v0.322.0 released: REPORT, CONTEXT, README (R-970 routes removed)
gates / gates (push) Successful in 52s
gates / gates (push) Successful in 52s
This commit is contained in:
+12
-32
@@ -3185,17 +3185,12 @@ volumes:
|
||||
|
||||
| Method | Path | Auth | Description |
|
||||
|--------|------|------|-------------|
|
||||
| GET | `/api/selfupdate/status` | Session or API key | Current status (cached, no network call) |
|
||||
| POST | `/api/selfupdate/check` | Session or API key | Force registry check, return result |
|
||||
| POST | `/api/selfupdate/update` | Session or API key | Trigger update (async, returns immediately) |
|
||||
| GET | `/api/selfupdate/status` | Session | Current status (cached, no network call) |
|
||||
| POST | `/api/selfupdate/check` | Session | Force registry check, return result |
|
||||
| POST | `/api/selfupdate/update` | Session | Trigger update (async, returns immediately) |
|
||||
|
||||
Self-update endpoints accept either session auth (for UI) or hub API key as bearer token (for external triggering from build scripts or hub). This enables the post-v0.16.0 deploy workflow:
|
||||
|
||||
```bash
|
||||
# After building + pushing new image:
|
||||
curl -s -X POST https://felhom.demo-felhom.eu/api/selfupdate/update \
|
||||
-H "Authorization: Bearer <HUB_API_KEY>"
|
||||
```
|
||||
Self-update endpoints take a logged-in session only. **v0.322.0 (R-970):** the hub API key no longer opens them (it did
|
||||
from v0.16.0 for a build-script trigger nobody used); boxes move by the hub's floor. Pinned by `TestR970_HubKeyOpensNoDoor`.
|
||||
|
||||
##### Settings Page UI
|
||||
|
||||
@@ -3319,7 +3314,7 @@ Synchronizer-token CSRF protection on all browser-facing state-mutating endpoint
|
||||
- Logs: `[WARN] CSRF rejected: METHOD /path from addr (reason)`
|
||||
|
||||
**Exempt paths (no CSRF check):**
|
||||
- Requests with `Authorization: Bearer ...` header — hub→controller API calls (selfupdate, config/apply). Browsers cannot auto-send Bearer headers, so cross-site requests are impossible on these endpoints.
|
||||
- *(Removed v0.322.0, R-970: the `Authorization: Bearer` exemption. No route takes the hub key, so such a request needs the session's token like any other — `TestR970_HubKeyIsNoCSRFExemption`.)*
|
||||
- Auth-disabled mode (`authEnabled() == false`) — CSRF is meaningless when there is no session.
|
||||
|
||||
**Token delivery to templates:**
|
||||
@@ -3471,12 +3466,10 @@ Bearer token authentication, 3-attempt retry with 5-second backoff. Push status
|
||||
|
||||
**Direction 2 — hub→box wait channel (v0.140.0):** the reverse immediacy path, so an OPERATOR action on the hub reaches the box in seconds. `report.Waiter` (`internal/report/waiter.go`) holds a hanging authenticated `GET {hub}/api/v1/wait?gen=N` (same hub URL + key as the pusher; no new config keys) against hub ≥ v0.58.0's in-memory operator-intent generation counter. The hub completes the hold the instant any operator intent bumps that customer's generation (config save/delete, claim resend, offsite re-issue/freeze, floor, block/unblock, log-pull); on a generation **change** the Waiter fires the same Direction-1 `report.Trigger` — and nothing else, so the immediate report's ACK delivers everything through the unchanged config-refresh/escrow/claim/floor machinery (the box pulls even the wake-up; the hub never connects inbound). Its `http.Client` has **no overall timeout** (a held GET must stay open for the hub's ~240 s hold, which streams a 25 s heartbeat newline to defeat the nginx 60 s read-timeout — no ingress change needed); a per-request context bounds a dead connection. First-observation records-not-fires (no restart echo); a same-generation timeout fires nothing; any error (transport, a 404 from a pre-v0.58.0 hub, malformed body) backs off 5 s→5 min and the 15-min cycle keeps reconciling. Constructed beside the trigger under the same `hubPusher != nil && cfg.Hub.Enabled` gate. Grounding: `felhom.eu/documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md`.
|
||||
|
||||
#### Config apply + self-restart (`internal/api/router.go`, `internal/api/selfrestart.go`)
|
||||
#### Self-restart (`internal/api/selfrestart.go`)
|
||||
|
||||
`POST /api/config/apply` (Hub-authed) writes a new `controller.yaml`, but the new config only takes effect on **restart** — singletons such as the Cloudflare client are built once at startup (so a rotated CF API token would otherwise keep failing). Behaviour (v0.70.0):
|
||||
|
||||
- **No-op guard:** if the pushed body is byte-identical to the current file, do nothing — no rewrite, no restart (the Hub may re-push idempotently; never flap on a no-op).
|
||||
- Otherwise: write `0600`, respond `200` (flushed), then **gracefully self-restart** — `gracefulSelfRestart` waits ~500 ms for the response to flush, then `os.Exit(0)`. The container runs `restart: unless-stopped`, so Docker brings it back with the fresh config, and a startup report is pushed. The exit sits behind an injectable seam (`Router.restart` / `SetRestarter`) for unit testing.
|
||||
*(The hub-authed `POST /api/config/apply` that wrote `controller.yaml` and restarted is removed in v0.322.0, R-970 —
|
||||
no caller existed. Settings reach the box only through the hub report's ACK.)*
|
||||
|
||||
**Manual restart (v0.70.0):** `POST /api/selfrestart` (session auth + CSRF via the `/api/` mount) runs the same helper — surfaced as the **"Vezérlő újraindítása"** button on the settings page (confirm → POST → poll `GET /` every 2 s → reload), so a customer can recover the controller without rebooting the whole guest.
|
||||
|
||||
@@ -3796,7 +3789,7 @@ Thread-safe access via `GetGeoRestriction()`, `SetGeoRestriction()`, `SetGeoAppO
|
||||
| POST | `/api/stacks/{name}/geo/override` | Set per-app country override |
|
||||
| DELETE | `/api/stacks/{name}/geo/override` | Remove per-app override |
|
||||
|
||||
All mutating endpoints trigger an async Cloudflare sync. The `/api/geo/` path accepts both session auth and Hub Bearer token auth (via `selfUpdateAuthMiddleware`), enabling Hub-side geo-disable for lockout recovery.
|
||||
All mutating endpoints trigger an async Cloudflare sync. The `/api/geo/` path takes a session only (v0.322.0, R-970: the hub key no longer opens it; the hub's geo switch goes to Cloudflare directly).
|
||||
|
||||
#### Sync Triggers
|
||||
|
||||
@@ -4575,22 +4568,9 @@ All daily jobs use Europe/Budapest timezone. Skip-if-running prevents concurrent
|
||||
| POST | `/api/selfupdate/check` | Force registry check |
|
||||
| POST | `/api/selfupdate/update` | Trigger self-update (async) |
|
||||
|
||||
Self-update endpoints accept session auth OR `Authorization: Bearer <hub_api_key>` for external triggering.
|
||||
Self-update endpoints take a session only (v0.322.0, R-970).
|
||||
|
||||
### Config Management
|
||||
|
||||
| Method | Endpoint | Description |
|
||||
|--------|----------|-------------|
|
||||
| POST | `/api/config/apply` | Apply new controller.yaml from Hub (atomic write) |
|
||||
| GET | `/api/config/hash` | Get SHA256 hash of current controller.yaml |
|
||||
| GET | `/api/config` | Get raw controller.yaml content (text/yaml) for live diff and pull |
|
||||
|
||||
Config endpoints accept session auth OR `Authorization: Bearer <hub_api_key>` (same as self-update). The `/api/config/apply` endpoint:
|
||||
- Accepts raw YAML body (the generated config from Hub)
|
||||
- Validates YAML is parseable before writing
|
||||
- Atomic write: writes to `.tmp` then `os.Rename` for crash safety
|
||||
- Does NOT reload config — restart required to apply changes
|
||||
- Returns `{"ok": true, "message": "Config applied. Restart controller to apply changes."}`
|
||||
*(Config Management — `/api/config`, `/api/config/apply`, `/api/config/hash` — removed in v0.322.0, R-970.)*
|
||||
|
||||
### Metrics
|
||||
|
||||
|
||||
Reference in New Issue
Block a user