vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(nh3-svos): SVOS front door uses HTTP Basic auth (login Vuong); WhoIs gate retired

Browse Source 
Prime's ruling: basic auth saved in the browser, mesh-only access. basic_auth argon2id with the account hash in a root:caddy file outside git (plaintext vaulted). After auth, Tailscale-User-Login is set from the authenticated user and Authorization is deleted, since the kernel's human path refuses requests that carry it. Removed svos-whois-auth (every mesh node is login pfi). Verified from a mesh peer against a temporary header echo: 401 without/with wrong credentials, 200 with exactly one Tailscale-User-Login: Vuong and no forged or Authorization headers upstream.
This commit is contained in:
vh
2026-10-05 19:47:19 -07:00
parent 454b689a54
commit c523806566
6 changed files with 37 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/svos-front/caddy-svos.service
+2 -2
View File
@@ -1,7 +1,7 @@
[Unit]
Description=SVOS front door (Caddy, tailnet-only, svos.phasefinal.com) - eshpfi configs/svos-front
After=network-online.target tailscaled.service svos-whois-auth.service
Wants=network-online.target tailscaled.service svos-whois-auth.service
After=network-online.target tailscaled.service
Wants=network-online.target tailscaled.service
[Service]
User=caddy