vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(svos-front): kernel seat-host calls allowed on the terminal origin (app-terminal base_url reverted to it)

Browse Source
This commit is contained in:
vh
2026-10-12 09:44:06 -07:00
parent ca9e385316
commit 82987828f8
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/svos-front/Caddyfile
+10 -1
View File
@@ -168,7 +168,7 @@ https://svos-terminal.phasefinal.com:443 {
# The kernel's signed calls come from the box itself (its source on the mesh address); anything else is refused. # The kernel's signed calls come from the box itself (its source on the mesh address); anything else is refused.
@not_from_box { @not_from_box {
path /verbs/* /health path /verbs/* /health /seats/*
not remote_ip 100.64.0.9 10.100.50.43 127.0.0.1 not remote_ip 100.64.0.9 10.100.50.43 127.0.0.1
} }
handle @not_from_box { handle @not_from_box {
@@ -211,6 +211,15 @@ https://svos-terminal.phasefinal.com:443 {
handle @health { handle @health {
import svos_terminal_upstream import svos_terminal_upstream
} }
# U13 fix (2026-10-12): app-terminal's registry base_url is this origin again (browsers frame panes from it),
# so the kernel's signed seat-host calls (U5b) come through here too, from the box only (@not_from_box above).
@seat_host {
method POST
path /seats/observe /seats/check /seats/launch /seats/retire-launch
}
handle @seat_host {
import svos_terminal_upstream
}
handle { handle {
respond 404 respond 404
} }