From f20b7de05321e08e5e80e32dc649a866d8fa03c9 Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Wed, 2 Sep 2026 23:37:30 +0200 Subject: [PATCH] hygiene: prepare VacatureRadar for public release --- .env.unraid.example | 4 ++-- .gitea/workflows/managed-validation.yml | 2 ++ SECURITY.md | 3 ++- deploy-log.txt | Bin 40150 -> 0 bytes docs/ai/PROJECT_STATE.md | 2 +- docs/operations/UNRAID_DEPLOYMENT.md | 2 +- tests/unit/test_public_configuration.py | 6 +++--- 7 files changed, 11 insertions(+), 8 deletions(-) delete mode 100644 deploy-log.txt diff --git a/.env.unraid.example b/.env.unraid.example index 797e9ae..5b46862 100644 --- a/.env.unraid.example +++ b/.env.unraid.example @@ -16,8 +16,8 @@ DJANGO_SECRET_KEY=CHANGE_ME_generate_at_least_50_random_characters DJANGO_DEBUG=0 # Leeg laten tot er een publieke HTTPS-URL is. PUBLIC_BASE_URL= -DJANGO_ALLOWED_HOSTS=192.168.10.150,127.0.0.1,localhost -DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.10.150:1226,http://127.0.0.1:1226 +DJANGO_ALLOWED_HOSTS=vacatureradar.local,127.0.0.1,localhost +DJANGO_CSRF_TRUSTED_ORIGINS=http://vacatureradar.local:1226,http://127.0.0.1:1226 DJANGO_TIME_ZONE=Europe/Brussels VACATURERADAR_OWNER_NAME=Jens VACATURERADAR_VERSION=0.3.12 diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml index 055c2a6..6358a59 100644 --- a/.gitea/workflows/managed-validation.yml +++ b/.gitea/workflows/managed-validation.yml @@ -21,6 +21,8 @@ concurrency: jobs: full: name: full + # Public fork code must never execute automatically on the private runner. + if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }} runs-on: ubuntu-latest timeout-minutes: 30 container: diff --git a/SECURITY.md b/SECURITY.md index 4989a7e..c61cdf9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -38,7 +38,8 @@ Deze data mag nooit shell-, netwerk-, e-mail-, bestandssysteem- of sollicitatiea ## Kwetsbaarheid melden -Maak geen publieke issue met secrets of persoonlijke vacaturegegevens. Documenteer intern: +Maak geen publieke issue met secrets of persoonlijke vacaturegegevens. Meld een +kwetsbaarheid privé via `security@itworx.tech` en vermeld: 1. component en versie/commit; 2. reproduceerbare stappen met synthetische data; diff --git a/deploy-log.txt b/deploy-log.txt deleted file mode 100644 index 56ea08a17fec1b1e54eadda979f4e02a2eb70864..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 40150 zcmeI5`)(V@6^Hll0(}RykNf6hU#Hi!AlHH;(QbPB*kz_}*-KZ$~Kz)(E zK%b}W@0-J;ndR<^vlMl4upme-_cD9#x0$p2-+%vDY!=&kzboDs$Hi{3uI(MYkBgrd zKP!Gw%on}lRq?tw(iywjd!%Cr#kbmfP`nA}+7@FRXz!N3zt@>Pjj~(pg)3j{+SfY! zs5nVRFfF5 zotjbZ>56%cwIB?>512YO&@jcBvCBBmmvCOxaj1Hts}70}+Un`fhk|cEY;T9r;EB=u zjn1}vIA(W}^Y0b2dZiHeb@a{1zVaE24Q1{Hj8=y<0j@IKYbCgsE*Xk1bhqzB1te)j zux;vlRhaGR*P6cP1o38ZSI1YiZ%dyGIFB)nEa=#Lv8X+Zx)Qlw(cbytd2702 zS7&gJjmXh0y}84JKJV(f9lbX7y{L0dLc#h$abNGRB*PEGUOTd^BjaTEP~*JQh>XfN zvRdV*bL>ET*%G(W>r-*?tv=t0CP>#k!PF1<-4UHQ^RT!RWcYRQqkcKOKoz-Y5}Rt= z%7vib7c|>~&LQ3uET%^Xf(HK0O4~jNTC`(6e9jFi$(_rPE$RwrY4lvpfUGY{Mh!

kXb^NjH@i)cS+M0|$qmsWWS=G-R_f3sY7bTu||R%7CMB2`kJx#V0-)<-F} zB8*pc?|IQ>Ezk=*pwf&9F?8`I^`D2Ln~2_KUtz$|`rhd%=e*N+=#0e; z$g#g%L(1otp#=U@UD1pM@{esf3|exe`(O*Ube5HVW*LEK6%L8S7w z_#trNtwsVrbe-crgfZAAKRD4yrpd&*=<`XyjqMNNxJ5)|437mF7!b!J_a6k&vA*rj zrq%C;zq$8`wtsylH_*I^9~Nhf@?%NYo8S7Aba%b@y)5|?eMbx8yyp6*vGJKzIbS;) z`yw(~rq8x)+@a`BR`iMD8K{a~dmW_6sL|KH?{vgpCOc_V+0z)Cl5q3jeO-&(AQ?!z z>Az75DcIIAmnkIft@wzf`pd>Yl#hY$X1THMZi8oov~i3`IPS%s>eV(nR+~>?$ zor`vyFF{b~P4PFu3Dj`X>^qr-c^!wqIScoiIE!y5Zba5iCoCVvHm3QTkJWVkf$n}9 zAP3)a<~T12>M4~kmePiEXyC?RSdHzeI!0vlBeI&K60Hc9VMb8#$gXp z4pEO~Q^ZL`gL`@rGZG6ECv0hpJc-zGTfbMeMFh317iTW%Dq+c$47SGG!gmHryznpVBZOxivmw+1ofUWf$tuA}B%sCym z{>~>u-6PBB1?!cETTj`D)jQq==&N>H4yTJ=7hrs2+E@c6jb;T3C<8Z#AOx82`=7A^T@>Q(i#iwhEd( z5EY35_k&KK%HAIZ-upS}H+*~+D7z6X&$c*%SH#D0Y)0>V2~N3uuh@Af5PqtI~~P^H`k2YM&N=&=&DZgz%BZM>39uBOb%B0sGg2dRLUN zSO6W^(Y^d^yN7*p4iZ8g4Ozs#|53kEiCEWf(^+WuK<7}iaa(rraiI33qd;Y}=AzKV zaU7awstoswS3FY;k{)T=-q6VF;>8nP`)GK@1MPXF zF<$8N{82V^4(Gj;95&sd&Hm>hetMzN;MDmN(oScvT5gqy0m|`C>LdPB{JZ#<&NjH+ z-=|pImq#NnC4M0qF^|P>JOJ?!ew`OuXfaTf9rS&^Kv$oJqxflA6Jr@|r2B6D3f}Z@$tieDqaz}h8(Zi`AY%41rVgQYtuK2Lnw`4XM-F2xf&J{a1=9c>{Q z*lNT4Yw65jsId>V#f-^Q)eojki+T!`_qL{EiIVZD_^zHPjIW+VtJ+bA7?une9G=L=nC4pM0{6|Q8ZH*~?nrNM zY5#_#;j!R+p>Hg+*>NOeT_b&|_p@NHkt?ege5G?8;W6{YA-c-%Utld4@Ehup5|raF<|;c{*a^00KV5Jz8M?a zlPr=S5A;$R@93Uu z;jU!I(1E>J9J?=YTShnDe?YP6(HbiUWzl=5wo&GZsQy9F5}zdsUIr|!9_BNJXdRIw7LXdE=^pc|smxj3a#lEF zt)5F(O$u$^1Wa#D9am=T%D668bj9;;=CI6@l;=>;Yj_54;WD`!)iJhrf@PuRgaq_d znZrt1P0Z$G@CiNPHcsNK-fmi*XK(Us2D-xh8rCGW8I#k&>~K#MAWDwD7OV4}C?Y(VNSz0Pg(z|+xZqXTufadZF@B-x^u2femsl@Zz#-C-e&%G?F|W;Fu8nrga_y*acZHpddrh~wKV8TYpe zH0NNee;4jxBik$h6pu%N?Lg2Sg?*zs4$e_?n$MfQY>nEmYWz3Oral92M&mxRJzZ@mUxIEwPAn#;x%tWzX=&82zXzx}4>yoYsEW_lH z`>2nz2tL;~5LGk7nfl@?|IB*rN_R~w(G2$)?q%J_niOKEO_K9)&Wj$fWofMI7g!1+9W0FHs8mO16z4t(^@QIPnF?}^WoMg6!uOljk!z8i zzNGshS`{&X>b?s%C=Fc|0O z;nPj>^T5;O=gF~}{k&ayJ${~hH~V=%TJPtnGdxzlFwW2WdDEAzY595AjJBG5aUV{8 zNQP*$isPezcAnVh8{5>-@D8lbEn6OHBCM(HYG~7}q2<%Mx!!csYG{TN5|rBgI{9hF z>0_y(8Lm_z%edM)zEoGnKA#uVlKCSKC-%kvO4>i&OLq_;A8fly2s}& z?hg#yjXZEhu;)Y0l|H}EY;XRRljCfaLtu?i=ie8I$vMdFZB@oVIVN?c!!Ylbu2&j_ zY==4kRV4Zg`l8aYvZ4C4-;o z9eJJhWU<06o;h=7%U`LUVJl-@GG56Fe%s2%-yC~;J`WaE)m%<^&`h6pJctyxnU=wj zy6@!`%oCi*i>CCy4DB1$q*_A-OFm+TDZuq_1d0M>!dP=ilM#cL!6Y4 zCln+Cv!{3v7hCLh9O72@dT406qOq<1rF=@aBWFgp@-es`PVGsenYZw@&SY`*oTB@w z%qi=pglG9!I-gF&A-ojPlFj(p{A@q)ovJ-BF*ZGa&Ohsa+70!(vX65-W-232i^nOy z^R}ZV`_`y*@H?M&*CQcycCJZ6Qm;CyYx#IW-NhzU$;7-Iq_htCNu(Wgm33Sq@2Epni2Y9gop&m^7Wwt9)#cl+oIpTb9_z zN+#PM`s?%WJX14T8`-!z>PNa;^TXQJptUH9ui19gwX;Sk^;t7#{c*P9gNS8gBmy$mgq zzdGyJmb>(6r`0*MD%H(=9HFuC$KzMJ8f^6wmDDYH8rGipzA`t{D1^>Zx{ByFVmjCVWwmh-rQXli}; zAxmf789hW+*(z7@fg268bK20ms%N8Gb>8oKEz8@RPsday zK9xUWcE_K|lTyrOwvNi55BpL$hZ!JNr7dbbU>fDu^Wi4Ixl)RCsE30E62lrqzFFNz zrRXL=%c_E?N#{X32pK!D+cPV#AAY(Y$}-`Uy>3_sl3JceNIi+T@j!FJ)fr^g?59;I zp9h=NhFy;C*^^^Z8Sy#y!P#0;oAt5y_(T$pC5`L*CzJE|Q~>w7ZMuV*(_Bj=`(iWn zllK;P9sA~C@?`)o*LCc-qgUG~;^Ni6Np!O7*zY>_Kgb*AJh328{=1HS)@!F7`^3p~ zH`77mD;K+t{mbdtZ$oQx8S==R-m&jE(N#K5ewuOmI93}wuGOa#Ox~$Zu4i%oWpwPP zT*Izf0k=k<5& zx4{?;ud-v`VXHnz;vyY;*x&2!*mul$vTIr2axp{FsP$4u#M<2Sj(zLLqlVyp_pxU_ zcGXuq_U-Apm)WszkkO4d-Hv_Nad3{BQ|;LI^YX0u_>L8mEozYEZXvGxR_!{rlWzT-_k`DJ(bnH6@YnlTt>vApz!`}k3DZJ#&C7=(~Q%{QA2ZF`LDIq$5C5rn{P~` zV;^`Nj_KN3vh{LKRmacKRl%0=TIHAj=J+Y*R9(mZ_@~VH+AUw9#jJRqd~#*FvLmjG zNPE8P*Io0Rpty3wpEHnuU+(RzQds#-heOw~&(qWB{OCINO(wdI{dP}Vz;8sYEbCW0 z-HfZgyN>;F|4ZZl;!$r)yN-RH`_SBx-gWHL+uKZ^N%gk5W4!Cw=O6EFPPO?7H&!9D zNQi$t;wL9sBuDEt;%{uj&n)W@7|wJ&!(1z6r+$oqz3()R)OGALC$S#7jncX-w7WVP z={okQ3dXAV)lz>l4fQ!KW=`$-@Z+9zk#C*Ae^lqYj{R{@Y3w@o`5!O3W?6YTuD3Wp z8a1z#|Kxiwg2?rH~j*RgL;eyWeLJVuS*F~T3e z)ud-R`}4hV8V7bA`}~jaURXiab?mdcoPQ&lo>X)l`^{Ov^r+l*>|f;Hz`Krp^Dp@x z1n<^$?6;#=*RkJJmqMC&+7c_J@IOyNr&IZVe;p?-g(-%s?sFP{3f lp)+|p3%z5#;;Zm9u;ve{{gT>9-sgK diff --git a/docs/ai/PROJECT_STATE.md b/docs/ai/PROJECT_STATE.md index a13baf5..8022f41 100644 --- a/docs/ai/PROJECT_STATE.md +++ b/docs/ai/PROJECT_STATE.md @@ -461,7 +461,7 @@ VR-208-herverificatie op 2026-07-22: ## Deploymentstatus - `main` is via de bestaande Gitea-SSH-sleutel naar `NuklearRabbit/VacatureRadar` gepusht. -- De applicatie draait op de Unraid-server via `http://192.168.10.150:1226/` als één Dockerman-container; Supervisor bewaakt intern PostgreSQL 17, Redis, web, worker en scheduler. +- De applicatie draait op de Unraid-server via de geconfigureerde private host en poort `1226` als één Dockerman-container; Supervisor bewaakt intern PostgreSQL 17, Redis, web, worker en scheduler. - De Dockerman-tegel gebruikt de lokale VacatureRadar-favicon en opent rechtstreeks de WebUI op poort 1226. - De server-side `.env` heeft rechten `0600`; gegenereerde secrets zijn niet naar Git of logs gekopieerd. - Historisch bewijs (2026-07-22, inmiddels vervangen): de self-hosted runner was diff --git a/docs/operations/UNRAID_DEPLOYMENT.md b/docs/operations/UNRAID_DEPLOYMENT.md index 98d409a..77d8be4 100644 --- a/docs/operations/UNRAID_DEPLOYMENT.md +++ b/docs/operations/UNRAID_DEPLOYMENT.md @@ -105,7 +105,7 @@ Gebruik vanaf een beheerwerkstation altijd een benoemde SSH-hostalias met een af ```sshconfig Host unraid-itworx - HostName 192.168.10.150 + HostName server.example.test Port 22 User root IdentityFile ~/.ssh/itworx_unraid_deploy diff --git a/tests/unit/test_public_configuration.py b/tests/unit/test_public_configuration.py index 6475fca..73a0ff5 100644 --- a/tests/unit/test_public_configuration.py +++ b/tests/unit/test_public_configuration.py @@ -49,8 +49,8 @@ def test_configure_public_url_updates_only_public_security_settings(tmp_path: Pa env_file.write_text( "DJANGO_SECRET_KEY=keep-this-secret\n" "POSTGRES_PASSWORD=keep-this-password\n" - "DJANGO_ALLOWED_HOSTS=192.168.10.150,localhost\n" - "DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.10.150:1226\n", + "DJANGO_ALLOWED_HOSTS=vacatureradar.local,localhost\n" + "DJANGO_CSRF_TRUSTED_ORIGINS=http://vacatureradar.local:1226\n", encoding="utf-8", ) @@ -67,7 +67,7 @@ def test_configure_public_url_updates_only_public_security_settings(tmp_path: Pa assert "DJANGO_DEBUG=0" in content assert "vacatureradar.itworx.tech" in content assert ( - "DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.10.150:1226,https://vacatureradar.itworx.tech" + "DJANGO_CSRF_TRUSTED_ORIGINS=http://vacatureradar.local:1226,https://vacatureradar.itworx.tech" ) in content assert "CACHE_URL=redis://127.0.0.1:6379/1" in content assert "TRUSTED_PROXY_CIDRS=172.18.0.0/16" in content