kevinveenbirkenbachandClaude Opus 5.5 0a52dc946e Merge branch 'main' into feature/updater-lockdown-probe ...

Conflict in roles/web-app-gitea/tasks/01_manager_ops.yml: main (c59e2838d6, c2577560f8) moved the readiness probes inside the Gitea container on its hosting node, because a host port lands on the swarm ingress mesh; this line (381c3cd5bc) had reduced them to one wait for /api/v1/version = 200 and dropped the explicit `gitea migrate`, which raced Gitea's own migration on galaxyserver. The resolution keeps main's in-container probe as that single wait with `curl -fS` (200 required), after the resolve and with this line's 600 s budget scaled by lookup('timeout'), and drops main's app.ini wait, its migrate task and its post-admin readiness wait.

main's new tests/unit/python/roles/sys-front-tls/templates/test_nginx_ssl_header.py renders nginx_ssl_header.j2 without `domain`, which ssl_credentials.j2 needs on this line since 47160d755e; its render() now passes the vhost's domain.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-30 00:08:59 +01:00

..

__init__.py

refactor(python): clear the open CodeQL code-quality alerts

2026-10-20 21:40:58 +02:00

test_forwarded_client_address.py

test(sys-svc-proxy): resolve the forwarded base include from the repository root

2026-10-28 21:08:53 +01:00

test_mcp_edge_limits.py

…

test_mcp_vhost_exposure.py

…

test_security_headers_lua.py

feat(proxy): per-app nosniff, Referrer-Policy, Permissions-Policy and HSTS directives

2026-10-28 21:38:38 +01:00