fix(manage-server): TRITON_MANAGE_TRUSTED_PROXY_CIDRS + TRITON_MANAGE_HOST_BIND (triton#940 + #945) #24

Merged

amiryahaya merged 2 commits from sync-940-trusted-proxy-cidrs into main

2026-09-02 02:43:32 +02:00

amiryahaya commented

2026-09-01 12:32:07 +02:00

Owner

Summary

Combined sync of two installer-script fixes from the #483 pentest engagement:

triton#940 — compose.yaml never passed TRITON_MANAGE_TRUSTED_PROXY_CIDRS through to the container at all, env.template never documented it, and install.sh never warned an operator using --no-tls that it needs to be set.

triton#945 — the admin API port bound 0.0.0.0 unconditionally, relying solely on ufw.

Changes

compose.yaml: pass TRITON_MANAGE_TRUSTED_PROXY_CIDRS through; new TRITON_MANAGE_HOST_BIND var (default 0.0.0.0, unchanged behavior).
env.template: document both variables and when they're required.
install.sh: --no-tls now warns if TRITON_MANAGE_TRUSTED_PROXY_CIDRS is still unset, and automatically narrows TRITON_MANAGE_HOST_BIND to 127.0.0.1 (matching Postgres's own always-loopback binding).

The actual code-level fixes (HSTS gating, must_change_pw enforcement, licence summary counters, malformed-ID validation) live in the triton repo, not this repo — this sync is the installer-script half only.

🤖 Generated with Claude Code

## Summary Combined sync of two installer-script fixes from the #483 pentest engagement: **triton#940** — compose.yaml never passed TRITON_MANAGE_TRUSTED_PROXY_CIDRS through to the container at all, env.template never documented it, and install.sh never warned an operator using --no-tls that it needs to be set. **triton#945** — the admin API port bound 0.0.0.0 unconditionally, relying solely on ufw. ## Changes - compose.yaml: pass TRITON_MANAGE_TRUSTED_PROXY_CIDRS through; new TRITON_MANAGE_HOST_BIND var (default 0.0.0.0, unchanged behavior). - env.template: document both variables and when they're required. - install.sh: --no-tls now warns if TRITON_MANAGE_TRUSTED_PROXY_CIDRS is still unset, and automatically narrows TRITON_MANAGE_HOST_BIND to 127.0.0.1 (matching Postgres's own always-loopback binding). The actual code-level fixes (HSTS gating, must_change_pw enforcement, licence summary counters, malformed-ID validation) live in the triton repo, not this repo — this sync is the installer-script half only. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

amiryahaya added 1 commit

2026-09-01 12:32:07 +02:00

fix(manage-server): document + wire TRITON_MANAGE_TRUSTED_PROXY_CIDRS 5b7b40b2aa

Sync of triton#940's fix: compose.yaml never passed this env var through
to the container at all, env.template never documented it, and install.sh
never warned an operator using --no-tls that it needs to be set. Without
it, the session cookie loses its Secure flag, HSTS is never sent, and
per-client rate limiting collapses to one shared bucket for every real
client under the documented --no-tls reverse-proxy deployment pattern.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

amiryahaya added 1 commit

2026-09-02 02:43:08 +02:00

fix(manage-server): add TRITON_MANAGE_HOST_BIND (triton#945 sync) 2a50bef5c3

Follow-up commit on this same PR: also syncs triton#945's admin-API
port-binding fix (#483 pentest, Low finding) alongside the #940 fix
this branch already had. New TRITON_MANAGE_HOST_BIND compose var
(default 0.0.0.0, unchanged behavior); install.sh --no-tls narrows it
to 127.0.0.1 automatically, matching Postgres's own always-loopback
binding.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

amiryahaya changed title from ~~fix(manage-server): document + wire TRITON_MANAGE_TRUSTED_PROXY_CIDRS~~ to fix(manage-server): TRITON_MANAGE_TRUSTED_PROXY_CIDRS + TRITON_MANAGE_HOST_BIND (triton#940 + #945)

2026-09-02 02:43:16 +02:00

amiryahaya merged commit afe431fba1 into main

2026-09-02 02:43:32 +02:00

amiryahaya referenced this pull request from a commit

2026-09-02 02:43:33 +02:00

Merge pull request 'fix(manage-server): TRITON_MANAGE_TRUSTED_PROXY_CIDRS + TRITON_MANAGE_HOST_BIND (triton#940 + #945)' (#24) from sync-940-trusted-proxy-cidrs into main