[ptr727]

Summary

Promotes these develop changes to main:

• Send the Same Security Headers and Image Lifetime From Both Sites #499: the blog site block sends HSTS, nosniff, and Referrer-Policy with the family block's values. The family images take the blog's one-hour image class. deploy/README.md "Security headers" and "Cache lifetimes" give the reason for each difference that stays.
• Confirm the Proxy Headers Before Calling a Run Proxied #498: OPERATIONS.md "Deploying" says to confirm server: cloudflare and cf-ray from the checking machine before calling a hand run proxied.

Closes #497.

Verification

Release 5ff25e7 of #499's branch is on the local staging mirror. checks/check-live-urls.sh passed there in full: 1294 URLs, with the family site included. Every response class on both sites was read for the new headers, lifetimes, and content types. #499's later commits change only documentation wording.

Release

This changes the served headers, so it needs a release to VPS production and the local production mirror. After the release, the HomeAutomation-Config session re-measures both production names through the proxy, per #497.

Deferred

• Assert the Security Headers in the Live Check #500: assert the security headers in the live check.
• Survey What Blog Posts Load Before a Blog Content-Security-Policy #501: survey what blog posts load before a blog CSP.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 86516bf0-0265-4c39-8222-210d1732ba53

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.70%. Comparing base (f35ec08) to head (64b8793).
⚠️ Report is 140 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #502   +/-   ##
=======================================
  Coverage   49.70%   49.70%           
=======================================
  Files          10       10           
  Lines        3058     3058           
=======================================
  Hits         1520     1520           
  Misses       1538     1538           

Flag	Coverage Δ
python-3.13	49.70% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟡 Changes recommended

The proxied-run preflight must validate both required headers for every configured base URL before approval.

1 open issue

• Require both valid Cloudflare proxy headers in preflight · New

What changed in this PR

This pull request promotes site security-header, caching, and proxied-run verification changes from develop to main.

Changes:

• Adds HSTS, nosniff, and Referrer-Policy headers to the blog site block.
• Aligns family-site image caching with the one-hour policy and documents cache and security-header rationale.
• Documents Cloudflare verification requirements before manually running production URL checks.

File	Summary	Review findings
OPERATIONS.md	Adds Cloudflare proxy-header verification guidance for hand-run checks.	Two [P1] moderate findings: require both valid proxy predicates, including server: cloudflare, and verify every configured base URL, including the family URL.
deploy/​README.md	Documents security headers and cache-lifetime rationale.	One [P2] nit: clarify that the HSTS scope is excluded under the site's domain.
deploy/​Caddyfile	Adds blog security headers and aligns family image caching.	No findings.

_{Review effort: Lite}

[ptr727]

Answering the round on 4493967: the deploy/README.md HSTS nit (clarify the includeSubDomains scope) is fixed by #503. The sentence now says it would extend the policy to every subdomain of the site's hostname, and that this bundle serves none of them.

[Copilot]

🔵 Needs a closer look

The proxy preflight can accept server: cloudflare-origin or an empty cf-ray, so the unresolved moderate finding should be addressed before approval.

No open issues 🎉

1 resolved since last review

• Require both valid Cloudflare proxy headers in preflight

_{Review effort: Lite}

[ptr727]

Answering the round on 64b8793 ("the probe can accept server: cloudflare-origin or an empty cf-ray"): declined, because no component in this deployment can produce either input.

• The probe tells two states apart: the edge answering, or the origin answering through a lagging resolver. Measured by hand on this head, a DNS-only name served by the same origin stack sends neither a server header nor cf-ray. A proxied name sends exactly server: cloudflare with a cf-ray.
• A cloudflare-origin server value or an empty cf-ray would need the maintainer's own origin to impersonate the edge. The probe's readers are the maintainer and his agents on his own hosts, so that is not a threat this check guards against. The local strict pass on Print a Proxied Verdict for Every Host the Check Reaches #503 reached the same conclusion about the prefix match.
• Every failure the probe can meet (curl error, origin answer, missing header) prints UNCONFIRMED, so it fails closed.