oskar 9a5c160b39 fix(security): control-plane UI bind na Tailscale IP — 18180 z /action/mutate byl publicznie dostepny bez auth na VPS ... Co: operator-ui (18180:8080) bindowal na 0.0.0.0, wiec /action/mutate (brak autoryzacji, moze przenosic akcje do "approved") byl osiagalny z publicznego internetu. Fix stosuje istniejacy wzorzec repo (TAILSCALE_BIND_IP env var, patrz fleet-prometheus/llm-gateway/gokapi) + dual-bind jak w ollama (127.0.0.1 obok TAILSCALE_BIND_IP), bo node-agent na VPS laczy sie z network_mode: host przez localhost:18180/summary. Nie ruszono operator_ui.py / mutate_action — auth to osobny temat.		2026-07-22 17:29:11 +02:00
..
src	fix(supervisor): odpornosc petli na zawieszenie + timeout blokujacych wywolan — petla stanela cicho po ha_websocket_dead (mozg martwy 24h, healthy ale nie tika)	2026-07-16 16:17:20 +02:00
tests	fix(observer): map containers_not_running to unhealthy status + incident — dead/crash-looping containers created no incident, so supervisor never alerted	2026-07-22 16:28:31 +02:00
deploy-local.sh	fix(deploy): skip sudo chown/chmod when /opt/homelab ownership is already correct	2026-06-03 15:44:44 +02:00
docker-compose.yml	fix(security): control-plane UI bind na Tailscale IP — 18180 z /action/mutate byl publicznie dostepny bez auth na VPS	2026-07-22 17:29:11 +02:00
Dockerfile	fix(control-plane): run executor as uid 1000 with docker group access	2026-06-03 18:19:58 +02:00
env.example	fix(security): control-plane UI bind na Tailscale IP — 18180 z /action/mutate byl publicznie dostepny bez auth na VPS	2026-07-22 17:29:11 +02:00
pyproject.toml	feat(control-plane): route ha-diag-agent events through supervisor	2026-05-29 15:59:23 +02:00