fix(gateway): enforce request body size limits

2026-02-15 21:44:36 -08:00
parent 22959ea3aa
commit d93c1c9f8d
13 changed files with 270 additions and 22 deletions
@@ -686,6 +686,15 @@ server:

 The web UI detects the locked state and disables auto-reconnect when rejected.

+## Gateway Request Body Limit
+
+Cap inbound HTTP POST body size (webhooks and Gmail push) to reduce memory-DoS risk.
+
+```yaml
+server:
+  max_request_body_bytes: 1048576  # 1 MiB
+```
+
 ## Tailscale Serve

 Automatically expose the gateway via Tailscale Serve when the daemon starts. Requires Tailscale to be installed and authenticated on the host.