3 Commits

Author	SHA1	Message	Date
admin	66817709ad	v0.27.0 — user-configurable app subdomains ... Users can now customize the subdomain for each app during deployment instead of using a fixed value. The deploy page shows an editable text input with the default pre-filled and the base domain as a suffix. New "subdomain" deploy field type with DNS-safe format validation, reserved name blocklist, and uniqueness check across deployed stacks. Locked after deploy — changing requires Remove + Redeploy. Backward compatible: InjectMissingFields() auto-fills SUBDOMAIN from .felhom.yml defaults for existing deployed apps on next sync/restart. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-22 15:06:22 +01:00
admin	02650e3202	v0.23.0 — CSRF protection on all browser-facing POST endpoints ... Controller: - internal/web/csrf.go (new): CsrfProtect middleware, csrfToken/csrfField helpers - auth.go: per-session CSRF token (csrfToken field, csrfTokenForSession method) - server.go: executeTemplate wrapper auto-injects CSRFField+CSRFToken - main.go: wire CsrfProtect on all routes; bump to v0.23.0 - handlers.go, storage_handlers.go, handler_restore.go: executeTemplate - All templates: CSRFField in forms, meta csrf-token, csrfHeaders() JS helper, fetch calls updated; sendBeacon→fetch+keepalive in storage_attach.html Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-02-21 16:38:56 +01:00
admin	57cacd9233	v0.3.0: structural refactor — go:embed templates, server split, domain rename ... - Migrate all 7 HTML templates + CSS from Go string constants to individual go:embed files in internal/web/templates/ (templates.go: 2150→35 lines) - Split server.go into auth.go, handlers.go, funcmap.go (server.go: 540→120 lines) - Rename controller subdomain from dashboard.* to felhom.* in Traefik labels - Update documentation (CLAUDE.md, README.md, CONTEXT.md) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-15 10:38:06 +01:00