siftlode/backend/entrypoint.sh

#!/bin/sh
set -e

echo "Applying database migrations..."
alembic upgrade head

echo "Starting Siftlode API..."
# --timeout-keep-alive 75: keep idle upstream connections alive longer than the reverse
# proxy's idle-reuse window. uvicorn's default (5s) is shorter than Caddy's pooled-keepalive
# timeout, so Caddy would reuse a connection uvicorn had just closed -> broken pipe / reset
# on the next request -> 502. Non-idempotent POSTs (the player's progress/state writes,
# fired every 5s) can't be auto-retried by the proxy, so those 502s reached the user.
#
# SECURITY: do NOT add --proxy-headers / --forwarded-allow-ips here. auth._client_ip trusts
# X-Forwarded-For only when the TRUE socket peer is a configured proxy (TRUSTED_PROXY_IPS); those
# flags would make uvicorn overwrite request.client from the forgeable XFF, defeating that check and
# reopening the rate-limit bypass (SA3).
exec uvicorn app.main:app --host 0.0.0.0 --port 8000 --log-config log_config.json --timeout-keep-alive 75
feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens - docker-compose with Postgres 16 + slim Python API image - FastAPI app with session middleware, health endpoint, static login page - Google OAuth (Authlib) with email invite-list whitelist; admin role support - User + OAuthToken models; refresh tokens encrypted at rest (Fernet) - Alembic migrations, run automatically on container startup - Postgres backup/restore scripts for portability between machines 2026-06-11 01:01:37 +02:00			`#!/bin/sh`
			`set -e`

			`echo "Applying database migrations..."`
			`alembic upgrade head`

chore: rebrand Subfeed -> Siftlode Rename all user-facing references (UI wordmark Sift+lode, titles, app name, legal pages, onboarding wizard, emails, README/docs) and infra paths (/srv/subfeed -> /srv/siftlode, image tag, deploy script, backup filenames). Internal identifiers kept on purpose: Postgres user/db "subfeed", logger namespace, localStorage keys, and the subfeed_pgdata volume (renaming would orphan the migrated production data). 2026-06-14 04:40:22 +02:00			`echo "Starting Siftlode API..."`
fix(api): raise uvicorn keepalive above the proxy reuse window uvicorn's default --timeout-keep-alive is 5s, shorter than Caddy's pooled keepalive idle window, so the proxy reused connections uvicorn had just closed -> broken pipe / connection reset -> 502. The player's progress/state POSTs fire every 5s (resonant with the 5s default) and, being non-idempotent, could not be auto-retried by the proxy, so those 502s reached the user. Set --timeout-keep-alive 75 so the upstream outlives the proxy's reuse. 2026-06-18 15:13:01 +02:00			`# --timeout-keep-alive 75: keep idle upstream connections alive longer than the reverse`
			`# proxy's idle-reuse window. uvicorn's default (5s) is shorter than Caddy's pooled-keepalive`
			`# timeout, so Caddy would reuse a connection uvicorn had just closed -> broken pipe / reset`
			`# on the next request -> 502. Non-idempotent POSTs (the player's progress/state writes,`
			`# fired every 5s) can't be auto-retried by the proxy, so those 502s reached the user.`
harden(auth): SA3 review follow-ups — IPv6-mapped match + no-proxy-headers guardrail Post-review hardening (both fail-safe, not bugs): - _client_ip normalizes IPs via ipaddress and unwraps IPv4-mapped IPv6, so a plain TRUSTED_PROXY_IPS=10.10.0.1 also matches a peer surfaced as ::ffff:10.10.0.1 (a Docker/IPv6 self-host footgun that would otherwise silently collapse everyone into one rate-limit bucket). - entrypoint.sh + _client_ip docstring: explicit warning never to add uvicorn --proxy-headers, which would rewrite request.client from the forgeable XFF and defeat the trust check. 2026-07-12 03:49:08 +02:00			`#`
			`# SECURITY: do NOT add --proxy-headers / --forwarded-allow-ips here. auth._client_ip trusts`
			`# X-Forwarded-For only when the TRUE socket peer is a configured proxy (TRUSTED_PROXY_IPS); those`
			`# flags would make uvicorn overwrite request.client from the forgeable XFF, defeating that check and`
			`# reopening the rate-limit bypass (SA3).`
fix(api): raise uvicorn keepalive above the proxy reuse window uvicorn's default --timeout-keep-alive is 5s, shorter than Caddy's pooled keepalive idle window, so the proxy reused connections uvicorn had just closed -> broken pipe / connection reset -> 502. The player's progress/state POSTs fire every 5s (resonant with the 5s default) and, being non-idempotent, could not be auto-retried by the proxy, so those 502s reached the user. Set --timeout-keep-alive 75 so the upstream outlives the proxy's reuse. 2026-06-18 15:13:01 +02:00			`exec uvicorn app.main:app --host 0.0.0.0 --port 8000 --log-config log_config.json --timeout-keep-alive 75`