ZeroLog
Geschlossene Vorschau
Zurück zum Newsroom

Übersetzung noch nicht verfügbar. Der Originaltext wird angezeigt.

Produkt

23 October (continued): key proxy view, newsroom design, documentation corrections

The key proxy settings page was rebuilt and the newsroom got the new design. Several documentation pages were corrected.

Nutzerwirkung: Noch nicht bewertet

Added on 23 October 2026 from the repository history. Thirteen deploys ran on this day.

One request through the key proxyAn agent sends a request that carries a placeholder instead of your key. The egress broker hands it to the key service with a signed preamble naming the user and container. The key service rejects ambiguous requests, chooses the provider profile by destination host, checks that the placeholder is yours, classifies the operation and compares it with the key's rule. Allowed operations continue; known but disallowed ones get 403; unknown operations and payments wait for your approval. After a rate brake the real key is inserted and sent only to the profile's host, and the response is redacted before it returns to the agent.Key service (separate VM)allowedneeds younot allowedapproved once1. Agent sends a requestwith a placeholderinstead of the key2. Egress broker handsover with a signedpreamble (user, container)3. Reject ambiguousrequests: path tricks,duplicate headers4. Pick the profile byhost. Placeholder mustbe yours, same container5. Classify the operation,check the key's rule6. Rate brakeper risk class7. Insert the real key9. Redact your key values,swap new secrets forplaceholders, send back403 refusedYou approve unknownoperations, payments(60 s, then 403)8. Provider APIprofile host onlyno redirects
One request through the key proxy. Diagram from the docs.
Text version

The agent sends a placeholder. The key service checks host and operation against your rule, then inserts the real key.

Key proxy

  • The settings page shows a grid of provider templates with status, access level, validity, a volume limit and the last uses.
  • Unlocking and rotating a key require a passkey. Expiry can only be shortened.
  • Each key has a usage log of up to 100 lines. It records neither path nor value.
  • Tailscale can be stored as an API token or an OAuth client.
  • The BYOK view shows a status line with a zero-data-retention marker and the region of each provider.

Site

  • The newsroom uses the start page design. Entry images appear as the preview image when shared.
  • Header icon, navigation links and the Status footer link on the legal page were fixed.

Documentation corrected

  • Trust page: key service, Infomaniak, MoonPay and IONOS backups.
  • Plans and credit: pack credit expiry, yearly grants, signed top-up confirmation and top-up limit.
  • Deep research and spend limits: no per-user spend cap on deep research.

Auch Korrekturen gehören hierher. Feed · Doku · X · Recht & Datenschutz