Усилить безопасность и надёжность выполнения операций

deploy/community/.env.example

@@ -24,6 +24,9 @@ CRANK_RUNTIME_MAX_CONCURRENT_UNARY=64
 CRANK_RUNTIME_MAX_CONCURRENT_WINDOW=16
 CRANK_RUNTIME_MAX_CONCURRENT_SESSIONS=16
 CRANK_RUNTIME_MAX_CONCURRENT_JOBS=16
+CRANK_OUTBOUND_ALLOWED_HOSTS=
+CRANK_OUTBOUND_DENIED_HOSTS=
+CRANK_OUTBOUND_MAX_RESPONSE_BYTES=4194304
 CRANK_CACHE_BACKEND=memory
 CRANK_CACHE_URL=
 CRANK_CACHE_DEFAULT_TTL_MS=

deploy/community/.env.images.example

@@ -16,6 +16,9 @@ CRANK_PUBLISH_BIND=127.0.0.1
 CRANK_ADMIN_BIND=0.0.0.0:3001
 CRANK_MCP_BIND=0.0.0.0:3002
 CRANK_MCP_REFRESH_MS=5000
+CRANK_OUTBOUND_ALLOWED_HOSTS=
+CRANK_OUTBOUND_DENIED_HOSTS=
+CRANK_OUTBOUND_MAX_RESPONSE_BYTES=4194304
 
 CRANK_CACHE_BACKEND=memory
 CRANK_CACHE_URL=

deploy/community/docker-compose.images.yml

@@ -59,6 +59,9 @@ services:
       CRANK_BOOTSTRAP_ADMIN_PASSWORD: ${CRANK_BOOTSTRAP_ADMIN_PASSWORD}
       CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME: ${CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME:-Crank Owner}
       CRANK_DEMO_SEED: ${CRANK_DEMO_SEED:-false}
+      CRANK_OUTBOUND_ALLOWED_HOSTS: ${CRANK_OUTBOUND_ALLOWED_HOSTS:-}
+      CRANK_OUTBOUND_DENIED_HOSTS: ${CRANK_OUTBOUND_DENIED_HOSTS:-}
+      CRANK_OUTBOUND_MAX_RESPONSE_BYTES: ${CRANK_OUTBOUND_MAX_RESPONSE_BYTES:-4194304}
     volumes:
       - artifact_storage:${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}
     ports:
@@ -87,6 +90,9 @@ services:
       CRANK_LOG_LEVEL: ${CRANK_LOG_LEVEL:-info}
       CRANK_MASTER_KEY: ${CRANK_MASTER_KEY}
       CRANK_BASE_URL: ${CRANK_BASE_URL:-http://localhost:3000}
+      CRANK_OUTBOUND_ALLOWED_HOSTS: ${CRANK_OUTBOUND_ALLOWED_HOSTS:-}
+      CRANK_OUTBOUND_DENIED_HOSTS: ${CRANK_OUTBOUND_DENIED_HOSTS:-}
+      CRANK_OUTBOUND_MAX_RESPONSE_BYTES: ${CRANK_OUTBOUND_MAX_RESPONSE_BYTES:-4194304}
     volumes:
       - artifact_storage:${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}
     ports:

deploy/community/docker-compose.yml

@@ -43,6 +43,9 @@ services:
       CRANK_BOOTSTRAP_ADMIN_PASSWORD: ${CRANK_BOOTSTRAP_ADMIN_PASSWORD}
       CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME: ${CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME:-Crank Owner}
       CRANK_DEMO_SEED: ${CRANK_DEMO_SEED:-false}
+      CRANK_OUTBOUND_ALLOWED_HOSTS: ${CRANK_OUTBOUND_ALLOWED_HOSTS:-}
+      CRANK_OUTBOUND_DENIED_HOSTS: ${CRANK_OUTBOUND_DENIED_HOSTS:-}
+      CRANK_OUTBOUND_MAX_RESPONSE_BYTES: ${CRANK_OUTBOUND_MAX_RESPONSE_BYTES:-4194304}
     volumes:
       - artifact_storage:${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}
     ports:
@@ -74,6 +77,9 @@ services:
       CRANK_LOG_LEVEL: ${CRANK_LOG_LEVEL:-info}
       CRANK_MASTER_KEY: ${CRANK_MASTER_KEY}
       CRANK_BASE_URL: ${CRANK_BASE_URL:-http://localhost:3000}
+      CRANK_OUTBOUND_ALLOWED_HOSTS: ${CRANK_OUTBOUND_ALLOWED_HOSTS:-}
+      CRANK_OUTBOUND_DENIED_HOSTS: ${CRANK_OUTBOUND_DENIED_HOSTS:-}
+      CRANK_OUTBOUND_MAX_RESPONSE_BYTES: ${CRANK_OUTBOUND_MAX_RESPONSE_BYTES:-4194304}
     volumes:
       - artifact_storage:${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}
     ports: