Zareian 4cd859b5fa 216 backups encrypted on 216: pgBackRest (AES-256) + age-encrypted payment CSVs, pushed write-only to 247 with rrsync; health watches pg_stat_archiver and OFFSITE_SYNC_STATUS_FILE; 216 scripts/configs in ops/server216; plaintext pg216 pipeline removed ...

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-17 19:43:00 +03:30

..

__init__.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30

asgi.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30

cache.py

Do not connect to the shared Redis: CACHE_URL stays empty, own Redis is an open decision

2026-10-07 14:41:39 +03:30

db.py

API output without Persian diacritics or written ezafe ی (company decision); tutor answers too

2026-10-14 16:57:17 +03:30

exceptions.py

Postgres connection pool, clean 503 under overload, time indexes, 4 workers

2026-10-11 20:21:35 +03:30

health.py

216 backups encrypted on 216: pgBackRest (AES-256) + age-encrypted payment CSVs, pushed write-only to 247 with rrsync; health watches pg_stat_archiver and OFFSITE_SYNC_STATUS_FILE; 216 scripts/configs in ops/server216; plaintext pg216 pipeline removed

2026-10-17 19:43:00 +03:30

log_formatters.py

throttling, abuse-protection & logging/monitoring pass

2026-08-23 23:44:00 +03:30

middleware.py

Trust X-Forwarded-For only from ArvanCloud edges

2026-10-13 18:45:27 +03:30

renderers.py

API output without Persian diacritics or written ezafe ی (company decision); tutor answers too

2026-10-14 16:57:17 +03:30

settings.py

216 backups encrypted on 216: pgBackRest (AES-256) + age-encrypted payment CSVs, pushed write-only to 247 with rrsync; health watches pg_stat_archiver and OFFSITE_SYNC_STATUS_FILE; 216 scripts/configs in ops/server216; plaintext pg216 pipeline removed

2026-10-17 19:43:00 +03:30

tests_app_log_archive.py

App logs kept forever: nightly gzip on 249 (LOG_FILE_ROTATION=external), hourly pull to 247 via a forced-command key, health warns if the archive stops

2026-10-13 17:54:05 +03:30

tests_audit_round2.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_cache_resilience.py

Close /api/health details and API docs to the public

2026-10-08 13:05:19 +03:30

tests_db_pool.py

Postgres connection pool, clean 503 under overload, time indexes, 4 workers

2026-10-11 20:21:35 +03:30

tests_domains.py

make the domain configuration, not code: two env vars move everything

2026-09-26 23:46:25 +03:30

tests_no_fixed_logins.py

Server hardening: nginx origin locked to ArvanCloud + CSP, demo logins removed, docs

2026-10-13 19:17:11 +03:30

tests_offsite_backup.py

216 backups encrypted on 216: pgBackRest (AES-256) + age-encrypted payment CSVs, pushed write-only to 247 with rrsync; health watches pg_stat_archiver and OFFSITE_SYNC_STATUS_FILE; 216 scripts/configs in ops/server216; plaintext pg216 pipeline removed

2026-10-17 19:43:00 +03:30

tests_plain_persian.py

API output without Persian diacritics or written ezafe ی (company decision); tutor answers too

2026-10-14 16:57:17 +03:30

tests_request_size.py

Oversized request body: 413 with a short warning instead of 500 and an ERROR traceback

2026-10-07 14:48:03 +03:30

tests_trusted_proxy.py

Trust X-Forwarded-For only from ArvanCloud edges

2026-10-13 18:45:27 +03:30

tests.py

Close /api/health details and API docs to the public

2026-10-08 13:05:19 +03:30

urls.py

Security review fixes: admin permissions, guest sessions, payment edge cases, assistant leaks

2026-10-05 04:52:25 +03:30

wsgi.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30