From 1176c7715ac5a2d19a5da80a957752a5ab226585 Mon Sep 17 00:00:00 2001 From: Paul Payne Date: Thu, 15 Oct 2026 07:24:01 +0000 Subject: [PATCH] chore: Remove TODO.md (items tracked elsewhere) --- TODO.md | 22 ---------------------- 1 file changed, 22 deletions(-) delete mode 100644 TODO.md diff --git a/TODO.md b/TODO.md deleted file mode 100644 index 6e156f8..0000000 --- a/TODO.md +++ /dev/null @@ -1,22 +0,0 @@ -# TODO - -## Response headers don't work with host ACL conditions - -`http-response set-header ... if host_X` doesn't work because `hdr(host)` is a request-phase fetch that HAProxy can't evaluate in the response phase. The headers are generated but silently ignored (HAProxy logs a WARNING). - -Fix: capture the host in a transaction variable during the request phase, then use it in response rules: -```haproxy -http-request set-var(txn.host) hdr(host) -acl is_keila var(txn.host) -i keila.cloud.payne.io -http-response set-header Access-Control-Allow-Origin "https://cloud.payne.io" if is_keila -``` - -Affects: keila (CORS headers), plausible (Private-Network-Access header). - -## Input validation for header values - -Header values with special characters (newlines, NULs) should be rejected at registration time. Currently values are Go-`%q`-quoted in the HAProxy output which handles spaces/commas but may produce backslash escapes that HAProxy doesn't understand for edge cases. - -## APT package: Authelia bare-metal installation - -When building the wild-central apt package in `dist/`, include Authelia as a dependency or document its installation. Bare-metal installation instructions: https://www.authelia.com/integration/deployment/bare-metal/