fix: close all 14 findings of the 2026-09-21 system review - #21

Merged

marcoome merged 12 commits into

mainfrom

fix/system-review-batch

Sep 21, 2026

Commits on Sep 21, 2026

security(nodes): require the authenticated agent admin proxy for remote nodes
marcoome
committed
5855b46
docs(ha): drop the shared certificate store claim, document per-node issuance
marcoome
committed
6f7baef
build(deploy): bump lite/Portainer pins to 1.5.1 and gate drift in CI
marcoome
committed
52ab064
ops(compose): healthcheck app and Caddy
marcoome
committed
210a64e
ops(preflight): name every missing required var and tighten secret file modes
marcoome
committed
3b4fd2c
ops(geoip): make the remote-node profile able to serve country matching
marcoome
committed
95d1030
docs: correct make run, the APP_SECRET rotation claim and the reconcile SLA
marcoome
committed
6a88fee
fix(sso): strict forward-auth by default for new routes, drop Sec-Fetch-Dest trust
marcoome
committed
34b8abd
fix(security): stop trusting client-set True-Client-IP/X-Real-IP from the docker bridge
marcoome
committed
1816275
fix(portal): make logout POST-only with a CSRF-bound token
marcoome
committed
68fcb48
fix(security): fail-closed screening for tenant HTTP targets, headers and WAF
marcoome
committed
dd6839e
release: 1.6.0
marcoome
committed
bb05108