mirror of
https://github.com/zvx-echo6/navi.git
synced 2026-08-26 17:31:37 +00:00
malice
d644741c75
* Add navi-admin service (extraction #7) Net-new fleet admin aggregator on :8427 — no port from recon (recon has no /api/admin route; Phase A §3). Three @require_auth routes: GET /api/admin/fleet fan-out to all 6 navi-* /api/admin/<svc>/info + recon /api/health, merged; never 5xx (failures land in errors[]) GET /api/admin/recon/info recon /api/health wrapped in the info shape GET /api/admin/navi-admin/info self-describe Fan-out forwards the caller's X-Authentik-Username so the @require_auth upstreams accept it; per-service admin endpoints stay localhost-only (this is the single edge-exposed admin surface). Service discovery: hardcoded list in fleet.py (Option B). No secrets, no DB. Deploy artifacts (NOT applied here): navi-admin.env.example, systemd unit, nginx ^~ /api/admin snippet, and deploy/caddy notes for the @authed_api edit (first Caddy change since #2). 12 hermetic tests (fleet happy-path, per-service timeout/500 → errors[], auth-header forwarding, recon-down degraded-not-5xx, self-info no-secrets, auth-required). Full monorepo suite green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * PR #7 review fixes 1. Symmetric degraded-entry handling in fleet.build_fleet — every probed service now appears in `services` with a uniform degraded dict on failure (matches recon's existing pattern), AND in errors[]. Operators see "everything I tried + which broke" consistently. 2. Catch ValueError specifically in _get_json — non-JSON 200 responses now surface as `error: 'invalid JSON'` instead of opaque 'ValueError'. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * PR #7 review fixes (round 2) 1. Unified degraded shape: wrap_recon_health calls _degraded_entry on failure — no more runtime.status vs runtime.recon_status asymmetry. Every probed service has the same shape on failure (runtime.status == 'unreachable'). recon-specific runtime fields (recon_status/recon_uptime/pipeline) remain only on the success path. 2. DRY'd git short-SHA helper into shared/git_sha.py — was duplicated in 7 service app.py files + fleet.recon_git_sha. One implementation, one place to fix when behavior changes. Adds shared/tests (testpaths now includes "shared"). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: zvx-echo6 <mj@k7zvx.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
30 lines
1.6 KiB
Text
30 lines
1.6 KiB
Text
# =============================================================================
|
|
# navi-admin — nginx integration for the navi.echo6.co vhost
|
|
#
|
|
# ONE block. Add INSIDE the existing
|
|
# server { server_name navi.echo6.co; ... }
|
|
# block, BEFORE the existing `location /api/ { ... }` catch-all (which currently
|
|
# sends /api/admin/* to recon:8420 → 404, since recon has no /api/admin route).
|
|
#
|
|
# `^~ /api/admin` (NO trailing slash): the `^~` (extraction-#1 lesson) makes
|
|
# nginx skip regex evaluation; the no-slash prefix catches /api/admin/fleet,
|
|
# /api/admin/recon/info, and /api/admin/navi-admin/info.
|
|
#
|
|
# IMPORTANT — this route is AUTH-GATED, unlike the public navi-* prefixes. It
|
|
# needs the matching Caddy edit (see deploy/caddy/navi-admin.caddy.notes.md):
|
|
# add /api/admin/* to @authed_api so forward_auth runs before this proxy. The
|
|
# X-Authentik-Username header set below is what navi-admin forwards on its
|
|
# localhost fan-out to each per-service @require_auth /api/admin/<svc>/info.
|
|
#
|
|
# The per-service /api/admin/<svc>/info endpoints stay localhost-only — they are
|
|
# NOT exposed here. This single /api/admin front door (the fleet aggregator) is
|
|
# the only edge-reachable admin surface.
|
|
# -----------------------------------------------------------------------------
|
|
location ^~ /api/admin {
|
|
proxy_pass http://127.0.0.1:8427;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Authentik-Username $http_x_authentik_username;
|
|
proxy_read_timeout 15s;
|
|
add_header X-Cache-Status BYPASS;
|
|
}
|