3 Commits

Include renames

Author	SHA1	Message	Date
Gerhard Scheikl	fa457de8ec	fix(auth): route server-side Supabase calls via internal URL to avoid edge rate-limit ... Server-side Supabase calls (middleware getUser/refresh, server components, admin client) all egress through the Docker gateway as a single NATed IP and traverse Caddy's per-IP /auth/* rate limiter (8 events/s). A handful of active users saturate that shared bucket, 429ing getUser()/token refresh; the middleware then treats the session as invalid and bounces to /login, while a manual refresh lands under budget and works again. Add SUPABASE_INTERNAL_URL (e.g. http://kong-prod:8000) used only by the server-side clients (middleware, lib/supabase/server.ts, admin getSupabaseAdmin /getSupabaseAnon), falling back to the public URL when unset. Browser clients keep the public URL so real per-user-IP edge rate limiting still applies. Also bake the arg in the Dockerfile/build and make the web-prod network alias durable via WEB_ALIAS (dev sets web-dev) so the dev container can't reclaim the web-prod alias on redeploy.	2026-06-02 12:45:10 +02:00
Gerhard Scheikl	d317e8c758	feat(admin): live redis kill-switch on tunnel actions, sortable columns + CSV export + bulk actions, Node 24 LTS ... WS1: pin all Docker stages to node:24.16.0-alpine; add engines node>=20. WS2: lib/redis.ts gains TTL-backed redisSet, redisDel, setTunnelActive (writes tunnel:active:<sub>=1/0 EX 30, TUNNEL_ACTIVE_TTL override, no-op without REDIS_URL); wired into tunnel active/delete/reassign routes. WS3: sortable columns, CSV export routes (token excluded), and bulk actions (self-account guard) across users/tunnels/audit admin tables.	2026-05-31 14:46:22 +02:00
root	c935e39fa1	initial commit	2026-05-29 17:07:00 +02:00