vault-cortex 0.10.7 → 0.12.0

package/dist/env.js

@@ -94,17 +94,28 @@ MEMORY_DIR=About Me
 # Host port to expose (default: 8000).
 PORT=8000
 
-# Client-IP trust for OAuth rate limiting and logs (defaults shown).
-# With nothing in front of the server, leave both untouched — each visitor
-# is identified by their own connection, and faked Forwarded/X-Forwarded-For
-# headers are ignored.
-# With a proxy or tunnel you control in front (Caddy, nginx, Cloudflare
-# Tunnel), set TRUST_PROXY_HOPS=1 so visitors are told apart by their real
-# IP — otherwise they all share one rate-limit budget.
-# Set TRUST_FORWARDED_HEADER=true only if the proxy reports each visitor's
-# IP in the RFC 7239 Forwarded header (e.g. AWS API Gateway).
+# These two settings choose the client IP used for OAuth rate limiting and
+# logs (defaults shown below). Without the right values, every visitor
+# behind a proxy shares one rate-limit budget. TRUST_PROXY_HOPS counts the
+# proxies you control that write X-Forwarded-For; TRUST_FORWARDED_HOPS
+# counts the ones that write the RFC 7239 Forwarded header
+# (https://www.rfc-editor.org/rfc/rfc7239), and 0 ignores that header.
+#
+#   What sits in front of the server       TRUST_PROXY_HOPS  TRUST_FORWARDED_HOPS  Client IP is
+#   Nothing (default)                      0                 0                     the visitor (socket peer)
+#   A proxy or tunnel you control          1                 0                     the visitor (X-Forwarded-For)
+#     (Caddy, nginx, Cloudflare Tunnel)
+#   A proxy that reports visitors in       1                 1                     the visitor (Forwarded)
+#     Forwarded (e.g. AWS API Gateway)
+#   A CDN in front of that proxy, and      1                 2                     the visitor (Forwarded)
+#     the CDN is the only way to reach it
+#
+# When the Forwarded header is read (TRUST_FORWARDED_HOPS above 0), it wins
+# and TRUST_PROXY_HOPS is not consulted; TRUST_PROXY_HOPS is the fallback
+# when that header is ignored or absent. Faked headers from visitors are
+# ignored in every row — only the counted proxies are trusted.
 # TRUST_PROXY_HOPS=0
-# TRUST_FORWARDED_HEADER=false
+# TRUST_FORWARDED_HOPS=0
 
 # Log verbosity: debug | info | warn | error (default: info).
 LOG_LEVEL=info
@@ -221,17 +232,28 @@ MEMORY_DIR=About Me
 # Host port to expose (default: 8000).
 PORT=8000
 
-# Client-IP trust for OAuth rate limiting and logs (defaults shown).
-# With nothing in front of the server, leave both untouched — each visitor
-# is identified by their own connection, and faked Forwarded/X-Forwarded-For
-# headers are ignored.
-# With a proxy or tunnel you control in front (Caddy, nginx, Cloudflare
-# Tunnel), set TRUST_PROXY_HOPS=1 so visitors are told apart by their real
-# IP — otherwise they all share one rate-limit budget.
-# Set TRUST_FORWARDED_HEADER=true only if the proxy reports each visitor's
-# IP in the RFC 7239 Forwarded header (e.g. AWS API Gateway).
+# These two settings choose the client IP used for OAuth rate limiting and
+# logs (defaults shown below). Without the right values, every visitor
+# behind a proxy shares one rate-limit budget. TRUST_PROXY_HOPS counts the
+# proxies you control that write X-Forwarded-For; TRUST_FORWARDED_HOPS
+# counts the ones that write the RFC 7239 Forwarded header
+# (https://www.rfc-editor.org/rfc/rfc7239), and 0 ignores that header.
+#
+#   What sits in front of the server       TRUST_PROXY_HOPS  TRUST_FORWARDED_HOPS  Client IP is
+#   Nothing (default)                      0                 0                     the visitor (socket peer)
+#   A proxy or tunnel you control          1                 0                     the visitor (X-Forwarded-For)
+#     (Caddy, nginx, Cloudflare Tunnel)
+#   A proxy that reports visitors in       1                 1                     the visitor (Forwarded)
+#     Forwarded (e.g. AWS API Gateway)
+#   A CDN in front of that proxy, and      1                 2                     the visitor (Forwarded)
+#     the CDN is the only way to reach it
+#
+# When the Forwarded header is read (TRUST_FORWARDED_HOPS above 0), it wins
+# and TRUST_PROXY_HOPS is not consulted; TRUST_PROXY_HOPS is the fallback
+# when that header is ignored or absent. Faked headers from visitors are
+# ignored in every row — only the counted proxies are trusted.
 # TRUST_PROXY_HOPS=0
-# TRUST_FORWARDED_HEADER=false
+# TRUST_FORWARDED_HOPS=0
 
 # Log verbosity: debug | info | warn | error (default: info).
 LOG_LEVEL=info
@@ -250,16 +272,27 @@ LOG_RETENTION_DAYS=90
 PUID=1000
 PGID=1000
 
-# Device name shown in Obsidian Sync settings.
+# Device name the container reports to Obsidian Sync — labels its changes in the sync log.
 DEVICE_NAME=vault-cortex
 
 # Obsidian Sync conflict resolution: merge | conflict (default: merge).
 # 'merge' integrates changes automatically; 'conflict' writes a separate conflict file.
 CONFLICT_STRATEGY=merge
 
-# Sync direction: bidirectional | pull-only | push-only (default: bidirectional).
+# Sync direction: bidirectional | pull-only | mirror-remote (default: bidirectional).
+# 'pull-only': server edits are kept locally but never uploaded;
+# 'mirror-remote': server edits are undone, so the server is an exact copy.
 SYNC_MODE=bidirectional
 
+# Folders to leave out of sync, comma-separated — the same list as Obsidian's
+# Sync → "Excluded folders". Empty keeps the Sync client's default (nothing excluded).
+SYNC_EXCLUDED_FOLDERS=
+
+# Attachment types to sync, comma-separated: image, audio, video, pdf, unsupported —
+# the same toggles as Obsidian's Sync → "Selective sync". Empty keeps the Sync
+# client's default.
+SYNC_FILE_TYPES=
+
 # Obsidian settings categories to sync into the server's .obsidian/ folder
 # (default: the two the server reads — daily notes settings and community
 # plugin settings such as the Tasks plugin's format; "none" disables).

package/dist/optional-settings.js

@@ -69,9 +69,9 @@ const OPTIONAL_SETTINGS = [
                 hint: "receive changes but never push",
             },
             {
-                value: "push-only",
-                label: "Push-only",
-                hint: "push changes but never pull",
+                value: "mirror-remote",
+                label: "Mirror remote",
+                hint: "receive changes and revert any server-side edit",
             },
         ],
         defaultValue: "bidirectional",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-cortex",
-  "version": "0.10.7",
+  "version": "0.12.0",
   "description": "Set up a Vault Cortex MCP server for your Obsidian vault in one command: npx vault-cortex@latest init",
   "license": "MIT",
   "type": "module",