[turin-dev]

What and why

This PR adds a client IP allowlist for TCP proxies, caps login sessions at an absolute lifetime, and adds stricter CI checks. It also carries an audit pass over the backend, the dashboard, the installers and the docs. Each commit stands on its own.

New: TCP proxy client allowlist

TCP proxy ports are published Docker ports. Docker's publish rules bypass ufw, so a database behind a TCP proxy was reachable from the whole internet. The docs listed AVEN_TCP_PORT_ALLOW_CIDRS as designed but not implemented.

• Per-proxy list: each TCP proxy can carry allow_cidrs, a list of IPv4 addresses or CIDRs (at most 32). The server normalizes the list.
• Server default: AVEN_TCP_PORT_ALLOW_CIDRS applies to proxies that have no list of their own. A list containing 0.0.0.0/0 opts a proxy out of the default.
• Enforcement: the socat forwarder checks each connection's SOCAT_PEERADDR against the list before it connects to the service.
  • The script gets its data from environment variables, never by string interpolation, and the agent validates the list again.
  • Without a list, the forwarder command and its signature label are byte-for-byte what they were before, so existing proxies are not recreated on upgrade.
• Remote nodes: an agent built before this field refuses allow_cidrs. The API then answers 409, and the proxy is never reopened without the list.
• Copies keep the list: duplicating an environment and moving a proxy between HA root and edge carry the list.
• API and dashboard: POST/PATCH/GET …/tcp-proxy handle the list. The TCP proxy row shows who may connect and has an editor that validates as you type. Changes emit an event and an audit entry.
• Verified with real containers (alpine/socat:1.8.0.3 in Docker):
  • Listed /32 and /24 clients connect, and a 270 KB round trip arrives intact.
  • Clients outside the list are closed and logged.
  • This run caught a socat 1.8 quoting bug (double quotes are stripped inside an address unless it is single-quoted), fixed in the commit.
• Limitation: IPv4 only. The forwarder cannot see IPv6 client addresses, so IPv6 entries are refused with 400.

New: absolute session lifetime

• Sessions slid by 30 days on every use, so a session that kept being used, including a stolen cookie, never expired.
• Sessions now also end 90 days after login. The stored expiry and the cookie are both capped, and sessions created before this change are cut off at the cap.
• AVEN_SESSION_MAX_AGE takes 2160h, 30d or off. An invalid value fails at startup.

Security (Windows host)

• The plain-HTTP dashboard was bound to 0.0.0.0:7070, and the installer opened it to the local subnet. It now listens on 127.0.0.1:7070, and the installer removes the old firewall rule on upgrade.
• The proxy route on 0.0.0.0:7071 served requests without the gateway secret. It now refuses them.
• The wake secret header was forwarded to user apps. It is now stripped once it has been checked.

Bugs

• imageupdate: a shadowed err left resp nil and panicked aven-server. A regression test is included.
• webauthn: a shadowed err meant BeginLogin failures were never checked.
• deploy: data race in RestorePITR, found by -race.
• TestOAuthClientAuthAndPKCE failed about 1 run in 4096.
• Four tests computed a result and never checked it. They now assert it.

Resilience

• A panic in any one of the 18 background loops killed aven-server. Now only that loop restarts, with a backoff from 30s doubling up to 5 minutes, and its stack is logged.
• A panic in one aven-agent operation killed the agent. It now comes back as that request's error.
• The wake handlers used ReverseProxy.Director, deprecated in Go 1.26. They now share a Rewrite-based proxy.WakeReverseProxy. A test sends the same request through the old and the new proxy and checks that the app receives identical headers.

Dashboard accessibility

• axe now reports no violations on any route in the dark theme, and none on mobile; the only remaining violations are faint (gray-400) text in the light theme.
• Fixes: log table ARIA, node meters, canvas badges, light-theme kbd and timestamps, and the dark-theme gray-400 faint-text token (3.4:1 → 4.5:1).

CI, cleanup and docs

• CI: added gofmt, staticcheck and a separate go-race job (-timeout 30m; internal/api takes about 10 minutes under -race). Wired up the web unit tests that never ran (74).
• Cleanup: staticcheck is clean on every GOOS, with staticcheck.conf dropping ST1005 and S1016. Removed dead code.
• Docs: API reference, aven.env.example and the READMEs are updated, and the SDK link is fixed.

How

• Allowlist: internal/node/tcpforward.go, internal/deploy/tcpproxy.go, internal/agent/extra.go and TcpProxyRow.tsx.
• Sessions: sessionExpiry and sessionMaxAge in internal/api/auth.go.
• Resilience: cmd/aven-server/loops.go, Handler.handleRecovering and internal/proxy/wakeproxy.go.
• Reviewers should check one assumption: binding 7070 to loopback relies on Docker Desktop forwarding host.docker.internal to the host's loopback. I could not test this on a Windows host.

Checklist

• go test ./..., go test -race ./... (all 45 packages), staticcheck, GOOS=windows build and vet, cd web && npm run typecheck && npm run i18n:check && npm test && npm run build
• Tests for behavior changes; docs updated
• Breaking API, database migration, deployment or configuration changes are called out:
  • No migration.
  • Login sessions now end 90 days after login (AVEN_SESSION_MAX_AGE=off restores the old behavior).
  • Remote agents need upgrading before a proxy on them can use a list.
  • On Windows, existing installs keep AVEN_LISTEN=0.0.0.0:7070 until it is edited.
• No real credentials, private hostnames or user data

🤖 Generated with Claude Code

https://claude.ai/code/session_01CJyoeEBvvbpiXsP7oR67cb