Stavros
b43cf76d9b
refactor: use typed objects for kubernetes
2026-09-20 21:07:06 +03:00
Stavros
5a685c4a6b
Merge branch 'main' into feat/k8s_gateways
2026-09-20 18:51:23 +03:00
Stavros and OpenAI
0cf64e8598
fix: use constant-time secret comparisons
...
Co-Authored-By: OpenAI <noreply@openai.com >
2026-09-06 19:56:58 +03:00
Stavros and GitHub
bbcc8cafa6
feat: add backoff to docker connection for proxies ( #1114 )
2026-09-03 12:14:30 +03:00
Stavros and GitHub
b01f49cc44
refactor: use optimized image for background ( #1110 )
2026-09-01 00:18:35 +03:00
Stavros and GitHub
88901d342f
fix: consent screen skip status should get checked after auth ( #1099 )
2026-08-30 20:09:41 +03:00
Stavros and GitHub
847d8325c7
fix: auth module selection ( #1089 )
2026-08-25 17:07:56 +03:00
Stavros and GitHub
be48d712ee
feat: support for custom claims in oauth ( #1087 )
2026-08-22 19:58:05 +03:00
Contre and Claude Sonnet 4.6
e1b1e722e7
fix(acl): only let a label provider define ACLs for domains it routes
...
The app name fallback matches any domain that starts with the app name,
so an app named myapp served on myapp.example.com also defined the ACLs
of myapp.evil.com. Behind a proxy with a catch-all route, a request can
be authorized against the wrong app that way.
Label providers now receive the domain being authorized. The Kubernetes
provider keeps the hosts of every Ingress, HTTPRoute and GRPCRoute it
watches and withholds the apps of the resources that do not route the
domain, which bounds the name fallback to the hosts a resource actually
serves. Wildcard hostnames keep matching as a suffix, so nested
subdomains stay resolvable by app name.
Container labels carry no routing information, so the Docker provider
cannot narrow its results down and keeps yielding every app.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-08-19 12:18:02 +02:00
Contre and Claude Sonnet 4.6
3a216e95e2
Merge branch 'main' into feat/k8s_gateways
...
Reapply the Gateway API support on top of the KubernetesService rework
from main, which moved the service to ding-managed watchers and a
Lookup based LabelProvider, and started requiring an app to match a host
the resource actually routes.
Ingresses declare their hosts in spec.rules[].host while HTTPRoutes and
GRPCRoutes use spec.hostnames, so host extraction is now dispatched per
resource kind. Route hostnames may carry the Gateway API wildcard label,
which is matched as a suffix, and routes without hostnames are skipped
since the hosts of the gateway listeners they attach to cannot be
resolved from the route alone.
The cache key gains the resource kind because an Ingress and an
HTTPRoute may share a name within a namespace, and the catch-all path
warning is extended to HTTPRoute path matches.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-08-19 12:03:13 +02:00
Stavros and GitHub
0c47e68c09
feat: do not show oidc consent screen every time ( #989 )
2026-08-17 02:44:48 +03:00
Stavros and GitHub
46c8c58f45
fix: preserve query parameters for login ( #1068 )
2026-08-13 17:30:53 +03:00
tsushanth and GitHub
f9939538b9
Remote-Name header returns capitalized uid instead of LDAP cn — cn attribute never fetched ( #1072 )
2026-08-13 15:37:03 +03:00
6d5563db2c
fix: clean request path before acls ( #1055 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-30 19:35:31 +03:00
Stavros
c7077a7c84
fix: do not allow empty ingresses
2026-07-21 00:37:13 +03:00
Stavros and GitHub
80bc87188e
refactor: rework acl fetching for kubernetes and docker ( #1028 )
2026-07-20 16:39:15 +03:00
Stavros and GitHub
0e7bdf6cd5
feat: experimental option to run tinyauth in oauth bridge mode ( #1027 )
2026-07-20 00:03:26 +03:00
Stavros and GitHub
f43d690320
refactor: rework scheme validation in oauth controller and frontend ( #1026 )
2026-07-19 00:41:28 +03:00
Stavros
50c25e4478
fix: fix domain validator with port but no scheme and https or http
2026-07-18 18:17:24 +03:00
Stavros
d6087dc45e
fix: allow for mismatching protocol in trusted domain check - ui warnings
2026-07-18 18:06:26 +03:00
Stavros
a79438d6ec
fix: fix typo
2026-07-18 16:47:53 +03:00
Stavros
286aad2e08
test: remove obsolete test case
2026-07-18 16:37:52 +03:00
Stavros
5091fc2d7a
fix: suppress irrelevant debugs logs in acls service
2026-07-18 16:30:12 +03:00
Stavros
0fc87ad58f
fix: support for parent trusted domain, fixes #1021
2026-07-18 16:30:12 +03:00
Stavros and GitHub
a7eba59a42
refactor: export cache package ( #1017 )
2026-07-17 02:04:34 +03:00
tsushanth and GitHub
ac8703eadb
fix(ldap): use DN instead of uid in basicAuth GetLDAPUser call ( #1015 )
2026-07-17 01:15:48 +03:00
Stavros
04a06ec5ff
chore: use blue color for totp generate
2026-07-16 17:13:36 +03:00
Stavros
3cf3cc9090
fix: don't fail app on label provider init failure
2026-07-16 14:34:12 +03:00
Stavros
589fe22138
tests: add tests for abstain in oauth whitelist
2026-07-16 14:30:48 +03:00
1165c91fcc
fix: abstain when OAuth whitelist is empty ( #1010 )
...
Co-authored-by: wwhsaber <wwhsaber@foxmail.com >
2026-07-16 14:23:07 +03:00
Stavros and GitHub
dade1e2c8f
refactor: rework rate limit logic ( #1008 )
2026-07-15 15:30:57 +03:00
Stavros and GitHub
6e095fd4f2
refactor: rework the way trusted proxies ip work ( #1007 )
2026-07-15 15:17:55 +03:00
Stavros and GitHub
c22925c2fb
fix: use constant time in user checks ( #1004 )
2026-07-14 16:49:59 +03:00
Stavros and GitHub
d946926c36
feat: allow existing query params in oidc redirect uri ( #1003 )
2026-07-14 16:36:57 +03:00
Stavros and GitHub
e75605b2c5
refactor: move domain check into small helper util ( #1000 )
2026-07-14 14:20:15 +03:00
Florian Ilch and GitHub
79bcccbe43
feat: support proxy environment variables for OAuth requests ( #999 )
2026-07-14 13:18:28 +03:00
Stavros and GitHub
b62bb2d37a
refactor: generate mdx docs with tabs for each config option ( #996 )
2026-07-13 18:07:47 +03:00
Stavros and GitHub
0bd2821a9b
refactor: use tailscale api for user checking instead of tsnet ( #978 )
2026-07-09 01:56:09 +03:00
nv6 and GitHub
364175adc0
feat: try anonymous bind when bind credentials are empty ( #979 )
2026-07-08 17:11:30 +03:00
Stavros and GitHub
73cc4808bc
feat: improve binary size with build tags ( #976 )
2026-07-06 23:49:55 +03:00
Stavros and GitHub
4aa05aeb79
refactor: use some colors in CLI output ( #962 )
2026-07-03 16:40:22 +03:00
Stavros and GitHub
440a3a3ef5
chore: cleanup codegen ( #965 )
2026-07-02 23:35:34 +03:00
Stavros and GitHub
a3c4d6ac83
chore: move tailscale to experimental config ( #964 )
2026-07-02 23:17:03 +03:00
Stavros
04b93fa107
fix: remove shutdown from serve error path
2026-07-02 15:07:04 +03:00
Stavros and GitHub
a6c716c4e2
fix: ensure data paths are set correctly in docker, fixes #958 ( #959 )
2026-07-01 16:12:46 +03:00
Stavros and GitHub
ffafb5bff5
feat: add a reconnect to the initial ldap connection ( #928 )
2026-06-30 15:57:41 +03:00
Stavros and GitHub
09ec40cb76
feat: show provider in quick actions ( #955 )
2026-06-28 17:58:11 +03:00
Stavros
08af4557fd
fix: use client ip instead of remote addr in tailscale whois lookups
2026-06-23 21:06:55 +03:00
Stavros and GitHub
69f4206f65
refactor: remove concurrent listeners and rework cookie logic ( #950 )
2026-06-23 13:35:29 +03:00
Stavros and GitHub
efe373084f
feat: support for oidc max age ( #949 )
2026-06-20 00:21:22 +03:00
Stavros
ContreandClaude Sonnet 4.6
tsushanthandGitHub
Florian IlchandGitHub
nv6andGitHub