Feat/proxy loopback - #296
Merged
Merged
Conversation
Parked, not shipped. Complete and green (11 tests), but shelved in favour of per-name trust and a trust-all mode. Every live Moshpit name answers the local proxy instead of its origin, so the proxy can verify the registry pin and re-sign with a root this machine generated — the only language a stock client accepts. Refuses to start when nothing is listening where it would send them: with the mode on and no proxy behind it, every Moshpit name resolves and then refuses the connection, which reads as 'all my sites are down' while dig looks perfectly healthy. Unclaimed names stay NXDOMAIN and parked names still reach the parking page. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two textual conflicts in src/dns.mjs, both additive: main's --trust-all auto-trust and this branch's --proxy loopback mode touch the same deps block and the same onQuery handler. Kept both — the flags are independent, so proxy mode passes proxyAddress through while auto-trust still considers each name that resolved to something of ours. Also one conflict git could not see: main's template list --json test (#284) asserts an exact template list, and this branch adds caddy-proxy. Added it to the expectation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan92 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 42
…and 42 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
The timeout in proxyReachable() was unref'd, which defeats the one thing it exists to guarantee. A connect that stalls without keeping a handle alive left nothing holding the loop open, so the process reached an idle event loop with the probe still pending — node 22 reports that as a cancelled await rather than the `false` the caller needs, and it took the three tests that follow it down with it as cancelledByParent. It cannot outlive the probe: both settle paths already clear it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Merged
ralyodio
added a commit
that referenced
this pull request
Aug 5, 2026
Bump moshcode to v0.23.0, releasing #296: --proxy points every live Moshpit name at the local pinned-TLS proxy, plus the caddy-proxy example template.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.