Claude
48b9ccf152
feat: M4 Hardening — encryption, resource limits, monitoring, backups
...
## Env var encryption at rest (AES-256-GCM)
- server/src/crypto.rs: new module — encrypt/decrypt with AES-256-GCM
Key = SHA-256(HIY_SECRET_KEY); non-prefixed values pass through
transparently for zero-downtime migration
- Cargo.toml: aes-gcm = "0.10"
- routes/envvars.rs: encrypt on SET; list returns masked values (••••)
- routes/databases.rs: pg_password and DATABASE_URL stored encrypted
- routes/ui.rs: decrypt pg_password when rendering DB card
- builder.rs: decrypt env vars when writing the .env file for containers
- .env.example: add HIY_SECRET_KEY entry
## Per-app resource limits
- apps table: memory_limit (default 512m) + cpu_limit (default 0.5)
added via idempotent ALTER TABLE in db.rs migration
- models.rs: App, CreateApp, UpdateApp gain memory_limit + cpu_limit
- routes/apps.rs: persist limits on create, update via PUT
- builder.rs: pass MEMORY_LIMIT + CPU_LIMIT to build script
- builder/build.sh: use $MEMORY_LIMIT / $CPU_LIMIT in podman run
(replaces hardcoded --cpus="0.5"; --memory now also set)
## Monitoring (opt-in compose profile)
- infra/docker-compose.yml: gatus + netdata under `monitoring` profile
Enable: podman compose --profile monitoring up -d
Gatus on :8080, Netdata on :19999
- infra/gatus.yml: Gatus config checking HIY /api/status every minute
## Backup cron job
- infra/backup.sh: dumps SQLite, copies env files + git repos into a
dated .tar.gz; optional rclone upload; 30-day local retention
Suggested cron: 0 3 * * * /path/to/infra/backup.sh
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-24 15:06:42 +00:00
Shautvast
2654a26b06
rust 1.94
2026-03-24 14:27:12 +01:00
Claude
0569252edf
Add roadmap: Podman + git push deploy + self-hosted git
...
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-20 14:46:14 +00:00
Claude
dc59293c5e
Replace Cloudflare DNS challenge with standard Let's Encrypt HTTP-01
...
Caddy's built-in ACME support handles TLS automatically — no CF_API_TOKEN,
no Cloudflare account, no DNS plugin needed. Requires ports 80+443 forwarded
to the Pi and ACME_EMAIL set in infra/.env.
2026-03-20 11:41:40 +00:00
Claude
95ac2adcb0
docs: fix docker-compose for docker.io users — install separately, note hyphen syntax
...
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-19 14:27:52 +00:00
Claude
1532bc170b
docs: clarify Docker install — add docker.io fallback, warn against bare apt install docker-ce
...
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-19 14:10:27 +00:00
Claude
c7c4e7a2ec
docs: add Raspberry Pi end-to-end setup guide
...
Covers: OS flash, SSH hardening, ufw/fail2ban, Docker install,
Cloudflare DNS + wildcard TLS, platform startup via docker compose,
first app deploy, webhook setup, daily backups, Netdata/Gatus monitoring,
platform upgrades, and a troubleshooting table.
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-19 13:29:41 +00:00
