vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(svos-front): kernel app origin admits the seat host's task reports (POST /tasks/start|progress|checking|exit); every task launch had failed start_unreported on a Caddy 404

Browse Source
This commit is contained in:
vh
2026-10-19 01:15:11 -07:00
parent ee6036a172
commit d5e41d8cad
2 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/svos-front/Caddyfile
+5 -2
View File
@@ -238,7 +238,8 @@ https://svos-terminal.phasefinal.com:443 {
# nh3-dev, read at source): the apps (bridge, terminal, app-miranda, app-high-seat) GET /auth/kernel-key, POST
# /auth/enroll, POST /auth/proofs, POST /registry/apps/*/manifest, /verbs/*, POST /seats/enroll; Miranda's agent
# connector GET /auth/whoami, /registry/apps, /registry/apps/*, /principals/*/grants, /seats, /events,
# /artifacts/resolve (and /verbs/*). Anything else 404. B2's check: GET /auth/kernel-key without a credential is a
# /artifacts/resolve (and /verbs/*); app-terminal's task host POST /tasks/start|progress|checking|exit (U15, added
# 2026-10-19). Anything else 404. B2's check: GET /auth/kernel-key without a credential is a
# 401 from the KERNEL, not from Caddy.
# - Client identity/forwarding headers are deleted as on the other sites; the same 1 MiB body cap; nothing streams.
https://svos-kernel.phasefinal.com:443 {
@@ -277,9 +278,11 @@ https://svos-kernel.phasefinal.com:443 {
handle @app_grants {
reverse_proxy 127.0.0.1:8410
}
# 2026-10-19: + the seat host's U15 task reports (apps/terminal svos_terminal/tasks.py -> kernel/app.py). They were
# never added after v0.0.11, so every task launch failed start_unreported (Caddy 404) until now.
@app_post {
method POST
path /auth/enroll /auth/proofs /seats/enroll
path /auth/enroll /auth/proofs /seats/enroll /tasks/start /tasks/progress /tasks/checking /tasks/exit
}
handle @app_post {
reverse_proxy 127.0.0.1:8410
playbooks/svos-front-caddy-task-reports.yaml
+22
View File
@@ -0,0 +1,22 @@
# nh3-svos: the kernel app origin (svos-kernel.phasefinal.com) admits the seat host's U15 task reports, POST
# /tasks/start /tasks/progress /tasks/checking /tasks/exit. Missing since v0.0.11, every task launch failed
# start_unreported: Caddy 404'd the start report, and the helper printed "seat launch failed" (diagnosed 2026-10-19 for
# svos-dev, thread 01M59KF34NBQ9F0XZB2JJRVTJY). Validate before swap; backup Caddyfile.pre-task-reports; reload, not restart.
steps:
- {name: stage the new Caddyfile, upload: {src: configs/svos-front/Caddyfile, dest: /etc/caddy/Caddyfile.new, mode: "0644"}, sudo: true}
- name: Validate, back up, swap, reload
sudo: true
shell: |
set -e
cd /etc/caddy
set -a; . /etc/caddy/env; set +a
/usr/local/bin/caddy validate --config Caddyfile.new --adapter caddyfile 2>&1 | tail -2
cp -p Caddyfile Caddyfile.pre-task-reports
chown --reference=Caddyfile Caddyfile.new; chmod --reference=Caddyfile Caddyfile.new
mv Caddyfile.new Caddyfile
systemctl reload caddy-svos; sleep 2; systemctl is-active caddy-svos
verify:
- name: Front door inventory still current
sudo: true
shell: /usr/local/sbin/svos-front-inventory --check
changed_when: "false"