The hardened runner's job network has no internet access, so `apk add` and
downloading addlicense from GitHub cannot work. git, curl, jq and addlicense
are baked into the runner's job image (infra/gitea-runner/ci-tools.Dockerfile).
The license bot service (Dcntrlized/license-bot) is authoritative: it amends
missing AGPL headers into the PR head commit, including for fork PRs, and
reports the license-bot / addlicense commit status. This workflow now only
reports an honest advisory signal, holds no secrets and never writes.
Renames the server-side plaintext escape hatch from INSECURE_INTERNAL to
DCNTRLIZED_DEBUG in the debug compose and the listener log line; bumps the
shared auth module.
- go.mod: dcntrlized-auth v0.1.1 -> v0.1.2 (tlsutil.IsDev/AuthBaseURL and the
identity-mount client fallback).
- docker-compose.debug.yaml: DEV_MODE replaced by DCNTRLIZED_DEV=true (the
single dev selector); mount the devboot-issued identity at the shared-module
default /dcntrlized/pki so the authproxy edge is mTLS. INSECURE_INTERNAL=1
stays: the RN-facing listener must stay plaintext.
Serve the listener over TLS with ClientAuth=RequireAndVerifyClientCert
trusting the instance CA (shared tlsutil.ServerConfig): only Maestro can
drive actions (T4), and the peer edge is encrypted. INSECURE_INTERNAL=1
(dev debug compose) keeps the listener plaintext for the RN client's
direct mode and hot reload.
- handlers/auth/proxy.go: new MeHandler proxies GET /auth/me to the
shared auth service (boot revalidation for direct-mode clients).
- main.go: register /auth/me.
- actions/auth.go: Me proxies GET /action/me; Logout is method-aware
(POST revokes via {refreshToken}, GET stays a bodyless no-op).
- action dispatcher: GET case me, POST case logout.
- go build + go vet clean.
Admin