vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

ops(svos): U13 phase B amendment — full kernel-origin path list, Miranda's env and origin on nh3-dev, enrollment secrets, app-high-seat declared

Browse Source 
Per svoperatingsystem dc241f8 u13-svos-edit.md items 1, 4, 5 and 6 (Prime's
go stands): the kernel origin passes exactly the method-pinned list (apps and
Miranda's agent connector; 15 pairs reach the kernel, the rest are Caddy 404);
nh3-dev's apps env is rebuilt as dc241f8 with svos-miranda 0.0.3 and
svos-agent 0.0.3 and gains the svos-miranda origin (nh3-svos only); three
enrollment secrets minted into the vault; app-high-seat declared with one
reload. Also fixes nh3-dev's fleet Caddy sharing admin localhost:2019 with
ttyd-caddy via SO_REUSEPORT (reloads could land on either): now :2021.
This commit is contained in:
vh
2026-10-10 16:56:47 -07:00
parent feef8330ca
commit fa567fa150
5 changed files with 86 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/fleet-tls-caddy/Caddyfile
+16
View File
@@ -1,5 +1,9 @@
{
email lkraven@lkraven.com
# Own admin port (2026-10-10). ttyd-caddy (stock caddy, ~/.config/caddy) also binds localhost:2019 and both sockets
# use SO_REUSEPORT, so a `reload` on 2019 landed on EITHER instance: this config was rejected by the stock binary
# (no cloudflare module), and ttyd's valid config could have replaced this one. ExecReload reads this address.
admin localhost:2021
}
# Fleet internal TLS — caddy is the WILDCARD CERT AUTHORITY for *.nh3.phasefinal.com
@@ -39,6 +43,18 @@
}
}
}
# - svos-miranda: app-miranda (svos-miranda 0.0.3, 127.0.0.1:8408), beside the Hermes gateway it calls on loopback;
# added 2026-10-10 per svoperatingsystem dc241f8 u13-svos-edit.md item 4. Not started before the edit.
@svos_miranda host svos-miranda.nh3.phasefinal.com
handle @svos_miranda {
@not_nh3_svos not remote_ip 10.100.50.43
handle @not_nh3_svos {
respond 403
}
handle {
reverse_proxy 127.0.0.1:8408
}
}
@svos_highseat host svos-highseat.nh3.phasefinal.com
handle @svos_highseat {
@not_nh3_svos not remote_ip 10.100.50.43