ekklesiaandClaude Opus 5.5
65908ac97c
CI / verify (pull_request) Successful in 51s
CI / infrastructure-smoke (pull_request) Successful in 20s
CI / migration-smoke (pull_request) Successful in 1m49s
CI / image-build (pull_request) Successful in 17s
CI / deploy-smoke (same-origin) (pull_request) Successful in 48s
CI / deploy-smoke (split) (pull_request) Successful in 55s
An installation can now serve the Dashboard and the API on sibling hostnames (dash./api.) beside the default same-origin topology, from one image and with configuration alone. - The Dashboard learns its API origin at run time: the built page carries one empty <meta name="ekklesia-api-origin">, which the API fills with its identity base URL's origin at startup, before computing the page's ETag. The shell accepts only a canonical http(s) origin and otherwise fails closed without making a request. The build-time EKKLESIA_API_BASE_URL is gone from the bundle; the development server injects the same element. - The display host stays on the API's origin, so its device cookies, requests, and offline cache are unchanged. - The API trusts its own origin (trusted origins plus the identity base URL), as Better Auth already does, so the display page's mutations pass the origin check without operators listing it. - Doctor validates EKKLESIA_DASHBOARD_ORIGIN exactly as the API's startup does (it previously skipped it), reports the topology without printing hostnames, and warns when split hostnames are not siblings. - The module UI contract states the CORS header limit (safelisted headers plus Content-Type, safelisted response headers only). - Reference deployment: Caddyfile.split.example (Dashboard hostname serves / and its script; API hostname serves /api/*, /display/*, and the display script; each refuses the other's paths) and EKKLESIA_DASHBOARD_HOSTNAME in the proxy overlay and env examples. - The deploy smoke test runs either topology (CI runs both). The split run installs the module template as a test-only module, checks per-hostname routing and exact CORS, then drives a digest-pinned headless Chromium over the DevTools protocol, with no added dependency: sign-in on the Dashboard hostname, the session cookie host-only on the API hostname, the module UI imported cross-origin and its credentialed request succeeding, the display and its service worker on the API hostname, and sign-out. ADR 0045 is marked Accepted. Co-Authored-By: Claude Opus 5.5 <[email protected]>
35 lines
1.8 KiB
Bash
35 lines
1.8 KiB
Bash
# Non-secret settings for the reference deployment's Compose project. Copy to deploy/.env, which
|
|
# Compose reads automatically from this directory. Nothing here is a secret; secrets live in the
|
|
# per-service files under EKKLESIA_ENV_DIR.
|
|
|
|
# The image to run, by registry, name, and tag (or digest). Required.
|
|
EKKLESIA_IMAGE=
|
|
|
|
# Where the root-owned, mode-600 env files and the TLS directory live on the host.
|
|
EKKLESIA_ENV_DIR=/etc/ekklesia
|
|
EKKLESIA_TLS_DIR=/etc/ekklesia/tls
|
|
|
|
# --- compose.proxy.yaml ---------------------------------------------------------------------------
|
|
# The Ekklesia hostname and the storage hostname (signed object URLs). In the default same-origin
|
|
# topology (Caddyfile.example) EKKLESIA_HOSTNAME serves the Dashboard, the API, and displays.
|
|
EKKLESIA_HOSTNAME=
|
|
EKKLESIA_STORAGE_HOSTNAME=
|
|
# The split topology only (ADR 0045, Caddyfile.split.example): the Dashboard's own hostname, while
|
|
# EKKLESIA_HOSTNAME is the API's and the displays'. Both must share one registrable domain, for
|
|
# example dash.example.org and api.example.org. Leave empty for the same-origin topology.
|
|
EKKLESIA_DASHBOARD_HOSTNAME=
|
|
# Contact address for the ACME account (certificate expiry notices).
|
|
EKKLESIA_ACME_EMAIL=
|
|
# EKKLESIA_CADDYFILE=./Caddyfile
|
|
# EKKLESIA_PUBLISH_ADDRESS=0.0.0.0
|
|
# EKKLESIA_HTTP_PORT=80
|
|
# EKKLESIA_HTTPS_PORT=443
|
|
|
|
# The edge network. Change the subnet only if it collides with one already on the host. Docker
|
|
# assigns dynamic addresses only from EKKLESIA_EDGE_DYNAMIC_RANGE (the lower half); the proxy and
|
|
# the tunnel connector take fixed addresses from the upper half, so nothing else can ever hold them.
|
|
# EKKLESIA_EDGE_SUBNET=10.249.250.0/24
|
|
# EKKLESIA_EDGE_DYNAMIC_RANGE=10.249.250.0/25
|
|
# EKKLESIA_PROXY_ADDRESS=10.249.250.254
|
|
# EKKLESIA_TUNNEL_ADDRESS=10.249.250.253
|