Finding
ByparrProxy in crates/zetesis/src/cf_bypass/byparr.rs implements a complete Cloudflare bot-protection bypass for search indexer fetches: HTTP fetch, cookie extraction, and CloudflareProxy trait impl. serve.rs unconditionally passes Arc::new(NoProxy) to the search subsystem and never reads cloudflare_bypass_enabled or cf_proxy_url from SearchSubsystemConfig. The bypass is fully implemented and permanently disabled regardless of config.
Evidence
serve.rs:645: Arc::new(NoProxy) is hardwired. SearchSubsystemConfig fields cloudflare_bypass_enabled and cf_proxy_url exist but rg 'cloudflare_bypass_enabled|cf_proxy_url' in serve.rs = 0 hits. rg 'ByparrProxy' across the codebase = only definition + mod re-export.
Why this matters
Any indexer behind Cloudflare protection returns bot-detection failures for all fetch attempts. The bypass capability was built precisely to handle this class of indexer, but the wiring conditional was never added to serve.rs. Operators who set cloudflare_bypass_enabled = true in config receive no error and no effect — the config is silently ignored.
Desired correction
In serve.rs, replace the unconditional Arc::new(NoProxy) with a conditional: read config.zetesis.cloudflare_bypass_enabled; if true, construct Arc::new(ByparrProxy::new(config.zetesis.cf_proxy_url.clone())) and pass it instead. Add an integration test that verifies the bypass is selected when the config flag is set.
Done when: cloudflare_bypass_enabled = true in config causes ByparrProxy to be used for indexer fetches, and the config field has a production read site.
Finding
ByparrProxyincrates/zetesis/src/cf_bypass/byparr.rsimplements a complete Cloudflare bot-protection bypass for search indexer fetches: HTTP fetch, cookie extraction, andCloudflareProxytrait impl.serve.rsunconditionally passesArc::new(NoProxy)to the search subsystem and never readscloudflare_bypass_enabledorcf_proxy_urlfromSearchSubsystemConfig. The bypass is fully implemented and permanently disabled regardless of config.Evidence
serve.rs:645:Arc::new(NoProxy)is hardwired.SearchSubsystemConfigfieldscloudflare_bypass_enabledandcf_proxy_urlexist butrg 'cloudflare_bypass_enabled|cf_proxy_url'inserve.rs= 0 hits.rg 'ByparrProxy'across the codebase = only definition + mod re-export.Why this matters
Any indexer behind Cloudflare protection returns bot-detection failures for all fetch attempts. The bypass capability was built precisely to handle this class of indexer, but the wiring conditional was never added to
serve.rs. Operators who setcloudflare_bypass_enabled = truein config receive no error and no effect — the config is silently ignored.Desired correction
In
serve.rs, replace the unconditionalArc::new(NoProxy)with a conditional: readconfig.zetesis.cloudflare_bypass_enabled; if true, constructArc::new(ByparrProxy::new(config.zetesis.cf_proxy_url.clone()))and pass it instead. Add an integration test that verifies the bypass is selected when the config flag is set.Done when:
cloudflare_bypass_enabled = truein config causesByparrProxyto be used for indexer fetches, and the config field has a production read site.