Security page; nginx/CSRF/envsubst gotchas
New Security page. The wiki had no security coverage at all, which is a gap
now that the project is public and pullable: a hardening checklist for anyone
moving past a local lab, the security-relevant settings, the CSP trade-off,
and the review history.
The settings needed a home in particular. IRIS_CORS_ALLOWED_ORIGINS appeared
only in a changelog row, and the three analytics variables were documented
nowhere in the wiki despite shipping in August. Both are the kind of setting
someone reaches for while debugging something unrelated, so each says plainly
when NOT to set it -- CORS is a browser policy and does nothing for n8n, API
clients or LLM backends, and the analytics variables silently disable each
other unless all three agree on the host.
Development Guide: the add_header/always rule (both nginx conf files are live,
editing one is half a fix), validate_on_submit versus hand-rolling
is_submitted() + validate(), and the envsubst allowlist being wrong in both
directions -- a missing variable emits a literal ${VAR} into the CSP, an extra
one is CERT_DIR, which nginx never reads.
Corrects a contradiction: the Development Guide said not to open a public issue
for a vulnerability, while the SECURITY.md it linked to says to report by
creating one. It now points at the Security page. The repository file still
carries upstream's text and needs the maintainer's decision on a private
channel.
Getting Started links to the checklist from First login.