diff --git a/.env.unraid.example b/.env.unraid.example index 797e9ae..5b46862 100644 --- a/.env.unraid.example +++ b/.env.unraid.example @@ -16,8 +16,8 @@ DJANGO_SECRET_KEY=CHANGE_ME_generate_at_least_50_random_characters DJANGO_DEBUG=0 # Leeg laten tot er een publieke HTTPS-URL is. PUBLIC_BASE_URL= -DJANGO_ALLOWED_HOSTS=192.168.10.150,127.0.0.1,localhost -DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.10.150:1226,http://127.0.0.1:1226 +DJANGO_ALLOWED_HOSTS=vacatureradar.local,127.0.0.1,localhost +DJANGO_CSRF_TRUSTED_ORIGINS=http://vacatureradar.local:1226,http://127.0.0.1:1226 DJANGO_TIME_ZONE=Europe/Brussels VACATURERADAR_OWNER_NAME=Jens VACATURERADAR_VERSION=0.3.12 diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml index 055c2a6..6358a59 100644 --- a/.gitea/workflows/managed-validation.yml +++ b/.gitea/workflows/managed-validation.yml @@ -21,6 +21,8 @@ concurrency: jobs: full: name: full + # Public fork code must never execute automatically on the private runner. + if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }} runs-on: ubuntu-latest timeout-minutes: 30 container: diff --git a/SECURITY.md b/SECURITY.md index 4989a7e..c61cdf9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -38,7 +38,8 @@ Deze data mag nooit shell-, netwerk-, e-mail-, bestandssysteem- of sollicitatiea ## Kwetsbaarheid melden -Maak geen publieke issue met secrets of persoonlijke vacaturegegevens. Documenteer intern: +Maak geen publieke issue met secrets of persoonlijke vacaturegegevens. Meld een +kwetsbaarheid privé via `security@itworx.tech` en vermeld: 1. component en versie/commit; 2. reproduceerbare stappen met synthetische data; diff --git a/deploy-log.txt b/deploy-log.txt deleted file mode 100644 index 56ea08a..0000000 Binary files a/deploy-log.txt and /dev/null differ diff --git a/docs/ai/PROJECT_STATE.md b/docs/ai/PROJECT_STATE.md index a13baf5..8022f41 100644 --- a/docs/ai/PROJECT_STATE.md +++ b/docs/ai/PROJECT_STATE.md @@ -461,7 +461,7 @@ VR-208-herverificatie op 2026-07-22: ## Deploymentstatus - `main` is via de bestaande Gitea-SSH-sleutel naar `NuklearRabbit/VacatureRadar` gepusht. -- De applicatie draait op de Unraid-server via `http://192.168.10.150:1226/` als één Dockerman-container; Supervisor bewaakt intern PostgreSQL 17, Redis, web, worker en scheduler. +- De applicatie draait op de Unraid-server via de geconfigureerde private host en poort `1226` als één Dockerman-container; Supervisor bewaakt intern PostgreSQL 17, Redis, web, worker en scheduler. - De Dockerman-tegel gebruikt de lokale VacatureRadar-favicon en opent rechtstreeks de WebUI op poort 1226. - De server-side `.env` heeft rechten `0600`; gegenereerde secrets zijn niet naar Git of logs gekopieerd. - Historisch bewijs (2026-07-22, inmiddels vervangen): de self-hosted runner was diff --git a/docs/operations/UNRAID_DEPLOYMENT.md b/docs/operations/UNRAID_DEPLOYMENT.md index 98d409a..77d8be4 100644 --- a/docs/operations/UNRAID_DEPLOYMENT.md +++ b/docs/operations/UNRAID_DEPLOYMENT.md @@ -105,7 +105,7 @@ Gebruik vanaf een beheerwerkstation altijd een benoemde SSH-hostalias met een af ```sshconfig Host unraid-itworx - HostName 192.168.10.150 + HostName server.example.test Port 22 User root IdentityFile ~/.ssh/itworx_unraid_deploy diff --git a/tests/unit/test_public_configuration.py b/tests/unit/test_public_configuration.py index 6475fca..73a0ff5 100644 --- a/tests/unit/test_public_configuration.py +++ b/tests/unit/test_public_configuration.py @@ -49,8 +49,8 @@ def test_configure_public_url_updates_only_public_security_settings(tmp_path: Pa env_file.write_text( "DJANGO_SECRET_KEY=keep-this-secret\n" "POSTGRES_PASSWORD=keep-this-password\n" - "DJANGO_ALLOWED_HOSTS=192.168.10.150,localhost\n" - "DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.10.150:1226\n", + "DJANGO_ALLOWED_HOSTS=vacatureradar.local,localhost\n" + "DJANGO_CSRF_TRUSTED_ORIGINS=http://vacatureradar.local:1226\n", encoding="utf-8", ) @@ -67,7 +67,7 @@ def test_configure_public_url_updates_only_public_security_settings(tmp_path: Pa assert "DJANGO_DEBUG=0" in content assert "vacatureradar.itworx.tech" in content assert ( - "DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.10.150:1226,https://vacatureradar.itworx.tech" + "DJANGO_CSRF_TRUSTED_ORIGINS=http://vacatureradar.local:1226,https://vacatureradar.itworx.tech" ) in content assert "CACHE_URL=redis://127.0.0.1:6379/1" in content assert "TRUSTED_PROXY_CIDRS=172.18.0.0/16" in content