2 commits

Author	SHA1	Message	Date
Devin AI	3347ebca7a	fix(security): remove hardcoded secrets, patch command injection, tighten CORS and Cypher guard ... - run_import_workflow.py, run_multi_import.py: replace hardcoded budget password with BUDGET_PASSWORD env-var (fail-fast if unset) - server.js /ingest: replace shell-interpolated exec() with execFile() so user-controlled title/body cannot inject shell commands - authentik-values.yaml: blank out bootstrap_password and bootstrap_token so they must be supplied at deploy time via --set or sealed-secret - cluster-dashboard main.py: restrict CORS from allow_origins=["*"] to env-configurable whitelist (default: dashboard.researchstack.info), methods to GET, headers to Authorization+Content-Type - neo4j_obsidian_connector_router.js (both copies): replace permissive prefix-only readOnly regex with a deny-list that blocks CREATE/MERGE/DELETE/DETACH/SET/REMOVE/DROP anywhere in the query, and route readOnly queries through session.readTransaction() Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>	2026-06-15 00:24:12 +00:00
Brandon Schneider	54dbac5893	feat(infra): media stack, Vaultwarden, Cloudflare tunnel, OIDC providers, Caddy TLS ... - Media stack deployed: qBittorrent, Sonarr, Radarr, Lidarr, Prowlarr, Bazarr, Navidrome, Audiobookshelf, Jellyfin, Homarr, Kavita, MeTube, SuggestArr, BoxArr - Romm, ebook2audiobook (GPU CUDA), TrailBase, FlareSolverr deployed - Vaultwarden + Vaultwarden-API deployed - Caddy reverse proxy on racknerd with Let's Encrypt TLS at *.researchstack.info - Authentik 7 OIDC providers + 12 proxy providers for SSO - NVIDIA GPU support enabled on k3s (device plugin + containerd runtime) - Cloudflare tunnel created (DNS on Porkbun) Build: 3313 jobs, 0 errors (lake build Compiler)	2026-05-31 11:01:39 -05:00