chore(tools): the live tools take their target, they do not assume it

The dashboard's fifth guard learned to see a host name and found three in
tools/live: a default host in lib.ts and two health checks written out.
A measuring tool that aims at somebody else's server by default is a trap,
so FILIUS_HOST has no fallback and the run says what to set; the two checks
use BASE, which is derived from it.

BASE had to be imported in m3.ts — without that this would have been a
NameError instead of the intended refusal.

README.md keeps the real names: the project is this school's and the prose
describes its deployment; what has to stand on its own is the code.

The allow file also excuses the simulator's own data. Filius simulates a
network, so its scenarios, tests and documentation carry 65 693 addresses
(measured) — all of invented machines in invented networks, which is the
point of the program. Deliberately broad: a list of scenario files would be
one nobody keeps correct.

typecheck green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/internal_addresses_allow.txt

@@ -0,0 +1,33 @@
+# Where an address or a host name of the school stands on purpose in this
+# submodule. Applies **on top of** the dashboard's own list — the checker
+# reads both (INTERNAL_ADDRESSES_ROOT points it here).
+#
+#     <path>::<rule>          # why
+#     host:<name>::<rule>     # why, for a host that is excused everywhere
+#
+# Why each rule exists:
+#     INTERNAL_ADDRESSES_ROOT=$PWD python3 ../scripts/check_no_internal_addresses.py --rules
+
+# ── Documentation stays specific to this school ─────────────────────
+# Decided on 13.11.2026: the project *is* this school's, and the prose
+# describes its deployment. What has to stand on its own in a dev container
+# is the **code** — not the text about it. So the README keeps the real
+# names while the configuration and the tools no longer carry any.
+README.md::school-hostname
+
+# ── This program's subject *is* networks ────────────────────────────
+# Filius simulates a network, so every scenario, every test and every piece
+# of documentation is full of addresses — 65 693 of them, measured on
+# 13.11.2026. None belongs to a school: they are the addresses of invented
+# machines in invented networks, which is the point of the program. The same
+# reason the dashboard excuses `modules/dnsfilter`, where the feature itself
+# is about ranges.
+#
+# This is deliberately broad. A narrower list would have to name every
+# scenario file, and a new scenario would then have to remember this file —
+# which is how an allow list becomes a list nobody keeps correct.
+packages::internal-address
+tools::internal-address
+corpus::internal-address
+CHANGES.md::internal-address
+README.md::internal-address

tools/live/lib.ts

@@ -17,7 +17,11 @@ const env = Object.fromEntries(
     .filter((l) => l.includes('='))
     .map((l) => [l.slice(0, l.indexOf('=')).trim(), l.slice(l.indexOf('=') + 1).trim()]),
 );
-export const HOST = process.env.FILIUS_HOST ?? 'test-filius.hub.mdg-hamburg.de';
+// No deployment's host as a fallback: this repository is handed out, and
+// a measuring tool that aims at somebody else's server by default is a
+// trap. Unset, the run says what to set.
+export const HOST = process.env.FILIUS_HOST ?? '';
+if (!HOST) throw new Error('set FILIUS_HOST to the instance to measure');
 export const BASE = `https://${HOST}`;
 const SECRET = env.FILIUS_TICKET_SECRET!;
 const KEY = env.FILIUS_SERVICE_KEY!;

tools/live/m3.ts

@@ -9,7 +9,7 @@
 //
 //   npx vite-node tools/live/m3.ts [steps, e.g. 1,10,25,50] [seconds per step]
 
-import { cleanUp, openRoom, seededProject, signIn, svc, type Room } from './lib.js';
+import { BASE, cleanUp, openRoom, seededProject, signIn, svc, type Room } from './lib.js';
 
 const EXAMPLE = 'java-examples/Internet_Komplett_mit_eMail_Webserver_Intranet_Portforwarding_Firewall_DHCP_DE.fls';
 const steps = (process.argv[2] ?? '1,10,25,50,100,150,200').split(',').map(Number);
@@ -75,7 +75,7 @@ try {
     await new Promise((resolve) => setTimeout(resolve, seconds * 1000));
     lost += [...pending.values()].filter((sent) => performance.now() - sent > 5_000).length;
     const sorted = [...samples].sort((a, b) => a - b);
-    const health = await (await fetch('https://test-filius.hub.mdg-hamburg.de/healthz')).json();
+    const health = await (await fetch(`${BASE}/healthz`)).json();
     console.log(
       [rooms.length, sorted.length, quantile(sorted, 0.5), quantile(sorted, 0.95), quantile(sorted, 0.99), sorted.at(-1) ?? NaN]
         .map((value, index) => (index < 2 ? String(value) : value.toFixed(0)).padStart(index === 0 ? 5 : 7))
@@ -88,6 +88,6 @@ try {
     room.close();
   }
   await cleanUp();
-  const health = await (await fetch('https://test-filius.hub.mdg-hamburg.de/healthz')).json();
+  const health = await (await fetch(`${BASE}/healthz`)).json();
   console.log('after clean-up:', JSON.stringify(health), (await svc('GET', '/svc/sessions')).status);
 }