vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(arbo): disable ENGINE_TOKEN bearer auth on prod (WireGuard = boundary)

Browse Source 
Operator decision 2026-06-13 (relayed by comfy-dev, confirmed in-session):
turn off the prod arbo engine's bearer auth and rely on the WireGuard
perimeter. Reverses ADR-0001's open-auth-hole-closed posture (comfy-dev owns
the ADR update on the vh/arbo side).

The app's protected-gate no-ops only when ENGINE_TOKEN is ABSENT — an empty
string still gates (verified: ENGINE_TOKEN="" -> /workflows 401). So both
inject paths are removed: the compose environment line is commented out and
the .env line deleted on the host. Result: tokenless GET /workflows 200 (was
401), matching the dev engine. Original token preserved in the host's
.env.pre-auth-off.bak for re-enable.

playbooks/arbo-disable-engine-token.yaml captures the reversible procedure.
This commit is contained in:
vh
2026-06-13 14:05:07 -07:00
parent f32c6ddaab
commit db97899037
4 changed files with 88 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/arbo/README.md
+8 -3
View File
@@ -31,9 +31,14 @@ scripts/deploy-stack.sh irv-ml1 arbo # diffs vs live, prompts y/N
Both injected via the on-host **`.env`** (gitignored; never the althing bus),
the standard fleet pattern:
- **`ENGINE_TOKEN`** — auth is **OPEN today**. Mint a real bearer
(`openssl rand -hex 32`), put it in `.env`. Closing this is the one security
fix the move buys us.
- **`ENGINE_TOKEN`** — bearer auth is **intentionally OFF** (operator decision
2026-06-13). Prod is WireGuard-only; the perimeter is the boundary, so the
per-browser token was friction with little added security. The compose
`ENGINE_TOKEN` injection is commented out **and** the `.env` line removed — the
app's protected-gate no-ops only when the var is **absent** (an empty string
still gates). To re-lock: un-comment the compose line, set a bearer in `.env`
(`openssl rand -hex 32`), `compose up -d`. Reverses ADR-0001 (comfy-dev owns
that ADR's update). See `playbooks/arbo-disable-engine-token.yaml`.
- **`GRANITE_KEY`** — the LiteLLM **virtual key scoped to arbo**. The
`arbo-prompt-enhance` vkey (comfy-dev, issued 2026-06-09) was **extended**
to reach **both** `granite-4.1-8b` (prompt-craft / `gen` step) **and**