mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
CyberMind-FR
940aa64fcf
haproxyctl: honour an opt-in `waf_bypass = true` field per vhost so the generator emits `use_backend <backend>` (nginx_vhosts) instead of forcing mitmproxy_inspector under waf_enabled. Makes the WAF-bypass of media/large- upload services (nc/photoprism/matrix/torrent) declarative, auditable and regen-durable instead of fragile hand-edits of the generated haproxy.cfg. Normal vhosts are unaffected (verified in isolation). secubox-torrent postinst: register torrent.<host>.<suffix> in haproxy.toml (backend=nginx_vhosts, waf_bypass=true, ssl=true) idempotently and run a drift-guarded `haproxyctl generate` — which refuses safely on a board that still has un-migrated hand-edit vhosts (live cfg untouched) and succeeds on a fresh board. Torrent bypasses sbxwaf by design, so no sbxwaf route is needed. CLAUDE.md: WAF-bypass section updated — default stays 'never bypass'; the ONLY sanctioned exception is the declarative waf_bypass=true in haproxy.toml, never a hand-edit of the generated cfg. Co-Authored-By: Gerald KERMA <devel@cybermind.fr> |
||
|---|---|---|
| .. | ||
| changelog | ||
| control | ||
| postinst | ||
| postrm | ||
| prerm | ||
| rules | ||
| secubox.yaml | ||