d-u.net/fedi-signup-bot
Watch
2
0
Fork
You've already forked fedi-signup-bot
 0
Code Releases 25 Packages 1 Activity Actions
25 releases 34 tags
  • v2.1.0 cd0ff54e76

    v2.1.0 Stable

    david.gabriel released this 2026-09-03 12:53:05 +00:00 | 19 commits to main since this release

    ⚠ Breaking changes since v1.5.0 — read before upgrading

    • Bind default changed to 127.0.0.1 (was 0.0.0.0). The webhook server
      no longer listens on all interfaces; expose it via a reverse proxy (set
      webhook_host explicitly to change).
    • webhook_secret is now mandatory. A missing/empty secret is a hard
      401; the old "skip verification" path is gone.
    • /health no longer leaks state — it returns only {"status": "ok"} and
      is IP-restricted (default: private ranges only).
    • At least one integration must be enabled — with both
      integrations.matrix and integrations.webui off, the bot exits at startup.
    • Emails are logged as a fingerprint by default (set LOG_PII=1 for full).
    • Security headers are now sent on every response.
    • New optional config options: integrations.webui_refresh, health,
      matrix.allowed_users, trust_proxy, webui_secure_cookie, and the DoS
      limits: 
      # DoS limits (all optional):
max_concurrent_reviews: 50   # in-flight review pollers (semaphore)
review_queue_wait: 10        # seconds to wait for a slot before 429
max_pending_reviews: 500     # cap on the in-memory pending queue

    Changes

    • Web UI: theme picker (light/dark/system), background auto-refresh
      (integrations.webui_refresh, default 15, 0 disables), a11y hardening;
      fixed the NameError on GET /webui.
    • CSRF token is now sticky per browser (no longer rotated by the
      auto-refresh poll), so Accept/Reject no longer 403 after ~15 s.
    • account_id validated (isdigit) at both the webhook and web-UI
      boundaries before any Admin API call (400 / skip otherwise).
    • Optional matrix.allowed_users moderator MXID allowlist (empty =
      legacy behaviour).
    • IP enrichment over HTTPS; webhook-supplied ip validated with
      ipaddress before any egress.
    • Webhook replay protection (sha256 body cache, 600 s TTL → 409);
      signature verified before ping detection; webhook_secret mandatory.
    • Binds 127.0.0.1 by default; security-headers middleware on every
      response (nosniff, no-referrer, X-Frame-Options: DENY, CSP
      frame-ancestors 'none', HSTS over HTTPS).
    • /health returns only {"status": "ok"} and is IP-allowlisted
      (default private ranges; health accepts true/false/CIDR list).
    • Matrix card escapes quotes (_html.escape(…, quote=True)).
    • Clickjacking headers verified on /webui.
    • Theme cookie Secure (webui_secure_cookie); emails logged as a
      fingerprint (LOG_PII=1 for full); audit IP honours X-Forwarded-For only
      when trust_proxy: true.
    • requirements.txt pinned to exact versions.
    • New bot.yaml options: the DoS limits (max_concurrent_reviews,
      review_queue_wait, max_pending_reviews), plus integrations.webui_refresh,
      health, matrix.allowed_users, trust_proxy, webui_secure_cookie.
    Downloads