@loicngr/kobo 1.9.0 → 1.9.1

package/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to Kōbō are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/). Each release is an `## <version>`
 section — the in-app "What's new" dialog reads this file.
 
+## 1.9.1
+
+- fix: exempt /api/health from network-auth and add local Docker compose stacks
+
 ## 1.9.0
 
 - feat: opt out a workspace from PR-watch (skip forge polling, keep local git stats)

package/README.md

@@ -57,13 +57,13 @@ Want to run from source or contribute? See [`CONTRIBUTING.md`](./CONTRIBUTING.md
 
 ### Docker
 
-An official `Dockerfile` and an example Traefik + Kōbō stack
-([`docker-compose.example.yml`](./docker-compose.example.yml)) ship in this repository — useful for
-running Kōbō on a VPS behind a reverse proxy, with git SSH auth, Claude Code / Codex credentials,
-optional Docker-socket passthrough for the dev-server panel, and SSH access into the container for
-interactive work. See [`CONFIGURATION.md`](./CONFIGURATION.md#behind-a-reverse-proxy) for the full
-setup, including the `KOBO_NETWORK_ACCESS_ENABLED` / `KOBO_NETWORK_ACCESS_BEHIND_PROXY` env vars
-that bootstrap network access at container boot with no manual step.
+An official `Dockerfile` and three ready-to-use Compose files ship in this repository: a quick local
+test stack, a Traefik-fronted local rehearsal (`kobo.localhost`, no domain needed), and a full VPS
+reference (Traefik + Let's Encrypt, SSH access, optional Docker-socket passthrough for the
+dev-server panel). See [`CONFIGURATION.md`](./CONFIGURATION.md#docker-deployment) for the complete
+setup — every compose file, every env var, every volume mount, and the `KOBO_NETWORK_ACCESS_ENABLED`
+/ `KOBO_NETWORK_ACCESS_BEHIND_PROXY` env vars that bootstrap network access at container boot with
+no manual step.
 
 ## Configuration
 

package/dist/server/middleware/network-auth-middleware.js

@@ -9,8 +9,16 @@ import { getGlobalSettings } from '../services/settings-service.js';
  * loopback is treated like any other address (see network-access-service.ts).
  * The client IP comes only from the OS socket via getConnInfo, never from
  * X-Forwarded-For, so a remote client cannot spoof a loopback address.
+ *
+ * `/api/health` is always exempt, regardless of `networkAccessBehindProxy`:
+ * it exposes only `{ status, version }` (nothing sensitive), and Docker's own
+ * HEALTHCHECK / a Compose healthcheck / an orchestrator's liveness probe has
+ * no way to supply the runtime-generated token — without this exemption, a
+ * "behind a reverse proxy" deployment's own container never reports healthy.
  */
 export const networkAuthMiddleware = async (c, next) => {
+    if (c.req.path === '/api/health')
+        return next();
     const address = getConnInfo(c).remote.address;
     const global = getGlobalSettings();
     const decision = evaluateNetworkAccess({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loicngr/kobo",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "Kōbō — multi-workspace agent manager for Claude Code. Orchestrates isolated git worktrees with dev servers, Notion integration, and MCP tools.",
   "type": "module",
   "license": "GPL-3.0-or-later",