galaxy-game

developer/galaxy-game

Fork 0

T

Ilia Denisov 1855e43699

Tests · Go / test (push) Successful in 1m42s

Details

Tests · Go / test (pull_request) Successful in 1m45s

Details

Tests · Integration / integration (pull_request) Successful in 1m36s

Details

gateway: add CORS allow-list for the public REST surface

Adds a `GATEWAY_PUBLIC_HTTP_CORS_ALLOWED_ORIGINS` env-driven allow-list
on the public REST server so the dev UI on https://www.galaxy.lan can
call https://api.galaxy.lan without the browser blocking the
cross-origin response. Defaults to empty (no CORS) so the production
posture stays closed.

The middleware mounts before route classification and anti-abuse, so
OPTIONS preflights never charge against per-class rate-limit buckets.

`tools/dev-deploy/docker-compose.yml` opts the dev gateway into a
single allowed origin (`https://www.galaxy.lan`); local-dev keeps the
defaults because Vite proxies through the same origin.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-15 07:58:14 +02:00

.claude

chore: claude settings

2026-05-11 01:10:32 +02:00

.gitea/workflows

ci: re-enable actions cache now that the runner serves it

2026-05-15 07:39:39 +02:00

backend

ui/phase-27: battle viewer (radial scene, playback, map markers)

2026-05-13 12:24:20 +02:00

client

ui/phase-9: PixiJS map renderer with torus and no-wrap modes