admin
8bc7ec54cd
gates / gates (push) Successful in 48s
forwarded.yml: felhom-forwarded is now a chain [felhom-https-only (redirectScheme https, 301 when the trusted tunnel says X-Forwarded-Proto: http), felhom-forwarded-headers (the clean-up + HSTS 86400, no subdomains, no preload)] plus a priority-1 catch-all router for unknown names over http. traefik.yml unchanged; hot-loaded. Tests red-proofed. Evidence: felhom.eu documentation/audits/https-only-2026-10-14/.
12 lines
853 B
Markdown
12 lines
853 B
Markdown
# REPORT — v0.312.0: every public name answers only over https (R-1033, P1, 2026-10-14 night)
|
|
|
|
Baseline `9b95e8e` (0.311.0). Design: felhom.eu `09` §3 decision 244 + the unattended decision recorded there (traefik on
|
|
the box, because the box keys cannot change Cloudflare zone settings). Evidence: felhom.eu
|
|
`documentation/audits/https-only-2026-10-14/`.
|
|
|
|
- `forwarded.yml`: `felhom-forwarded` = chain [`felhom-https-only` (redirectScheme https, 301), `felhom-forwarded-headers`
|
|
(clean-up + HSTS 86400)]; catch-all router for unknown names over http. traefik.yml unchanged, no traefik restart.
|
|
- Tests red-proofed (three mutations, each seen failing). Green gate: build, vet, test all OK.
|
|
- Delivered by hand to Tester 1, demo-hp 9201 and demo-felhom 9201 for the proof (Tier 0). **Not vouched, floor not
|
|
moved** — the operator's morning step.
|