vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

ops(svos): U13 phase B amendment — full kernel-origin path list, Miranda's env and origin on nh3-dev, enrollment secrets, app-high-seat declared

Browse Source 
Per svoperatingsystem dc241f8 u13-svos-edit.md items 1, 4, 5 and 6 (Prime's
go stands): the kernel origin passes exactly the method-pinned list (apps and
Miranda's agent connector; 15 pairs reach the kernel, the rest are Caddy 404);
nh3-dev's apps env is rebuilt as dc241f8 with svos-miranda 0.0.3 and
svos-agent 0.0.3 and gains the svos-miranda origin (nh3-svos only); three
enrollment secrets minted into the vault; app-high-seat declared with one
reload. Also fixes nh3-dev's fleet Caddy sharing admin localhost:2019 with
ttyd-caddy via SO_REUSEPORT (reloads could land on either): now :2021.
This commit is contained in:
vh
2026-10-10 16:56:47 -07:00
parent feef8330ca
commit fa567fa150
5 changed files with 86 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/svos-front/Caddyfile
+36 -5
View File
@@ -221,9 +221,12 @@ https://svos-terminal.phasefinal.com:443 {
# a request there is never a human and loopback trust never applies, so every call authenticates with its own bearer.
# NO Basic auth, and Authorization passes through untouched.
# - Source allowlisted to nh3-dev (10.100.10.50); anything else gets 403 from Caddy.
# - Paths: svos-dev's app surface (/auth/enroll, /auth/proofs, /registry/*, /verbs/*, /seats/enroll) plus
# /auth/kernel-key, which every svos_connector client fetches to trust the kernel's signatures (client.kernel_key; it
# is also the joint runbook's B2 check: refused by the KERNEL with 401 without a credential). Anything else 404.
# - Paths, method-pinned, exactly svoperatingsystem docs/operations/u13-svos-edit.md item 1 at dc241f8 (every caller on
# nh3-dev, read at source): the apps (bridge, terminal, app-miranda, app-high-seat) GET /auth/kernel-key, POST
# /auth/enroll, POST /auth/proofs, POST /registry/apps/*/manifest, /verbs/*, POST /seats/enroll; Miranda's agent
# connector GET /auth/whoami, /registry/apps, /registry/apps/*, /principals/*/grants, /seats, /events,
# /artifacts/resolve (and /verbs/*). Anything else 404. B2's check: GET /auth/kernel-key without a credential is a
# 401 from the KERNEL, not from Caddy.
# - Client identity/forwarding headers are deleted as on the other sites; the same 1 MiB body cap; nothing streams.
https://svos-kernel.phasefinal.com:443 {
bind 10.100.50.43
@@ -247,8 +250,36 @@ https://svos-kernel.phasefinal.com:443 {
handle @not_nh3_dev {
respond 403
}
@app_surface path /auth/enroll /auth/proofs /auth/kernel-key /registry/* /verbs/* /seats/enroll
handle @app_surface {
@app_get {
method GET
path /auth/kernel-key /auth/whoami /registry/apps /registry/apps/* /seats /events /artifacts/resolve
}
handle @app_get {
reverse_proxy 127.0.0.1:8410
}
@app_grants {
method GET
path_regexp ^/principals/[^/]+/grants$
}
handle @app_grants {
reverse_proxy 127.0.0.1:8410
}
@app_post {
method POST
path /auth/enroll /auth/proofs /seats/enroll
}
handle @app_post {
reverse_proxy 127.0.0.1:8410
}
@app_manifest {
method POST
path_regexp ^/registry/apps/[^/]+/manifest$
}
handle @app_manifest {
reverse_proxy 127.0.0.1:8410
}
@app_verbs path /verbs/*
handle @app_verbs {
reverse_proxy 127.0.0.1:8410
}
handle {