted addresses are marked non-trackable in the listener, so their connections are never blocked and never recorded as offenses. Unset = unchanged behaviour. - parse_ip_allowlist() in ban.cpp (trims entries, skips blanks) + unit tests - listener() consults the set when computing 'trackable' - documented in docker-compose.yml and DOCKER.md	2026-06-17 10:44:47 -07:00
pmb	b1e7f5229b	docs(docker): run as root under host networking to bind port 79 ... Host networking shares the host net namespace, so the host's privileged-port rule applies and the image's non-root user cannot bind 79 -- the daemon fails to listen silently. Add user: "0:0" to the compose and correct the earlier (wrong) claim that non-root bind still works. Note setcap as the non-root alternative.	2026-06-15 16:54:47 -07:00
pmb	54650af252	Only track bannable (globally-routable) source IPs ... The ban logic is per source IP, so it only works where the daemon can see the real client. Behind Docker's default bridge networking every client is SNAT'd to the bridge gateway (a 172.16/12 address), so a single IP would stand in for the whole internet -- counting offenses against it would block everyone at once. Add is_bannable_address(): only globally-routable unicast addresses are tracked. Loopback, RFC1918 private, CGNAT (100.64/10), link-local, IPv6 unique-local, and multicast all return false. main.cpp decides trackability from the accepted endpoint and skips both the block check and offense recording for non-global sources. Net effect: banning works where the real IP is visible (FreeBSD jail via pf rdr; Docker with host networking) and is inert -- not catastrophic -- where it is not (Docker bridge). Document the Docker client-IP caveat: docker-compose.yml now defaults to host networking, with the rationale and alternatives in DOCKER.md.	2026-06-15 16:38:07 -07:00
pmb	4d97255d3a	Docker support	2025-07-02 17:11:31 -07:00