2 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Sonnet 5	1e972fe7dc	Add memory_limit/max_execution_time sanity checks (#106) ... config/requirements.php only checked PHP version and 6 extensions. A deployment on a host with a low default memory_limit (e.g. shared- hosting-style 128M) passed the startup requirements check cleanly and only surfaced as a mysterious failure under real load — a large CSV export, an oversized dashboard query on a big install. Added min_memory_limit_mb (256) and min_max_execution_time (30s) thresholds to config/requirements.php, checked as warnings (not hard failures, since a low limit doesn't break every request) in both scripts/check_requirements.php (CI) and api/health.php (production monitoring). -1/0 (unlimited) always passes. Verified the ini-size parsing and warning logic directly with low/high/unlimited memory_limit and max_execution_time values. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X	2026-09-08 11:58:20 -04:00
jaredandClaude Opus 4.8	b2c19745eb	Add trusted-proxy auth hardening + PHP requirements checks ... Trusted-proxy hardening (defense-in-depth for Authelia forward-auth): - AuthMiddleware now only honors Remote-* identity headers when REMOTE_ADDR is in a configured TRUSTED_PROXIES allowlist; otherwise it refuses with 403 and logs an 'untrusted_proxy' security event. Previously anything that could reach PHP directly could spoof Remote-User/Remote-Groups and log in as admin. - New config TRUSTED_PROXIES (comma-separated, from .env). Empty = enforcement off, so this is backward compatible until the allowlist is set on a host. Requirements checks (so a PHP upgrade dropping an extension can't silently break features like avatars again): - config/requirements.php: single source of truth for min PHP version and required extensions (ldap, mysqli, curl, mbstring, fileinfo, json). - scripts/check_requirements.php: CI script that fails the build if the environment doesn't satisfy them. - New 'requirements' CI job installs those extensions and runs the check; deploy now depends on it. - api/health.php: adds php_extensions + php_version checks so production monitoring surfaces the drift (returns 503 if a required extension is gone). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 10:22:53 -04:00