SyslogSolution/prose-contracts
7
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(dsh-web-auth): Authentik-gated :80 login + non-disruptive token capture #73

Merged
abiba-bot merged 11 commits from fm/dsh-web-auth-restart-20260911 into master 2026-09-11 18:21:04 +00:00
Conversation 0 Commits 11 Files Changed 3
+401 -2
11 Commits
Author SHA1 Message Date
abiba-bot 767bd22d9c no-mistakes(document): Align zulip-health v3.2.0 registry metadata and B4 formatting
PR Pipeline — Authorize → Validate → Review → Merge / auth (pull_request) Successful in 5s
Details
PR Pipeline — Authorize → Validate → Review → Merge / validate (pull_request) Successful in 2s
Details
PR Pipeline — Authorize → Validate → Review → Merge / lint (pull_request) Successful in 7s
Details
PR Pipeline — Authorize → Validate → Review → Merge / ai-review (pull_request) Successful in 4s
Details
PR Pipeline — Authorize → Validate → Review → Merge / gate (pull_request) Successful in 0s
Details
2026-09-11 17:49:25 +00:00
abiba-bot e97145c88f no-mistakes(review): re-sample systemd invocation each pass during token wait 2026-09-11 17:34:53 +00:00
abiba-bot 55f1208eb8 no-mistakes(review): scope dsh token to invocation; log nginx diagnostics 2026-09-11 17:30:33 +00:00
abiba-bot b9adf353ee no-mistakes(review): guard missing include, non-fatal pending reload, chmod stash 2026-09-11 17:24:12 +00:00
abiba-bot aeb66ea22d no-mistakes(review): fix pending-reload path, token modes, restart check 2026-09-11 17:17:26 +00:00
abiba-bot 288f74cf84 no-mistakes(review): reprobe dsh tokens; persist pending nginx reload on failure 2026-09-11 17:12:11 +00:00
abiba-bot c66671dbee no-mistakes(review): simplify dsh token selection and reload state machine 2026-09-11 17:07:00 +00:00
abiba-bot b80d3142aa no-mistakes(review): harden dsh token reload retry, legacy bypass, cookie verification 2026-09-11 16:59:55 +00:00
abiba-bot 266fa1f835 fix(dsh-web-auth): Authentik-gated :80 login + non-disruptive token capture 
Correct the dsh-web authentication fix after parent correction:

- Remove the unauthenticated :8081 endpoint (0.0.0.0 bind with no
  auth_request = full Authentik bypass for the LAN). The script now removes
  /etc/nginx/sites-enabled/dsh.token automatically if it reappears.
- Put the login path inside the Authentik-gated :80 server block as
  location = /dsh-web-login; proxy to dsh-web with Host =
  tankodhs.sysloggh.net so the 30-day cookie is bound to the public
  authority, never to 127.0.0.1:3080.
- Isolate the rotating token in a generated include
  /etc/dsh-web/nginx-login.conf; reload nginx only when it changes.
- Replace the disruptive capture (systemctl stop/start dsh-web) with a
  non-disruptive read of the running service's journal, scoped to the
  current systemd invocation so a restarted process's stale token is never
  reused while the new banner is still pending.
- Keep x-dsh-task-board-proxy-token and Host $ak_origin_host intact in '/'.
- Document the corrected design (B4) in zulip-health.prose.md, v3.2.0.

Live-verified 2026-09-11: no auth bypass (302), :8081 refused (000), a
cookie minted before two dsh-web restarts still returns 200, the refreshed
token mints a fresh cookie, and the systemd ExecStartPost/timer refreshes
the token automatically without touching dsh-web.
 2026-09-11 16:52:45 +00:00
abiba-bot 85ea1f4f3d no-mistakes(review): harden dsh token capture: loopback bind, atomic nginx config 2026-09-11 15:22:41 +00:00
abiba-bot b2a259fa23 fix: add dsh-web restart-persistent authentication 
- Add capture-dsh-token.sh script that captures the dsh-web launch token
- Add login endpoint (/dsh-web-login on :8081) that mints 30-day auth cookie
- Document the authentication flow in zulip-health.prose.md (Platform B4)
- Cookie is authority-bound to 127.0.0.1:3080 with 30-day expiry
- After first login, subsequent requests use the cookie — no token required
 2026-09-11 14:56:57 +00:00