dtoro
f8e03806aa
The SPA-from-binary split (0c0f35a) left `make deploy-ui` pointing at a
deploy path that was never actually wired up: scp to a "mac-mini" SSH
host that doesn't resolve from itself, a /var/www/oikos-ui/ that doesn't
exist, and `systemctl reload caddy` on a box with no Caddy installed at
all (not brew, not a container, nothing on 80/443).
Add a `web` service (compose/web/Dockerfile: node build -> caddy:2-alpine
static + SPA-fallback serving) to docker-compose.yml so the UI deploys
through the same push-to-main -> webhook -> docker compose build/up
pipeline the rest of the stack already uses, instead of a manual
scp/ssh step. Drop the broken `deploy-ui` Makefile target; `make ui`
stays as a local build sanity-check.
Update the reference Caddy config (compose/caddy/Caddyfile.oikos) to
reverse_proxy the new :8091 service instead of reading static files off
local disk, and fill in the <mac-mini-mesh-ip> placeholders with the
actual LAN IP (192.168.178.182 — the LXC and mac-mini subnets are
routed). This file is a reference only; the real caddy-conf repo change
is applied separately after review.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
60 lines
2.6 KiB
Caddyfile
60 lines
2.6 KiB
Caddyfile
# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover, updated for the
|
|
# client/server split (plans/2026-07-12-wails-desktop-app.md, Phase 0).
|
|
# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121). THIS COPY
|
|
# IS A REFERENCE, NOT DEPLOYED FROM HERE — keep it in sync manually.
|
|
#
|
|
# The SPA is no longer embedded in the oikos binary; it's built and served
|
|
# by its own container (compose/web/Dockerfile, docker-compose.yml's `web`
|
|
# service, mac-mini:8091) rather than as static files read off local disk —
|
|
# see that service's comment for why. Every API/MCP/agent route now requires
|
|
# a bearer token in all cases (api's dev-open bypass was removed) —
|
|
# non-browser clients (Wails, curl, a future mobile client) can't complete
|
|
# Authentik's browser-session login, so those routes bypass `import
|
|
# authentik` the same way the enrollment endpoint always has and rely on
|
|
# api's own combinedAuth instead. See the Wails plan's "Plan review"
|
|
# section, gap 1.
|
|
#
|
|
# mac-mini and the LXC subnet are routed, so these target its direct LAN IP
|
|
# rather than the mesh (netbird) hostname.
|
|
|
|
oikos.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
@enroll path /api/v1/clients/enroll
|
|
handle @enroll {
|
|
reverse_proxy 192.168.178.182:8090
|
|
}
|
|
# Bearer-token clients — api's combinedAuth (internal/httpapi/server.go)
|
|
# is the real gate for all three; Authentik would just reject non-browser
|
|
# callers before they ever get there. /agent/* now goes through api's own
|
|
# (auth'd) proxy mount rather than straight to nomos:8092, so it's
|
|
# covered by the same check as /api/v1/* and /mcp.
|
|
@api path /api/v1/* /mcp /agent/*
|
|
handle @api {
|
|
reverse_proxy 192.168.178.182:8090
|
|
}
|
|
# Everything else: the static SPA shell, served by the `web` container.
|
|
# No sensitive data lives here — real enforcement is the bearer-token
|
|
# check above — Authentik is just a first line of defense against
|
|
# anonymous crawlers finding the bundle.
|
|
handle {
|
|
import authentik
|
|
reverse_proxy 192.168.178.182:8091
|
|
}
|
|
}
|
|
|
|
# Oikos MCP endpoint (agents) — bearer token required (api's combinedAuth),
|
|
# no separate gate here.
|
|
mcp.hubris.network {
|
|
reverse_proxy 192.168.178.182:8090
|
|
}
|
|
|
|
# Nomos's own gateway (workstation access) — still has NO auth of its own
|
|
# (C1, plans/2026-07-11-nomos-agent-code-review.md, still open). Anyone who
|
|
# can reach this host can talk to nomos directly, bypassing api entirely.
|
|
# Not fixed by the client/server split — tracked separately.
|
|
nomos.hubris.network {
|
|
reverse_proxy 192.168.178.182:8092
|
|
}
|