Erich Blume
702592bcc9
PR review caught that we didn't need an admin login surface on WAN.
App v1.0.1 adds DJANGO_PUBLIC_URL_BASE so QR codes generated from
/host/ (now tailnet-only) still point at shower.eblu.me for guest
phones — that closes the loop and lets us strip the WAN admin surface
entirely.
Container:
- bump version to 1.0.1
- outputHash → fakeHash (build will print the real one)
- entrypoint still does migrate + collectstatic before gunicorn —
the app is small enough that auto-migration is fine
Manifests:
- configmap adds DJANGO_PUBLIC_URL_BASE=https://shower.eblu.me
Fly nginx (shower.eblu.me):
- drop the /admin/(login|logout) carveout
- 403 anything under /admin/ AND /host/ with a "tailnet only" pointer
- drop the shower_auth limit_req zone and \$shower_banned geo
- drop the shower-admin-login fail2ban filter + jail
- drop the shower-deny.conf touch from start.sh
Docs:
- rename how-to docs/how-to/operations/shower-app.md →
shower-on-ringtail.md (mirrors cv-on-indri / docs-on-indri)
- new reference card docs/reference/services/shower-app.md per PR
review comment 2 (≈30s read; quick facts + cross-links)
- rewrite Defense layers section: collapses to general rate limit +
django-axes on the tailnet-side login (the only credential surface)
- rewrite the .infra.md changelog fragment to match
- add a 'Create the admin user' step (kubectl exec createsuperuser)
so first-time deploys aren't locked out
The nginx-deny action's per-jail \`nginx_deny_file\` generalization
stays — harmless future-proofing for the next public service.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
16 lines
735 B
YAML
16 lines
735 B
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: shower-app-config
|
|
namespace: shower
|
|
data:
|
|
DJANGO_DEBUG: "0"
|
|
# /host/, /admin/, and Django's login surface are all tailnet-only — the
|
|
# public proxy 403s everything outside of `/` and `/prizes/<token>/`.
|
|
# /host/'s "Django admin" link follows DJANGO_ADMIN_URL.
|
|
DJANGO_ADMIN_URL: "https://shower.ops.eblu.me/admin/"
|
|
# /host/ is served on shower.ops.eblu.me (tailnet), but the QR codes it
|
|
# generates need to point at the public WAN hostname so guest phones can
|
|
# reach them. PUBLIC_URL_BASE overrides Django's request.build_absolute_uri()
|
|
# in the QR views — see shower/views.py:_public_url. Added in app v1.0.1.
|
|
DJANGO_PUBLIC_URL_BASE: "https://shower.eblu.me"
|