mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
996ddafd1e
Loopback identity has three spellings a client may send, and six places wrote their own list of them. Each list carried two forms and omitted the third, so the exemption or allowlist it built stopped at whichever form the client actually used: no_proxy=localhost,127.0.0.1 is how an S3 write went through a SOCKS proxy while appearing to exempt loopback. NETWORK_LOOPBACK_HOSTS is now the list, beside the loopback CIDR that was already there, with the three forms also named individually for the consumer that wants only the literals. Migrated: NETWORK_TRUSTED_PROXY_CIDRS, LITELLM_LOOPBACK_HOSTS, the no_proxy of web-app-espocrm and web-app-pixelfed, the ALLOWED_HOSTS of web-app-pretix and web-app-bookwyrm, and the lab playbook's lab_no_proxy. Rendered deltas: lab_no_proxy keeps its exact set, nothing dropped or added, only the order no_proxy ignores. LITELLM_LOOPBACK_HOSTS | first stays 127.0.0.1, so LITELLM_BASE_LOOPBACK_URL is unchanged. The other four gain ::1, which widens an exemption or an allowlist and therefore cannot block a host that worked before; for the two Django allowlists a bare ::1 may be inert rather than effective, since Django matches a bracketed IPv6 Host, but an entry that never matches costs nothing. The lint governs assignments whose key names a proxy exemption or a host allowlist, and it strips a trailing comment first: DOCKER_REACH_HOST names localhost only in its comment, svc-dns-unbound passes a resolver to drill, and flowise's HTTP_DENY_LIST is a blocklist of CIDRs. None of those is a loopback host list. The form patterns are anchored because 127.0.0.11 is the docker resolver and infinito.localhost is a domain. Its second rule keeps the list referencing all three forms, so no one can narrow every consumer at once. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>