Leon SerfatyandClaude Opus 5 605c0e0052 Allow plaintext Postgres in production for private-network hosts only ...

The production DB is now a Postgres container on the same Docker/Swarm overlay
network as the app, reachable as a bare service name. It does not speak TLS, and
no managed-DB CA exists for it, so the previous fail-closed rules (CA required in
production; DATABASE_SSL=disable refused in production) made it unusable.

Narrow both rules to distinguish private from public hosts: a Docker service name,
localhost, or an RFC1918 address may connect in plaintext, because that traffic
never leaves the internal network. A routable hostname or public IP in production
still fails closed exactly as before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-26 11:19:14 -04:00

..

migrations

Superadmin impersonation, hardened auth/upload paths, dependency updates

2026-08-26 10:25:39 -04:00

src

Allow plaintext Postgres in production for private-network hosts only

2026-08-26 11:19:14 -04:00

drizzle.config.ts

Initial commit — eLegal Software monorepo

2026-04-26 02:42:42 -04:00

package.json

Security hardening: deps, tenancy quotas, auth, deploy, webhooks

2026-07-17 13:34:33 -04:00

tsconfig.json

Initial commit — eLegal Software monorepo

2026-04-26 02:42:42 -04:00