Make kom-relay fit for public use

littlefox commented

2026-10-17 17:54:19 +00:00

Owner

An installable web app (#51) needs HTTPS: browsers only allow service workers on HTTPS (or localhost). That means hosting the web app and kom-relay somewhere real, even if only for testing on a phone.

What:

Limits: connections per IP address, total connections, bytes per second, and an idle timeout.
Keep the fixed target (no open proxy) and check the WebSocket Origin header against a configured list.
Logs without content: connection counts and errors, never what's sent.
Docs for running it behind a TLS-terminating proxy (wss://) with an example config.

Done when:

Tests show each limit kicks in.
DESIGN.md describes the relay's threat model.

Helps: #51. Hosting itself is roadmap question 1 (needs the user).

From docs/ROADMAP.md, "Under the hood"; filed for 0.2.

An installable web app (#51) needs HTTPS: browsers only allow service workers on HTTPS (or localhost). That means hosting the web app and kom-relay somewhere real, even if only for testing on a phone. What: - Limits: connections per IP address, total connections, bytes per second, and an idle timeout. - Keep the fixed target (no open proxy) and check the WebSocket Origin header against a configured list. - Logs without content: connection counts and errors, never what's sent. - Docs for running it behind a TLS-terminating proxy (wss://) with an example config. Done when: - Tests show each limit kicks in. - DESIGN.md describes the relay's threat model. Helps: #51. Hosting itself is roadmap question 1 (needs the user). From docs/ROADMAP.md, "Under the hood"; filed for 0.2.

littlefox added this to the 0.2: Feels like an app milestone

2026-10-17 17:54:19 +00:00

littlefox added the

kind/infra

area/web

security

labels

2026-10-17 17:54:19 +00:00

littlefox referenced this issue

2026-10-17 17:56:17 +00:00

Host a test server for the web app (HTTPS) #71

littlefox commented

2026-10-17 17:56:24 +00:00

Author

Owner

Needed before #71's test server goes up.

littlefox referenced this issue from a pull request that will close it,

2026-10-17 21:42:32 +00:00

kom-relay fit for public use #85

littlefox referenced this issue from a commit

2026-10-17 21:42:33 +00:00

kom-relay fit for public use: limits, origins, quiet logs

littlefox closed this issue

2026-10-17 23:13:39 +00:00

littlefox commented

2026-10-18 00:56:00 +00:00

Author

Owner

Merged in #85 (CI run #141 green). Limits per address/total, upload pacing, idle timeout, allowed origins, X-Forwarded-For behind a trusted proxy (NEOKOM_RELAY_*). 5 in-process integration tests. docs/RELAY.md: threat model, Caddy/nginx.

Rows
Columns

Make kom-relay fit for public use #67