The proxy's shared access.log mixes every site on oolon and records neither
Host nor Origin. Origin is the only field that separates our UI's WebSocket
from another site's, because browsers send no Referer on the upgrade. The
public vhost now writes its own JSON-lines log carrying both.
Ten days of the shared log showed no third-party site using the API, and two
headless pollers: an OVH host polling summary once a minute (88% of all
no-referer REST) and a Hetzner host identifying as `stardust-devops`. The
public vhost now refuses the hosting networks of both providers, from the
prefixes RIPEstat reports as announced by AS24940, AS213230, AS212317 and
AS16276, generated by script/deny-networks.py and committed so the list is
reviewed. AS35540 is OVH's residential broadband and is left out. Against the
same ten days, the list matches the two pollers and no visitor.
Refusals are a plain-text 403 and are still logged with "denied":1, so a VPN
user caught by it shows up rather than disappearing.
Closes#24
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4Ldjix2ofMdQ7dzqgnYA8
