dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
de7eca8b6d0ec47ac8b69ad3e0c14cc22250ad4b
oikos/docs/adr/0015-api-bearer-auth-client-server-split.md
dtoro d80a394b7f
Some checks failed
ci / build-test (push) Has been cancelled
Details
ci / docker-build (push) Has been cancelled
Details
docs: fix plan/repo drift, retire dead Goose+Nomos and Caveman tooling 
Documentation and repo-hygiene pass following the client/server split:

Plan drift (audited all other active plans against current code):
- oikos-gaps-and-improvements.md: mark Section C and D.5 resolved (both
  described cmd/hermes, renamed to cmd/nomos with a real LLM loop since);
  refresh ~10 stale file:line citations; fix tool-count (33, not 28).
- liveness-drift-and-ux-cohesion.md: fix stale default-model claim (now
  deepseek-v4-pro since 2026-07-10) and "not yet deployed" status.
- nomos-agent-code-review.md: fix C1's citation (one unauthenticated route
  to nomos now, not two, after the client/server split).
- wails-desktop-app.md: record the production deploy outcome.

Repo structure: added missing directories to README/CONTRIBUTING layout
tables (checks/, tools/, cmd/webhook/, docs/operations/), fixed a broken
link, added ADR 0015 documenting the auth/CORS/client-split model (there
wasn't one despite CONTRIBUTING's own process requiring it), normalized
ADR 0013/0014's format drift, added an Authentication section to
AGENTS.md/CLIENTS.md (every example call was missing the now-required
bearer header).

Retired the Goose+Nomos workstation flow (bootstrap.sh --with-nomos,
tools/setup-nomos-soul.sh, .agents/operations/nomos-agent.md) and the
Caveman auto-install tooling (tools/setup-caveman.sh, tools/caveman/) —
both superseded by the production containerized Nomos agent, which has
never used either. Kept .agents/shared/caveman.md itself (the terse
writing-style convention agents still follow by reading it).

Deleted the orphaned legacy Python oikos/ directory — nothing imports it,
and bin/homelab (the CLI it was kept for) no longer exists in the repo.

Rewrote .agents/operations/agent-enrollment.md (365 -> ~110 lines) and
commands.md to match the current architecture instead of the retired
`homelab` CLI; migrated the still-true networking prerequisites (Netbird,
split-horizon DNS, SSH key distribution) into the knowledge base as a
runbook via upsert_knowledge rather than duplicating them in markdown.
Updated all 10 .agents/skills/ runbooks referencing the dead CLI with
their real MCP tool / REST API equivalents, or flagged them as needing
verification where no equivalent is confirmed yet.

Two real bugs found and fixed, not just docs:
- The tools/setup-*.sh auto-setup glob was tools/*.setup.sh in THREE
  places (tools/post-pull.sh, bootstrap.sh, and internal/httpapi/impl.go's
  GetClientContext handler) since the mechanism's introduction on
  2026-06-02 — never matched any real filename, so no client has ever
  picked up an auto-setup script via git-pull or the context-poller sync.
  Fixed all three; the Go server-side fix is the one that actually matters
  since it's what the current context-poller mechanism depends on.
- bootstrap.sh removed dead vestigial --gitea-token/--gitea-user flags
  (parsed, never consumed) left over from an earlier clone-based model.

Also flagged, not fixed (documented as an open gap in
client-enrollment/SKILL.md): bootstrap.sh tells a freshly-enrolled client
to call POST /api/v1/clients/{slug}/activate to finish enrollment, but
that route doesn't exist in api/openapi.yaml — EnrollClient sets entities
to provisioning and nothing currently transitions them to active.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-12 18:19:41 +02:00

3.7 KiB
Raw Blame History

ADR 0015 — Bearer-token auth for every route + client/server split

Status: accepted (2026-07-12) · Plan: plans/2026-07-12-wails-desktop-app.md, Phase 0

Context

The control-room SPA was embedded in the oikos binary (go:embed, ADR 0001) and served at /ui/*. combinedAuth (internal/httpapi/server.go) opened a dev-open bypass — no credential required at all — whenever OIKOS_ENV=dev and no static token/OIDC issuer was configured. That was true not just in local dev but in the actual mac-mini production deploy: docker-compose.yml's api service hardcoded OIKOS_ENV: dev with no token set, so every route (/api/v1/*, /mcp, and an /agent reverse-proxy mount to nomos that had never been wrapped in combinedAuth at all) was reachable unauthenticated from anywhere on the mesh/LAN. A planned Wails desktop client and any future non-browser client can't rely on same-origin requests or a dev-open bypass; they need the SPA to be a standalone, CORS-capable client that authenticates over HTTP like any other caller.

Decision

  • Delete the SPA embed (web/embed.go, the /ui/* routes). web/ is a standalone static build, deployed separately (make ui / make deploy-ui), served at / by Caddy with SPA fallback.
  • Remove the dev-open bypass entirely. Every route requires a valid static bearer token (OIKOS_API_TOKEN / OIKOS_MCP_BEARER_TOKEN) or an OIDC JWT, with two narrow exceptions: /healthz (liveness) and POST /api/v1/clients/enroll (IP-gated in the handler instead). GET /api/v1/events/stream additionally accepts the token as a ?token= query param, since EventSource can't set custom headers.
  • Add CORS (github.com/go-chi/cors, OIKOS_CORS_ORIGIN, default *) so a cross-origin SPA (Vite dev server, a future Wails webview) can reach the API. No AllowCredentials — auth is a header, not a cookie, so credentialed CORS mode isn't needed and the two don't combine safely with a wildcard origin.
  • Wrap the previously-unauthenticated /agent proxy mount in the same combinedAuth middleware as every other route.
  • cmd/nomos becomes an authenticated client of api: it now sends Authorization: Bearer $OIKOS_MCP_BEARER_TOKEN on its own outbound calls (MCP + the chat-assent approval-decision endpoint), which it never did before — dev-open covered for it until now.
  • The SPA gets a runtime config module (web/src/lib/config.ts) and a first-launch Config.svelte screen: server URL + token, stored in localStorage, injected into every fetch() via a shared fetchWithAuth wrapper. Resolved fresh per request (not cached at module-load time), so the same build works same-origin or cross-origin without a rebuild.

Consequences

  • Closing dev-open was a live security fix, not just future-proofing — verified post-deploy that unauthenticated requests to production now 401.
  • Nomos's own HTTP gateway (cmd/nomos, port 8092) still has no auth of its own — out of scope here, tracked separately (plans/2026-07-11-nomos-agent-code-review.md, finding C1).
  • Production Caddy (dtoro/caddy-conf, not this repo) does not yet expose oikos.hubris.network at all, so the interaction between Authentik forward-auth and bearer-token clients (a non-browser client can't complete a browser SSO redirect) is unresolved — needs an @enroll-style bypass for /api/v1/*//mcp//agent/* before public exposure. This repo's compose/caddy/Caddyfile.oikos (a reference copy, not deployed from here) has the bypass; the real config does not yet.
  • There is one shared bearer secret for all agents/clients, not per-client tokens — acceptable for the current fleet size, revisit if per-client revocation becomes necessary.
Reference in New Issue View Git Blame Copy Permalink