[Wikid82]

Addresses #1894

What changes

Missing database no longer locks anyone out. When no GeoIP database is available, country access lists are not enforced (an allow-list lets everyone in, a block-list blocks no one). Other protections on the host are unaffected. This replaces the temporary behaviour that refused every address except the admin whitelist.

A red alert in the notification bell reports it until the database is back. It is shown in the app only, cannot be dismissed, clears by itself, links to a troubleshooting page and suggests opening an issue, since the database is normally included. The alerts come from a new GET /notifications/alerts endpoint computed from the last applied proxy config.

A Country database card on the Security page (admins only):

• status, source, build date and size
• Reload, with an inline result
• Replace database (admin only, 32 MiB cap, validated, atomic swap with rollback) and Use the included copy
• an address lookup
• a muted note under a country list when it would not be enforced, or would refuse your current address (POST /access-lists/self-check)

The new upload and remove routes are admin-only, audited, refuse cross-origin browser requests, and never put file paths in error bodies. The bundled copy under /app/geoip is never modified, and backups do not include the data-folder copy.

Reload now applies the proxy config even when the database fails to load, so the proxy, the status and the alert agree.

Translations for the new text are in all 28 locales; the non-English ones are drafts that would benefit from a native-speaker pass.

Validation

• Targeted Playwright (security-tests): 33 passed, run twice on fresh images.
• Full backend and frontend suites pass; patch coverage 100% (983 of 983 lines).
• make lint-backend, frontend lint/type-check/build, lefthook, CodeQL Go/JS and Trivy are clean apart from items already suppressed.
• Docs: new troubleshooting page, access-control, Cerberus, security, features and architecture updates. The strict docs build is left to CI.
• Details in docs/reports/qa_report.md.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1873

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	13
🟢 Low	2
Total	16

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[codecov]

Codecov Report

❌ Patch coverage is 99.54700% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
frontend/src/components/GeoIPLookupForm.tsx	93.54%	0 Missing and 2 partials ⚠️
backend/internal/api/handlers/security_handler.go	92.85%	1 Missing ⚠️
frontend/src/components/NotificationCenter.tsx	96.55%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!