[Wikid82]

Summary

Tightens how access lists are applied by the proxy and how their changes are reported.

• Country lists are applied by the proxy. They need the GeoIP database; when it is unavailable they refuse requests, the Security page shows a passive note, and the image build prints a warning and writes a marker file. Reloading the database re-applies the config.
• An enabled allow-list needs at least one entry; one with none is refused on save (with a message in the form) and answers with a refusal if it exists in storage.
• Country codes are normalised on save and when the config is generated.
• Editing an access list that is attached to hosts now updates the proxy.
• The access-list switch is checked the same way on every settings path.
• Refused requests (403/429) now carry the configured security headers.
• Shared local-network ranges, a failed GeoIP reload keeps the loaded database, and docs updated.

Addresses #1851

Notes

• Commits: refactor, status/build check, frontend messages, hardening, headers, e2e, docs, QA fixes, QA report.
• Image builds that cannot download the GeoIP database now say so at build time; country lists then refuse requests until a database is provided at CHARON_GEOIP_DB_PATH.
• QA report: docs/reports/qa_report.md.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1873

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	13
🟢 Low	2
Total	16

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[codecov]

Codecov Report

❌ Patch coverage is 97.41379% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ckend/internal/api/handlers/access_list_handler.go	84.00%	4 Missing ⚠️
backend/internal/api/handlers/security_handler.go	96.66%	1 Missing ⚠️
backend/internal/api/routes/geoip_startup.go	85.71%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!