cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(deploy): select verified proxy subnet
CI and Deploy / test (pull_request) Successful in 5m21s
Details
CI and Deploy / test (push) Successful in 5m18s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details
CI and Deploy / deploy (push) Failing after 2m38s
Details

Browse Source
This commit is contained in:
cesnimda
2026-08-24 20:53:51 +02:00
parent c4b81918c4
commit fb90d0ad33
2 changed files with 66 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/verification/sec-002-ingress-compose.md
+1 -1
View File
@@ -32,7 +32,7 @@ No image was pulled and no production or persistent service was changed. Ephemer
## Limitations and production gates
- No Traefik configuration exists in this repository. Verify its exact `Host()` rule, TLS route, replacement of forwarding headers, selected Docker network, and hostile-Host rejection on the operator host.
- `WEB_PROXY_SUBNET` must be chosen after production Docker-network inventory; the example value is not a production fact. Deploys may recover a missing value only from the existing Compose `web_proxy` network, preserving the already-running production CIDR without guessing a new one.
- `WEB_PROXY_SUBNET` must be chosen after production Docker-network inventory. Deploys recover a missing value from a uniquely labelled existing Compose `web_proxy` network. On its first creation, the documented `172.31.250.0/29` candidate is accepted only after a complete Docker network inventory proves it does not overlap; unreadable or overlapping inventory remains fail-closed.
- Host firewall and `docker ps`/published-port state are unverified.
- The exact `nginx:1.29.8-alpine` base image was not installed locally. Syntax was checked with the existing local nginx frontend image; approved CI must build the pinned Dockerfile.
- A complete local proxy/browser smoke was not run because rebuilding the pinned container would require an unavailable base image/package access. No browser claim is made.