finnandClaude Opus 5.5
105fd42d22
Request logging: - One line per request from Flask hooks instead of the LoggingMiddleware. It now also covers static files, unknown URLs, 500 errors and the responses of the CSRF and auth middlewares. In debug mode, where Flask skips after_request on exceptions, the status is logged as 500. - All fields are logged as key=value. - The session is logged as a short SHA-256 prefix instead of the raw id. - In debug mode, the request lines of the Werkzeug dev server are filtered out, since the app logs requests itself. Translations: - TranslationHandler keeps the language in flask.g instead of a class attribute, so concurrent requests cannot overwrite each other's language. - Translating or rendering a template without a language raises LanguageNotSet. Requests that do not pass the I18NMiddleware are logged with lang=None. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Max
A small little program to manage emails.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.stMAX_PRODUCTION=1is set in the Docker image and makes MAX refuse to start in debug mode (FLASK_DEBUG). Do not override it.
Reverse proxy
In production, the reverse proxy must set X-Real-IP to the client's address and overwrite any
value the client sends. Max uses this address for audit logging. For nginx:
proxy_set_header X-Real-IP $remote_addr;
Dependencies
Direct dependencies are listed in requirements.in (production) and
requirements-dev.in (development tools). requirements.txt and
requirements-dev.txt are lockfiles with exact versions and hashes
- After changing a
.infile:make lock-depsandmake sync-deps - Update all dependencies:
make update-depsandmake sync-deps - Check for known vulnerabilities:
make audit(before every release)