finnandClaude Opus 5.5
b1c412f3d7
A catch-all rule raises NotFound, so unknown URLs pass the middlewares and get the regular not found page instead of Flask's default 404. Anonymous visitors are redirected to the login like for any other URL, so they cannot tell which URLs exist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Max
A small little program to manage emails.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.stMAX_PRODUCTION=1is set in the Docker image and makes MAX refuse to start in debug mode (FLASK_DEBUG). Do not override it.
Reverse proxy
In production, the reverse proxy must set X-Real-IP to the client's address and overwrite any
value the client sends. Max uses this address for audit logging. For nginx:
proxy_set_header X-Real-IP $remote_addr;
Dependencies
Direct dependencies are listed in requirements.in (production) and
requirements-dev.in (development tools). requirements.txt and
requirements-dev.txt are lockfiles with exact versions and hashes
- After changing a
.infile:make lock-depsandmake sync-deps - Update all dependencies:
make update-depsandmake sync-deps - Check for known vulnerabilities:
make audit(before every release)