Merge develop — release v0.7.10 (whitelist sync fix)

Author: hrodrig

CHANGELOG.md

@@ -7,6 +7,12 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.7.10] - 2026-06-19
+
+### Fixed
+
+- **Manual sync + IP whitelist:** valid `x-api-token` bypasses `GGHSTATS_WHITELIST` on protected paths so dashboard **Sync all** works remotely; clearer sync error messages (403/429) in the UI.
+
 ## [0.7.9] - 2026-06-16
 
 ### Added
@@ -327,7 +333,8 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 - Project naming and module path finalized as `gghstats` (binary, Docker image, `GGHSTATS_*` environment variables).
 - Toolchain and build base image aligned to Go **1.26.1**.
 
-[Unreleased]: https://github.com/hrodrig/gghstats/compare/v0.7.9...HEAD
+[Unreleased]: https://github.com/hrodrig/gghstats/compare/v0.7.10...HEAD
+[0.7.10]: https://github.com/hrodrig/gghstats/compare/v0.7.9...v0.7.10
 [0.7.9]: https://github.com/hrodrig/gghstats/compare/v0.7.8...v0.7.9
 [0.7.8]: https://github.com/hrodrig/gghstats/compare/v0.7.7...v0.7.8
 [0.7.7]: https://github.com/hrodrig/gghstats/compare/v0.7.6...v0.7.7

README.md

@@ -2,7 +2,7 @@
 
 ![gghstats — self-hosted GitHub traffic beyond the 14-day window](assets/gghstats-poster-devto.png)
 
-[![Version](https://img.shields.io/badge/version-0.7.9-blue)](https://github.com/hrodrig/gghstats/releases)
+[![Version](https://img.shields.io/badge/version-0.7.10-blue)](https://github.com/hrodrig/gghstats/releases)
 [![Release](https://img.shields.io/github/v/release/hrodrig/gghstats)](https://github.com/hrodrig/gghstats/releases)
 [![CI](https://github.com/hrodrig/gghstats/actions/workflows/ci.yml/badge.svg)](https://github.com/hrodrig/gghstats/actions)
 [![codecov](https://codecov.io/gh/hrodrig/gghstats/graph/badge.svg)](https://codecov.io/gh/hrodrig/gghstats)
@@ -123,7 +123,7 @@ export GGHSTATS_GITHUB_TOKEN=ghp_xxx
 gghstats run --open
 ```
 
-Or extract a [Release](https://github.com/hrodrig/gghstats/releases) tarball, or `go install github.com/hrodrig/gghstats/cmd/gghstats@latest`. Pin a version: `VERSION=v0.7.9 curl -fsSL …/install.sh | sh`.
+Or extract a [Release](https://github.com/hrodrig/gghstats/releases) tarball, or `go install github.com/hrodrig/gghstats/cmd/gghstats@latest`. Pin a version: `VERSION=v0.7.10 curl -fsSL …/install.sh | sh`.
 
 Open <http://localhost:8080> if you did not use **`--open`**. Data is stored in `./data/gghstats.db` (override with `GGHSTATS_DB`). A first sync may take a while if the default filter includes many repositories — narrow `GGHSTATS_FILTER` in [Configuration](#configuration) when you move beyond this smoke test.
 
@@ -167,7 +167,7 @@ Open <http://localhost:8080>. The template [`.env.example`](.env.example) docume
 curl -fsSL https://raw.githubusercontent.com/hrodrig/gghstats/main/scripts/install.sh | sh
 ```
 
-Downloads the latest [release](https://github.com/hrodrig/gghstats/releases) archive for your OS/arch into `/usr/local/bin` (override with `BINDIR=~/bin`). Review [`scripts/install.sh`](scripts/install.sh) before piping to `sh`; pin with `VERSION=v0.7.9`.
+Downloads the latest [release](https://github.com/hrodrig/gghstats/releases) archive for your OS/arch into `/usr/local/bin` (override with `BINDIR=~/bin`). Review [`scripts/install.sh`](scripts/install.sh) before piping to `sh`; pin with `VERSION=v0.7.10`.
 
 **From source (recommended for developers):**
 
@@ -182,15 +182,15 @@ This installs the binary to `$GOBIN` (default `$HOME/go/bin`). Ensure `$GOBIN` i
 | Platform | Command / path |
 |----------|----------------|
 | **Homebrew (macOS / Linux)** | `brew install hrodrig/gghstats/gghstats` — [tap](https://github.com/hrodrig/homebrew-gghstats) |
-| **Debian / Ubuntu** | `wget -q -O /tmp/gghstats.deb https://github.com/hrodrig/gghstats/releases/download/v0.7.9/gghstats_0.7.9_linux_amd64.deb && sudo dpkg -i /tmp/gghstats.deb` |
-| **Fedora / RHEL / AlmaLinux / Rocky / Oracle Linux** | `sudo dnf install https://github.com/hrodrig/gghstats/releases/download/v0.7.9/gghstats_0.7.9_linux_amd64.rpm` |
+| **Debian / Ubuntu** | `wget -q -O /tmp/gghstats.deb https://github.com/hrodrig/gghstats/releases/download/v0.7.10/gghstats_0.7.10_linux_amd64.deb && sudo dpkg -i /tmp/gghstats.deb` |
+| **Fedora / RHEL / AlmaLinux / Rocky / Oracle Linux** | `sudo dnf install https://github.com/hrodrig/gghstats/releases/download/v0.7.10/gghstats_0.7.10_linux_amd64.rpm` |
 | **Linux tarball** | `tar -xzf gghstats_*_linux_*.tar.gz` from [Releases](https://github.com/hrodrig/gghstats/releases); verify `checksums.txt` |
 | **FreeBSD** | `gghstats_*_freebsd_*.tar.gz` on [Releases](https://github.com/hrodrig/gghstats/releases); port + developer guide [`contrib/freebsd/README.md`](contrib/freebsd/README.md) (`gmake` in repo, `make` in ports tree) |
 | **OpenBSD** | `gghstats_*_openbsd_*.tar.gz` on [Releases](https://github.com/hrodrig/gghstats/releases); [`contrib/openbsd/README.md`](contrib/openbsd/README.md) and port [`contrib/openbsd/port/`](contrib/openbsd/port/) |
 | **macOS / Windows archives** | `.tar.gz` / `.zip` on [Releases](https://github.com/hrodrig/gghstats/releases) |
-| **OCI image** | `ghcr.io/hrodrig/gghstats:v0.7.9` or `:latest` (multi-arch) |
+| **OCI image** | `ghcr.io/hrodrig/gghstats:v0.7.10` or `:latest` (multi-arch) |
 
-Replace `v0.7.9` and `amd64` with your [release](https://github.com/hrodrig/gghstats/releases) version and architecture (e.g. `arm64`).
+Replace `v0.7.10` and `amd64` with your [release](https://github.com/hrodrig/gghstats/releases) version and architecture (e.g. `arm64`).
 
 After install, validate the UI locally:
 
@@ -415,6 +415,8 @@ gghstats supports optional IP-based access control via `GGHSTATS_WHITELIST`. Whe
 
 By default the whitelist applies to **all routes** except `/metrics`, `/api/v1/healthz`, and **`/api/v1/badge/*`** (README embeds). Scope it to specific paths with `GGHSTATS_WHITELIST_PATHS` (comma-separated prefixes, e.g. `/api/,/h2h`). Paths not listed remain publicly accessible. Badge URLs stay public even when `/api/` is whitelisted.
 
+When **`GGHSTATS_API_TOKEN`** is set, requests that include a matching **`x-api-token`** header bypass the IP whitelist on protected paths (the token is still validated by the API handler). This lets remote operators run **`POST /api/v1/sync`** from the dashboard without opening `/api/` to the whole internet.
+
 ```bash
 # Internal network + VPN only
 GGHSTATS_WHITELIST=10.0.0.0/8,172.16.0.0/12,192.168.1.0/24

VERSION

@@ -1 +1 @@
-0.7.9
+0.7.10

cmd/gghstats/serve.go

@@ -132,7 +132,7 @@ func runServe(args []string) error {
 		defer rateLimiter.Shutdown()
 	}
 
-	whitelist := server.NewWhitelist(server.ParseWhitelistEnv())
+	whitelist := server.NewWhitelist(server.ParseWhitelistEnv(), cfg.APIToken)
 
 	syncOpts := sync.Options{
 		IncludePrivate: cfg.IncludePrivate,

internal/i18n/locales/de.json

@@ -175,6 +175,10 @@
     "sync_last_repo": "Letzte Synchronisation ({{repo}}): {{when}}",
     "sync_last": "Letzte Synchronisation: {{when}}",
     "sync_failed": "Sync fehlgeschlagen",
+    "sync_start_failed": "Sync konnte nicht gestartet werden",
+    "sync_already_running": "Sync läuft bereits",
+    "sync_ip_not_whitelisted": "Ihre IP ist für die API nicht freigegeben (GGHSTATS_WHITELIST prüfen)",
+    "sync_rate_limited": "Rate-Limit — eine Minute warten und erneut versuchen",
     "sync_done": "Sync abgeschlossen",
     "token_required": "API-Token erforderlich",
     "token_save_sync": "Speichern & synchronisieren"

internal/i18n/locales/en.json

@@ -175,6 +175,10 @@
     "sync_last_repo": "Last sync ({{repo}}): {{when}}",
     "sync_last": "Last sync: {{when}}",
     "sync_failed": "Sync failed",
+    "sync_start_failed": "Could not start sync",
+    "sync_already_running": "Sync already running",
+    "sync_ip_not_whitelisted": "Your IP is not whitelisted for the API (check GGHSTATS_WHITELIST)",
+    "sync_rate_limited": "Rate limited — wait a minute and try again",
     "sync_done": "Sync finished",
     "token_required": "API token required",
     "token_save_sync": "Save & sync"

internal/i18n/locales/es.json

@@ -175,6 +175,10 @@
     "sync_last_repo": "Última sincronización ({{repo}}): {{when}}",
     "sync_last": "Última sincronización: {{when}}",
     "sync_failed": "Error de sincronización",
+    "sync_start_failed": "No se pudo iniciar la sincronización",
+    "sync_already_running": "Sincronización ya en curso",
+    "sync_ip_not_whitelisted": "Tu IP no está en la lista blanca de la API (revisa GGHSTATS_WHITELIST)",
+    "sync_rate_limited": "Límite de peticiones — espera un minuto e inténtalo de nuevo",
     "sync_done": "Sincronización terminada",
     "token_required": "Se requiere token de API",
     "token_save_sync": "Guardar y sincronizar"

internal/i18n/locales/fr.json

@@ -175,6 +175,10 @@
     "sync_last_repo": "Dernière synchronisation ({{repo}}) : {{when}}",
     "sync_last": "Dernière synchronisation : {{when}}",
     "sync_failed": "Échec de la synchronisation",
+    "sync_start_failed": "Impossible de démarrer la synchronisation",
+    "sync_already_running": "Synchronisation déjà en cours",
+    "sync_ip_not_whitelisted": "Votre IP n'est pas autorisée pour l'API (vérifiez GGHSTATS_WHITELIST)",
+    "sync_rate_limited": "Limite de débit — attendez une minute et réessayez",
     "sync_done": "Synchronisation terminée",
     "token_required": "Jeton API requis",
     "token_save_sync": "Enregistrer et synchroniser"

internal/i18n/locales/pt-br.json

@@ -175,6 +175,10 @@
     "sync_last_repo": "Última sincronização ({{repo}}): {{when}}",
     "sync_last": "Última sincronização: {{when}}",
     "sync_failed": "Falha na sincronização",
+    "sync_start_failed": "Não foi possível iniciar a sincronização",
+    "sync_already_running": "Sincronização já em andamento",
+    "sync_ip_not_whitelisted": "Seu IP não está na lista branca da API (verifique GGHSTATS_WHITELIST)",
+    "sync_rate_limited": "Limite de requisições — aguarde um minuto e tente novamente",
     "sync_done": "Sincronização concluída",
     "token_required": "Token da API é obrigatório",
     "token_save_sync": "Salvar e sincronizar"

internal/server/locale.go

@@ -122,6 +122,10 @@ func jsI18nPayload(bundle *i18n.Bundle, locale string) map[string]string {
 		"js.sync_last_repo",
 		"js.sync_last",
 		"js.sync_failed",
+		"js.sync_start_failed",
+		"js.sync_already_running",
+		"js.sync_ip_not_whitelisted",
+		"js.sync_rate_limited",
 		"js.sync_done",
 		"js.token_required",
 		"js.token_save_sync",