onWatch

onWatch v2.13.2

Trusted reverse-proxy / SSO support for the dashboard, plus a log-hygiene fix.

✨ Feature

• Trusted reverse-proxy / SSO auth mode (#83). If your dashboard already sits behind Authentik, Authelia, oauth2-proxy, or Traefik ForwardAuth, ONWATCH_AUTH_MODE=trusted_proxy skips the second onWatch login. A request bypasses local auth only when its direct TCP peer (never X-Forwarded-For) is inside ONWATCH_TRUSTED_PROXY_CIDRS and carries exactly one non-empty ONWATCH_TRUSTED_USER_HEADER value (default X-Forwarded-User; multi-value headers are rejected to block header smuggling through append-mode proxies). Everything else falls through to the existing session/Basic Auth, so /api/* keeps working for scripts and internal Docker callers, and spoofed headers from untrusted addresses are ignored. The default stays local, and trusted_proxy without valid CIDRs fails closed at startup. Setup guide with Authentik + Traefik and oauth2-proxy examples: docs/TRUSTED_PROXY_AUTH.md.

🐛 Fix

• Provider settings values are no longer written to the log. Saving provider settings logged the raw incoming settings map - including API keys and tokens - to the daemon log. The handler now logs only the names of the providers that were updated.

Full Changelog: https://github.com/onllm-dev/onWatch/compare/v2.13.1...v2.13.2