wweir 5dc57bc234 docs: security model for the sowerd edge; document the unknown-SNI cert fallback ...

Review of the anti-probing hardening found no code defects; the fixes
are documentation:

- docs/security.md: authoritative threat model, the three camouflage
  layers, unknown-SNI certificate fallback rules (whitelist source,
  error surfacing, capability propagation, concrete first entry), the
  client_hello fingerprint knob, rejected directions (QUIC, h2) with
  evidence, and residual accepted signals.
- Promote the plan doc to a non-authoritative historical record per
  AGENTS.md docs rules; index security.md from docs/README.md and
  ARCHITECTURE.md.
- config/sowerd.toml: document cert.domains; the first entry answers
  unknown-SNI handshakes.

2026-09-18 18:05:02 +08:00

..

example_load_test.go

refactor(config): drop YAML support, keep TOML only

2026-08-10 16:17:11 +08:00

sower_test.go

fix(install,config): lock down installed config, atomic binary copy, reject socks5 password, parse bare ipv6

2026-08-12 17:23:14 +08:00

sower.go

fix(install,config): lock down installed config, atomic binary copy, reject socks5 password, parse bare ipv6

2026-08-12 17:23:14 +08:00

sower.toml

docs(config): document dns.reverse in example config, clarify totals test

2026-08-11 23:35:15 +08:00

sowerd_test.go

feat(sowerd): support path-prefix routing within site routes

2026-08-13 08:44:38 +08:00

sowerd.go

feat(sowerd): support path-prefix routing within site routes

2026-08-13 08:44:38 +08:00

sowerd.toml

docs: security model for the sowerd edge; document the unknown-SNI cert fallback

2026-09-18 18:05:02 +08:00