rays
a20062d0f7
ipx's clients had no destination policy and followed redirects anywhere. Adding a feed returned the status or first line of whatever answered at the address; an enclosure declared as audio was downloaded whole from any URL and served back through /media; /api/art fetched any image a feed named. Feeds come from publishers and anyone signed in, so loopback, the Docker network and the LAN were all reachable. ipx-feed's guard is a connector layer: after the name resolves and the connection opens, before the request is written, it looks at the peer's address and refuses anything off the public internet unless config.toml's [general] fetch_internal lists it. Being on the connection, it covers every request on ctx.client and feed_client, each redirect hop, IP literals (which never reach a DNS resolver) and a name that resolves differently the second time. reqwest's rustls connection reports the peer address; a test run by hand checks HTTPS gets through, since were it lost every https fetch would be refused. The directory is on the server's own network by design (http://ipx-directory:8100), so it moves to local_client, unguarded, set by an admin. The browser suite and load tests serve their feeds on loopback and list 127.0.0.1. Not covered: librqbit's own connections (trackers, peers), which do not go through these clients. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
57 lines
2.7 KiB
TOML
57 lines
2.7 KiB
TOML
[workspace]
|
|
members = ["crates/ipx", "crates/feed", "crates/directory"]
|
|
resolver = "3"
|
|
|
|
# Each service has its own version, in its own Cargo.toml (ipx, ipx-directory) or package.json
|
|
# (the page), released and tagged on its own; see CLAUDE.md.
|
|
[workspace.package]
|
|
edition = "2024"
|
|
|
|
[workspace.dependencies]
|
|
ipx-feed = { path = "crates/feed" }
|
|
ipx-directory = { path = "crates/directory" }
|
|
ammonia = "4.1.4"
|
|
anyhow = "1.0.104"
|
|
argon2 = "0.6.0"
|
|
atom_syndication = "0.12.10"
|
|
axum = "0.8.9"
|
|
flate2 = "1.1.10"
|
|
chrono = { version = "0.4.45", default-features = false, features = ["std", "clock"] }
|
|
clap = { version = "4.6.6", features = ["derive"] }
|
|
futures-util = { version = "0.3.34", default-features = false, features = ["std"] }
|
|
jsonwebtoken = { version = "11.1.0", default-features = false, features = ["aws_lc_rs"] }
|
|
librqbit = { version = "9.0.1", default-features = false, features = ["rust-tls", "http-api-client"] }
|
|
opentelemetry = { version = "0.33", default-features = false, features = ["trace"] }
|
|
opentelemetry-otlp = { version = "0.33", default-features = false, features = ["trace", "http-proto", "reqwest-blocking-client", "gzip-http"] }
|
|
opentelemetry_sdk = { version = "0.33", default-features = false, features = ["trace"] }
|
|
opml = "1.1.6"
|
|
pulldown-cmark = { version = "0.13.4", default-features = false, features = ["html"] }
|
|
mimalloc = "0.1.52"
|
|
http = "1.5.0"
|
|
hyper-util = { version = "0.1.20", features = ["client-legacy"] }
|
|
percent-encoding = "2.3.2"
|
|
quick-xml = { version = "0.42.0", features = ["escape-html"] }
|
|
reqwest = { version = "0.13.5", default-features = false, features = ["rustls", "http2", "gzip", "brotli", "zstd", "stream", "json", "charset", "system-proxy"] }
|
|
rss = "2.1.1"
|
|
sea-orm = { version = "2.0.3", default-features = false, features = ["sqlx-sqlite", "sqlx-postgres", "runtime-tokio-rustls", "macros", "with-json", "sqlite-use-returning-for-3_35"] }
|
|
serde = { version = "1.0.229", features = ["derive"] }
|
|
serde_json = "1.0.151"
|
|
sha2 = "0.10.9"
|
|
tokio = { version = "1.53.1", features = ["rt-multi-thread", "macros", "fs", "io-util", "net", "sync", "time", "signal", "process"] }
|
|
toml = "1.1.5"
|
|
tower = { version = "0.5.3", features = ["util"] }
|
|
tower-http = { version = "0.7.1", features = ["fs", "compression-br", "compression-gzip", "compression-zstd", "decompression-gzip"] }
|
|
tracing = "0.1.44"
|
|
tracing-opentelemetry = { version = "0.34", default-features = false }
|
|
tracing-subscriber = { version = "0.3.23", features = ["env-filter", "json"] }
|
|
url = "2.5.8"
|
|
|
|
# Backtraces keep file and line; the full debug info made a 431 MB test binary whose link ran
|
|
# Tower, which has no swap, out of memory and stalled it for most of an hour (2026-10-18).
|
|
[profile.dev]
|
|
debug = "line-tables-only"
|
|
|
|
# Nobody steps through dependencies.
|
|
[profile.dev.package."*"]
|
|
debug = false
|