vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(nh3-svos): SVOS front door uses HTTP Basic auth (login Vuong); WhoIs gate retired

Browse Source 
Prime's ruling: basic auth saved in the browser, mesh-only access. basic_auth argon2id with the account hash in a root:caddy file outside git (plaintext vaulted). After auth, Tailscale-User-Login is set from the authenticated user and Authorization is deleted, since the kernel's human path refuses requests that carry it. Removed svos-whois-auth (every mesh node is login pfi). Verified from a mesh peer against a temporary header echo: 401 without/with wrong credentials, 200 with exactly one Tailscale-User-Login: Vuong and no forged or Authorization headers upstream.
This commit is contained in:
vh
2026-10-05 19:47:19 -07:00
parent 454b689a54
commit c523806566
6 changed files with 37 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/svos-front/Caddyfile
+11 -8
View File
@@ -1,10 +1,13 @@
# SVOS front door on nh3-svos (eshpfi configs/svos-front/), 2026-10-05. Prime: mesh-only, svos.phasefinal.com.
# - Listens ONLY on the tailnet address (100.64.0.9:443). There is no LAN or internet listener and no :80 redirect server.
# - Cert: Let's Encrypt via Cloudflare DNS-01 with a phasefinal.com-only token (env CF_API_TOKEN, /etc/caddy/env).
# - Identity: every request goes through forward_auth to svos-whois-auth on 127.0.0.1:8405, which resolves the
# SOCKET peer ({http.request.remote.host}:{port}; no trusted_proxies, so never a client header) with tailscaled
# WhoIs and returns Tailscale-User-Login only for allow-listed logins. Fail closed (403) otherwise.
# - Client-supplied identity/forwarding headers are deleted BEFORE auth; the verified login is the only one sent.
# - Identity: HTTP Basic auth (Prime 2026-10-05: "Basic auth is fine, saved in browser is fine"; mesh-only because we
# don't host externally). One account, `Vuong` (Prime is how SVOS addresses him). argon2id hash in
# /etc/caddy/svos-basic-auth.accounts (root:caddy 0640, NOT in git); plaintext vaulted nh3-svos/basic-auth-vuong.
# The WhoIs/forward_auth gate that preceded this was retired the same day (every mesh node is login `pfi`).
# - Client-supplied identity/forwarding headers are deleted BEFORE auth. After auth, Tailscale-User-Login is set to
# the authenticated user ({http.auth.user.id}) and Authorization is deleted: the kernel's human path (INV-U1-06)
# refuses any request that carries an Authorization header, and the app has no business seeing the password.
# reverse_proxy sets X-Forwarded-Proto=https and X-Forwarded-For itself; Host passes through; Origin untouched.
# - App side (svos-dev): kernel 127.0.0.1:8400 (/api/* with the prefix stripped, /api/health is the kernel's),
# connector 127.0.0.1:8403 (/health, /verbs/ping|pins|pin|unpin, /openapi.json), static UI /opt/svos/current/static.
@@ -30,11 +33,11 @@ https://svos.phasefinal.com:443 {
request_header -Forwarded
request_header -X-SVOS-Peer
forward_auth 127.0.0.1:8405 {
uri /auth
header_up X-SVOS-Peer {http.request.remote.host}:{http.request.remote.port}
copy_headers Tailscale-User-Login
basic_auth argon2id SVOS {
import /etc/caddy/svos-basic-auth.accounts
}
request_header Tailscale-User-Login {http.auth.user.id}
request_header -Authorization
handle_path /api/* {
reverse_proxy 127.0.0.1:8400