84a56c80de
Security (33 pentest findings addressed): - CRITICAL: backend binds 127.0.0.1, path traversal in tor.rs/dwn fixed - HIGH: federation requires signatures, XSS login redirect, RBAC viewer restricted - HIGH: tar slip prevention, S3 SSRF validation, backup ID validation - MEDIUM: remember-me random secret, TOTP session rotation, password re-auth - LOW: CSP unsafe-inline removed, CORS dev-only, onion/webhook validation Container reliability: - Memory limits on all 37 containers (OOM prevention) - Exited vs stopped state distinction with health-aware status badges - Crash recovery coordination (no more restart cascade) - User-stopped tracking survives reboots - Tiered boot recovery (databases → core → services → apps) UI: - Wallet TransactionsModal, health-aware app status badges - Restart button on containers, exited/crashed red state - Mesh view overhaul, glass button updates, BaseModal/ToggleSwitch - Apps sticky header removed, dev faucet, mutable mock wallet Infrastructure: - LND REST port 8080 exposed over Tor (LND Connect fix) - Nginx cookie_session fix, deploy script Tor config updated - Dev environment: podman auto-start, boot mode simulation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1.2 KiB
1.2 KiB
name, description, type
| name | description | type |
|---|---|---|
| Four Environments | Clear distinction between dev mode (local mock), dev server (228), demo (Portainer), and prod (same as dev server) | project |
Four distinct environments — use correct terminology:
| Name | What | Where | Backend | Deploy |
|---|---|---|---|---|
| Dev mode | Local macOS, mock backend | localhost:8100 |
mock-backend.js on :5959 |
npm run dev:mock |
| Dev server / Prod | Primary build/test/live server | 192.168.1.228 (+ fleet) |
Real Rust backend + Podman | deploy-to-target.sh --live |
| Demo | Public demo instance | Remote server | Mock Node.js via Docker | Portainer Stacks / docker-compose.demo.yml |
- Dev server and prod are the SAME machine (192.168.1.228) — "prod" just means "the live deployment"
- Demo is completely separate — user deploys via Portainer UI, Claude has no SSH access
- Dev mode is local-only, no containers needed, fastest iteration
Why: User corrected ambiguous usage of "dev servers (prod)" — these are the same thing, not two separate environments.
How to apply: Always say "dev mode" for local mock, "dev server" or "prod" for 228, "demo" for the Portainer instance. Never conflate them.