Backlog/v12 log input exposure

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

🛑 architecture (gemini-3-flash-lite) — high/critical — please review

Summary: Introduces a new public ingestion endpoint and port mapping in the installer, altering system contracts and network topology.

• high installer/docker/compose.go:451 — Exposing a new port (50052:50052) in the Docker compose installer modifies the networking contract and deployment footprint. Ensure backwards compatibility and proper security documentation.
• high installer/templates/front-end.go:35 — Adding a new public ingestion endpoint (/ingest) via Nginx templates introduces a new API contract surface area. Ensure backwards compatibility and adherence to security standards for API key validation.

🛑 bugs (gemini-3-flash-lite) — high/critical — please review

Summary: Nginx configuration variable scope bug in proxy_pass and inconsistent indentation.

• high installer/templates/front-end.go:40 — Using a variable directly inside proxy_pass ($utmstack_log_input/v1/ingest) in Nginx causes Nginx to attempt DNS resolution using default resolvers, which fails unless a 'resolver' directive is explicitly configured in the server block. To use variables with proxy_pass, a resolver must be defined or an explicit URL should be used.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Exposes an unauthenticated/weakly-authenticated log ingestion endpoint and modifies installer templates/docker configuration.

• medium installer/templates/front-end.go:35 — The /ingest location checks only for the presence of the utm_api_key header ($api_key_header = "") rather than validating its value against a stored or hashed secret, allowing any arbitrary non-empty string to bypass this check. Implement proper token/API key validation.

🔴 go-deps — pending updates

🔍 Discovered 30 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/events:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/rule-flood-guard:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/stats:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/feeds:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/alerts:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/aws:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./backend:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

❌ Please update dependencies before merging.

[AlexSanchez-bit]

the api key validation happends on the log input side, so no nginx validation is need further to api key presence