Domingo Dirutigliano
2c3316b036
Harden the no-auth reverse-proxy mode
...
Rename the flag to --unsafe-disable-auth so the risk is visible at the call
site, and close the ways the mode could outlive itself:
- Keep an explicit -P/--startup-psw instead of dropping it. Without a password
in the database, --no-unsafe-disable-auth brought firegex up in its
initial-setup state, where anyone able to reach it could choose the password.
- Refuse /api/login, /api/set-password and /api/change-password while
authentication is disabled: an anonymous caller could otherwise plant a
credential that kept working once authentication was turned back on.
run.py config --password still works, writing to the database from the host.
- Print a banner on every start/restart with authentication disabled. The flag
is persisted in the config file, so a later bare `run.py start` inherits it.
- Report the change in `run.py config --unsafe-disable-auth`, which claimed
"No configuration changes specified" while persisting it, and stop that
command from nulling the stored port and host on the way.
- Expose the state as auth_disabled in /api/status and hide the logout button
and the change-password entry, which were silent no-ops in this mode.
Tests cover both directions of the toggle, the socket.io handler, the password
endpoints and the -P handling.
2026-09-03 01:07:51 +02:00
Savva Serebriakov
6fb08f41f6
CUT-22: add reverse-proxy support to firegex
2026-09-02 19:08:51 +03:00
Domingo Dirutigliano
0943aeaa01
enforced security over import backup, minor changes
2026-07-23 18:38:22 +02:00
Domingo Dirutigliano
bd55a7bc9c
integrated and refactore docs + minor changes
2026-07-23 16:53:09 +02:00
Domingo Dirutigliano
d27831c9ec
Merge branch 'dev' into dev-tmp
2026-07-23 13:45:25 +02:00
Domingo Dirutigliano
c37d2b31e8
graphics and TLS feature total refactoring
2026-07-23 13:39:01 +02:00
Domingo Dirutigliano
4125eff93f
minor adjustments + network address based access control
2026-07-22 07:54:38 +02:00
Sogoss
75c54f0155
Add transparent TLS proxying and certificate management for NFProxy and NFRegex
...
- Add Nginx stream proxy module for transparent TLS termination in NFProxy and NFRegex
- Add backend routes and SQLite schema for certificate management (upload, view, delete)
- Implement DNAT nftables redirection rules for deterministic TLS ports
- Add frontend React components (TLSConfigModal, TLSServiceFields) for certificate configuration
- Update Dockerfile and docker-entrypoint.sh to support Nginx stream module and sysctl forwarding
2026-07-20 12:25:30 +02:00
Domingo Dirutigliano
bb4addf590
Merge pull request #28 from Minei3oat/socket
...
Allow binding to UNIX domain sockets
2025-10-01 15:39:40 +02:00
Minei3oat
88f4f54b55
Allow binding to UNIX domain socket
...
UNIX domain sockets are the recommended configuration for proxying with Nginx:
https://uvicorn.dev/deployment/#running-behind-nginx
2025-10-01 01:49:28 +02:00
Domingo Dirutigliano
0492f16cea
using empty string instead of None to bind dualstack server
2025-09-29 16:39:27 +02:00
Domingo Dirutigliano
2362eb8045
password hashing customized and also set already hashed by run.py
2025-09-29 14:33:12 +02:00
Domingo Dirutigliano
aeb97062e2
bind firegex also on ipv6 by default
2025-09-29 13:15:09 +02:00
Domingo Dirutigliano
402be8c021
new crypto system for passwords, removed bcrypt
2025-09-29 12:53:05 +02:00
Domingo Dirutigliano
760529e37a
firegex custom host and better port config managment
2025-08-17 16:23:49 +02:00
Domingo Dirutigliano
8ae533e8f7
push: code changes x2
2025-02-28 21:14:09 +01:00
Domingo Dirutigliano
6a11dd0d16
push: code changes
2025-02-25 23:53:04 +01:00
Domingo Dirutigliano
7f7e3353ec
User-Space thread balancing + refactoring
2025-02-16 16:33:34 +01:00
Domingo Dirutigliano
2fb77a348f
removed fastapi_socketio + general improves
2025-02-12 01:16:10 +01:00
Domingo Dirutigliano
ec279a4fc5
pushed edits
2025-02-02 22:27:12 +01:00
Domingo Dirutigliano
2d8f19679f
nfqueue to hyperscan and stream match, removed proxyregex
2025-02-02 19:54:42 +01:00
Domingo Dirutigliano
d64e0aa73c
add: filtering table of firewall + InterfaceSelector frontend fixes and improves
2024-10-19 18:39:42 +02:00
Domingo Dirutigliano
cbf2c5a43d
add: frontend update
2024-10-13 01:50:52 +02:00
Domingo Dirutigliano
a79c321300
frontend fixes, dockerfile passed to bun, nftable python installed using apt
2024-04-09 02:20:51 +02:00
Domingo Dirutigliano
b01441e300
edit: small changes
2023-09-28 23:16:57 +02:00
Domingo Dirutigliano
227650f3df
host=None only in production
2023-09-28 21:03:48 +02:00
Domingo Dirutigliano
07c4530fac
host None
2023-09-28 20:46:53 +02:00
Domingo Dirutigliano
71edfc29c4
Firewall refactor
2023-09-28 20:45:58 +02:00
Domingo Dirutigliano
3e00add783
fix: host on ipv4 and ipv6
2023-09-26 23:21:13 +02:00
Domingo Dirutigliano
0c972baa9c
add(todo): additional setting to implement
2023-09-26 01:17:09 +02:00
Domingo Dirutigliano
732680753c
IPv6 hosted
2023-09-23 15:00:40 +02:00
Domingo Dirutigliano
7fda371dcb
adding firewall function to firegex!
2023-09-22 20:46:50 +02:00
Domingo Dirutigliano
1b414139a0
Frontend -> vite
2023-06-29 13:44:12 +02:00
Domingo Dirutigliano
63a3014676
sysctl managmento for port hijacking
2023-04-12 23:53:43 +02:00
DomySh
d7eb8efa81
new start.py + set password in start.py
2022-08-09 10:28:30 +00:00
DomySh
af59ea0ef4
Fixes and improvements in thread managment
2022-08-02 19:45:28 +00:00
DomySh
63ba0e94e7
Moduled Firegex, Merging pt1 (not finished and not working yet)
2022-07-21 20:25:39 +02:00
DomySh
0ed8bb635e
Restructurated backend
2022-07-21 01:02:46 +02:00
DomySh
d4cc2f566c
Added reset button
2022-07-20 21:19:22 +02:00
DomySh
1266aebe0e
Autosuggestion for network interfaces ips
2022-07-20 00:21:22 +02:00
DomySh
2988a37bdf
Fixes (need fixes on docker)
2022-07-19 15:32:37 +02:00
DomySh
a020e4311d
Iptables -> NFtables
2022-07-19 15:17:34 +02:00
DomySh
2a5be65feb
Python integration with c++ binary (not totally working yet)
2022-07-18 18:52:14 +02:00
DomySh
1e94c26fd6
Refactor code pt 1 (not tested)
2022-07-12 20:18:54 +02:00
DomySh
632d0a1b12
Minor fixes
2022-07-12 16:03:35 +02:00
DomySh
3034c66423
IP interface and Protocol + fix iptables
2022-07-12 15:47:31 +02:00
DomySh
c4ab4c628e
Starting inserting protocol and ip interface in services
2022-07-11 19:56:05 +02:00
nik012003
a340a3316b
Version bump
2022-07-10 16:44:37 +02:00
DomySh
c6e94bcf89
Now on IPv6
2022-07-10 16:42:33 +02:00
DomySh
ada3a7212b
Now on IPv6
2022-07-10 15:05:56 +02:00
