fix: vision(#623): Caddy Remote-User forwarding + chat-side validation (defense-in-depth) (#709)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 02:21:02 +00:00 · 2026-04-12 02:21:02 +00:00 · f8ac1d2ae2
commit f8ac1d2ae2
parent 34d4136f2e
3 changed files with 97 additions and 3 deletions
--- a/.env.example
+++ b/.env.example
@ -73,6 +73,7 @@ WOODPECKER_DB_NAME=woodpecker              # [CONFIG] Postgres database name
 CHAT_OAUTH_CLIENT_ID=                     # [SECRET] Chat OAuth2 client ID (auto-generated by init)
 CHAT_OAUTH_CLIENT_SECRET=                 # [SECRET] Chat OAuth2 client secret (auto-generated by init)
 DISINTO_CHAT_ALLOWED_USERS=               # [CONFIG] CSV of allowed usernames (disinto-admin always allowed)
+FORWARD_AUTH_SECRET=                      # [SECRET] Shared secret for Caddy ↔ chat forward_auth (#709)

 # ── Vault-only secrets (DO NOT put these in .env) ────────────────────────
 # These tokens grant access to external systems (GitHub, ClawHub, deploy targets).