4 Commits

Include renames

Author	SHA1	Message	Date
Logan CusanoandClaude Opus 5	157be0c049	Serve Firebase's auth handler from our own domain ... Google sign-in fails in production: the popup opens, flashes, closes, and the page shows a generic failure with nothing in the console or the network tab. The app is served from drb.cusano.net while signInWithPopup opens its handler on the project's firebaseapp.com origin. Chrome partitions third-party storage, so the popup cannot read back the state its opener wrote and dies immediately. Visiting the handler directly says so: "missing initial state ... a storage-partitioned browser environment". Nothing about authorised domains or the build was wrong -- the shipped bundle carries the correct apiKey and authDomain, which is exactly what made this look like a code bug. Caddy now proxies /__/auth/* on the bare domain to the Firebase Hosting origin, rewriting Host so Firebase recognises the request. Same-site again, which is Google's documented fix. The vhost becomes a `route` so the handler matches before the catch-all proxy to Next. The upstream host is a jinja default rather than a group_vars entry because group_vars/all.yml is gitignored; override it there if the project ever moves. Two manual steps remain, and all three parts are required or nothing changes: the CI secret FIREBASE_AUTH_DOMAIN must become drb.cusano.net with a frontend rebuild, and drb.cusano.net must be an authorised domain in the Firebase console. This template also needs an ansible run -- CI alone will not deploy it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 21:59:07 -04:00
Logan CusanoandClaude Opus 5	ee633cbe46	Secure the broker for public exposure: TLS and per-node credentials ... Edge nodes are deployed to arbitrary locations by arbitrary people, so the broker has to be reachable from the internet and secured on its own merits rather than by a VPN. Three defects made that impossible. The broker only had a plaintext 1883 listener; every node shared one drb-node password; and the ACL pattern used %c, the client-supplied client id, so any holder of that shared password could set client_id to another node and take over its namespace. The comment claiming this cryptographically prevented cross-node access was wrong and is gone. Authentication now uses mosquitto 2.x's built-in dynamic-security plugin on the stock eclipse-mosquitto image. c2-core administers it over the control topic, creating each node's client on approval with username=<node_id> and password=<its node_keys api_key>, attached to a role whose ACL is nodes/%u/# against the authenticated username. One credential, one revocation point. An HTTP-callback plugin was implemented first and rejected: that project is archived upstream, which is not an acceptable dependency on an internet-facing broker. Because dynsec state is a second source of truth alongside Firestore, approve/reissue/delete now write to the broker first and surface a 502 rather than drifting, and c2-core reconciles every approved node into dynsec on startup. Adds node self-enrollment (POST /nodes/enroll, GET /nodes/{id}/credentials) so a new node can obtain its key over HTTPS without an operator handling secrets by hand. Enrolling an already-approved node_id is refused on the fleet token alone — otherwise a leaked token plus a guessable id would let an attacker steal a live node's key before the real node asked for it. Pickup secrets are stored hashed and returned once, and the endpoint is rate limited per source IP. Infrastructure: an 8883 TLS listener fed by Caddy's certificate via a systemd path unit, a firewall rule for it, and Caddy now 404s /internal/* so the api vhost cannot proxy internal routes. Also fixes CORS, which allowed https://app.<domain> while the frontend is served on the bare domain — every call from the portal would have failed — and widens the vault gitignore to a glob, since ansible-vault leaves backup siblings that the exact-name rule left committable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-16 09:34:44 -04:00
Logan CusanoandClaude Opus 5	1f5f1fede8	Serve the frontend on the bare domain instead of app.<domain> ... Only drb.cusano.net and api.drb.cusano.net have public A records, so the app.<domain> vhost had no cert to present and the bare domain — the record that actually exists — matched no site at all, producing ERR_SSL_PROTOCOL_ERROR in the browser. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-09 22:35:47 -04:00
Logan	33700448bf	add Terraform + Ansible infrastructure for GCP deployment ... Provisions e2-micro VM (us-east1-b, free tier) with static IP, SSH and web firewall rules, Docker + Caddy startup script, and IAM bindings for Firestore and GCS access via ADC. Imports existing drb-calls bucket and c2-server Firestore database into state. Ansible roles handle first-time setup (swap, docker group) and all subsequent deploys via rsync + docker compose, with secrets managed via Ansible Vault. DNS stays on AWS Route 53.	2026-06-22 02:03:36 -04:00