doot.git/internal/handlers/proxy.go, branch masterdoot — personal productivity web app
https://git.terst.org/doot.git/atom?h=master2026-07-05T04:50:42+00:00fix(proxy): set Host header to upstream target to satisfy loopback MCP DNS-rebinding check2026-07-05T04:50:42+00:00Peter Stonethepeterstone@gmail.com2026-07-05T04:50:42+00:00urn:sha1:24a87b9e979abe6c2ba23421293dc0cd8cb6d65f
mcp.NewStreamableHTTPHandler rejects requests where the server is
bound to loopback but the Host header is not (DNS-rebinding protection).
Requests proxied through doot arrived at claudomator with
Host: doot.terst.org, triggering a 403.
Set req.Host = target.Host in the ReverseProxy Director so upstream
services see the target host (e.g. 127.0.0.1:8484) rather than the
original public hostname.
feat: service gateway framework + playground demo2026-06-15T09:14:14+00:00Peter Stonethepeterstone@gmail.com2026-06-15T09:14:14+00:00urn:sha1:c86abd29845fa6feb61b1fddb8e8bb41312d55a8
Formalizes doot as an authenticated reverse proxy for arbitrary upstream
services. Any local HTTP service can now be registered behind doot's
existing auth + SSL layer with 3 lines of config.
- Rename NewClaudomatorProxy → NewServiceProxy (generic)
- Replace hard-coded claudomator proxy block with serviceMount slice loop
- Add PlaygroundURL config (PLAYGROUND_URL env var)
- Add playground/web/server.py: stdlib Python status page on port 9090
- Document pattern in .agent/design.md; update .env.example
To add a new service: set its URL env var, add a config field, append
one mount entry in main.go. Claudomator's GitHub webhook bypass is
expressed as webhookPaths on its mount.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>