Security page; nginx/CSRF/envsubst gotchas
New Security page. The wiki had no security coverage at all, which is a gap
now that the project is public and pullable: a hardening checklist for anyone
moving past a local lab, the security-relevant settings, the CSP trade-off,
and the review history.
The settings needed a home in particular. IRIS_CORS_ALLOWED_ORIGINS appeared
only in a changelog row, and the three analytics variables were documented
nowhere in the wiki despite shipping in August. Both are the kind of setting
someone reaches for while debugging something unrelated, so each says plainly
when NOT to set it -- CORS is a browser policy and does nothing for n8n, API
clients or LLM backends, and the analytics variables silently disable each
other unless all three agree on the host.
Development Guide: the add_header/always rule (both nginx conf files are live,
editing one is half a fix), validate_on_submit versus hand-rolling
is_submitted() + validate(), and the envsubst allowlist being wrong in both
directions -- a missing variable emits a literal ${VAR} into the CSP, an extra
one is CERT_DIR, which nginx never reads.
Corrects a contradiction: the Development Guide said not to open a public issue
for a vulnerability, while the SECURITY.md it linked to says to report by
creating one. It now points at the Security page. The repository file still
carries upstream's text and needs the maintainer's decision on a private
channel.
Getting Started links to the checklist from First login.
TLS certificates page; IRIS-NG-v1.2.0
New TLS Certificates page covering bring-your-own certificates: how CERT_DIR,
CERT_FILENAME and KEY_FILENAME resolve, the Let's Encrypt case, and the two
failure modes worth documenting because neither is guessable from the symptom
alone -- mounting live/<domain> without archive/, which leaves the symlinks
dangling inside the container while ls shows the file present on the host, and
a private key that root owns 0700 and the container's www-data cannot read.
Renewal not reloading nginx is included for the same reason: the site keeps
serving the expired certificate and nothing reports it.
Changelog: IRIS-NG-v1.2.0. Also records that v1.1.0 was never released -- the
note previously named only v1.0.3, though both were staged on main and neither
was ever tagged.
Kubernetes: chart 0.6.0, appVersion IRIS-NG-v1.2.0, pull examples retargeted.
Getting Started: link to the new page, and correct the cert-missing symptom --
nginx now preflights and names the resolved path and the variable behind it
rather than emitting a raw SSL error.
Version scheme IRIS-NG-v1.0.0; document the Sponsor tab and IOC history
Changelog: version-scheme section rewritten for IRIS-NG-v<x.y.z>, stating
plainly that the string is not SemVer-parseable and that 1.0.0 sorts below
every prior release, and that the upstream compatibility range moved to
Settings -> System rather than disappearing. The older +iris-ng.<build> scheme
is kept as a note since those releases are still published. New v1.0.0 row.
Kubernetes: chart 0.3.1 / appVersion IRIS-NG-v1.0.0, image tags repointed to
the IRIS-NG-v1.0.0 images now that they exist, and the "+ becomes -" note
reframed as applying to the older scheme only.
Home: Sponsor tab and IOC history added to the feature list.
Add Kubernetes page with DigitalOcean referral; link from Home and Getting Started
The Helm chart at deploy/kubernetes exists but is inherited from upstream and
is not deployable as committed. The page documents the three gaps rather than
implying a working one-command install:
- no images are published (the ghcr workflows fire only on a v*.*.* tag, and
no container packages currently exist), so users must build and push first
- values.yaml ships literal placeholders (<irisapp_image>, <host_name>, ...)
- the chart has no ai_worker, so AI summary and chat jobs enqueue and are
never consumed -- a silent failure, not an error
Also covers installing, persistence, sizing, and points at Docker Compose on a
single host as the tested path for evaluation. The DigitalOcean link is
disclosed as a referral link at both the wiki and README.
Brand wiki as Community Edition; fix release table accuracy
Home: new "Community Edition" and "Contributing and support" sections
(LGPL-3.0, no feature gates, no license key or activation, no telemetry,
self-hosted); title and intro updated.
Getting Started: state up front that no registration, activation or
license key is required anywhere in the install.
Development Guide: new "Contributing" section — branch table (`main` is
the PR target; `develop` is retired with unrelated history), pre-PR
checklist covering the roadmap, CODESTYLE, the three-layer rule, ORM
CHECK constraints and deploy verification, plus security-issue routing.
Changelog: version scheme corrected to `+iris-ng.<build>` with a note
explaining the `iris-next` -> `iris-ng` rename and the skipped `.5`.
Added the `v2.5.0-beta.1+iris-ng.6` release. Rows for `iris-next.5`,
`.1` and `.0` relabelled as milestones — only four releases are actually
published, and listing unpublished builds as tagged releases was
misleading.
Docs sync: fix Getting Started cert step, strip private Claude integration, add 3 pages
- Getting Started: add required generate_dev_certs.sh step + iris_helper.sh --init
one-shot; correct false "cert generated at container start" claim (certs are
host-generated and bind-mounted read-only); add nginx cert-perms troubleshooting.
- Remove Claude proxy sidecar + per-case Claude memory (not in the public repo):
AI-Features (sidecar/memory sections, backend row, timeout row), Architecture
(claudeProxy/ tree line), Getting Started (service row, port 7440, pointer).
Kept SYNTHESIZER_FAST_MODEL_MAP model routing (real public code).
- New pages: Analyst Time Tracking, Analyst Skills and Teams, Case Export / Import.
- Home: nav rows + at-a-glance links for the three new pages.
Updated Getting Started (markdown)
[DOC] Migration troubleshooting: post-import login failure, secrets diagnostic, force-recreate rule
Updated Getting Started (markdown)
Add initial wiki (11 pages)