From 7fac97d7a39d5df0c7fc21396e701f6e7fc16d14 Mon Sep 17 00:00:00 2001 From: J1 Admin Date: Sun, 5 Jul 2026 04:51:19 +0000 Subject: [PATCH] security: redact hardcoded Tailscale IPs --- noc-dashboard/backend/app.py | 2 +- scripts/apply-setup.sh | 12 +++--- scripts/setup-wizard.sh | 12 +++--- skills/arah-health-validation/SKILL.md | 51 +++++++++++++++++++++++++ skills/arah-launch/SKILL.md | 52 ++++++++++++++++++++++++++ 5 files changed, 116 insertions(+), 13 deletions(-) create mode 100644 skills/arah-health-validation/SKILL.md create mode 100644 skills/arah-launch/SKILL.md diff --git a/noc-dashboard/backend/app.py b/noc-dashboard/backend/app.py index 145d30f..9e5f092 100644 --- a/noc-dashboard/backend/app.py +++ b/noc-dashboard/backend/app.py @@ -282,7 +282,7 @@ async def apply_setup(request: Request): (REPO_ROOT / "setup-complete.json").write_text(json.dumps(payload, indent=2)) if mode in ("cloudflare", "all") and cf_host and cf_tunnel: - cf_content = f"""tunnel: {cf_tunnel}\ncredentials-file: /home/j1admin/.cloudflared/{cf_tunnel}.json\ningress:\n - hostname: {cf_host}\n path: /honcho/*\n service: http://100.66.142.21:8000\n - hostname: {cf_host}\n path: /qdrant/*\n service: http://100.66.142.21:6333\n - hostname: {cf_host}\n path: /search/*\n service: http://100.66.142.21:8080\n - hostname: {cf_host}\n path: /obsidian/*\n service: http://100.66.142.21:8083\n - hostname: {cf_host}\n path: /costforge/*\n service: http://100.66.142.21:8090\n - hostname: {cf_host}\n path: /noc/*\n service: http://100.66.142.21:9500\n - service: http_status:404\n""" + cf_content = f"""tunnel: {cf_tunnel}\ncredentials-file: /home/j1admin/.cloudflared/{cf_tunnel}.json\ningress:\n - hostname: {cf_host}\n path: /honcho/*\n service: http://:8000\n - hostname: {cf_host}\n path: /qdrant/*\n service: http://:6333\n - hostname: {cf_host}\n path: /search/*\n service: http://:8080\n - hostname: {cf_host}\n path: /obsidian/*\n service: http://:8083\n - hostname: {cf_host}\n path: /costforge/*\n service: http://:8090\n - hostname: {cf_host}\n path: /noc/*\n service: http://:9500\n - service: http_status:404\n""" CF_DIR.mkdir(parents=True, exist_ok=True) (CF_DIR / "config.yml").write_text(cf_content) diff --git a/scripts/apply-setup.sh b/scripts/apply-setup.sh index 8d49ce9..4ef0d6c 100644 --- a/scripts/apply-setup.sh +++ b/scripts/apply-setup.sh @@ -38,22 +38,22 @@ credentials-file: /home/j1admin/.cloudflared/${cf_tunnel}.json ingress: - hostname: ${cf_host} path: /honcho/* - service: http://100.66.142.21:8000 + service: http://:8000 - hostname: ${cf_host} path: /qdrant/* - service: http://100.66.142.21:6333 + service: http://:6333 - hostname: ${cf_host} path: /search/* - service: http://100.66.142.21:8080 + service: http://:8080 - hostname: ${cf_host} path: /obsidian/* - service: http://100.66.142.21:8083 + service: http://:8083 - hostname: ${cf_host} path: /costforge/* - service: http://100.66.142.21:8090 + service: http://:8090 - hostname: ${cf_host} path: /noc/* - service: http://100.66.142.21:9500 + service: http://:9500 - service: http_status:404 EOF echo "Wrote Cloudflare tunnel config to $cf_config" diff --git a/scripts/setup-wizard.sh b/scripts/setup-wizard.sh index 9745d7c..9bd8574 100755 --- a/scripts/setup-wizard.sh +++ b/scripts/setup-wizard.sh @@ -59,22 +59,22 @@ credentials-file: /home/j1admin/.cloudflared/${CF_TUNNEL}.json ingress: - hostname: ${CF_HOSTNAME} path: /honcho/* - service: http://100.66.142.21:8000 + service: http://:8000 - hostname: ${CF_HOSTNAME} path: /qdrant/* - service: http://100.66.142.21:6333 + service: http://:6333 - hostname: ${CF_HOSTNAME} path: /search/* - service: http://100.66.142.21:8080 + service: http://:8080 - hostname: ${CF_HOSTNAME} path: /obsidian/* - service: http://100.66.142.21:8083 + service: http://:8083 - hostname: ${CF_HOSTNAME} path: /costforge/* - service: http://100.66.142.21:8090 + service: http://:8090 - hostname: ${CF_HOSTNAME} path: /noc/* - service: http://100.66.142.21:9500 + service: http://:9500 - service: http_status:404 EOF sudo systemctl enable --now cloudflared || true diff --git a/skills/arah-health-validation/SKILL.md b/skills/arah-health-validation/SKILL.md new file mode 100644 index 0000000..fb2ddca --- /dev/null +++ b/skills/arah-health-validation/SKILL.md @@ -0,0 +1,51 @@ +--- +name: arah-health-validation +description: Validates arah services with health checks. Use after deploy, restart, config change, or tunnel update. Use when verifying mode switches or troubleshooting. +--- + +# arah Health Validation + +## Overview +Every change to arah must be followed by validation. Use `scripts/healthcheck.sh` and curl checks for each service. + +## When to Use +- After `docker compose up -d` +- After `.env` or profile changes +- After tunnel config changes +- When NOC dashboard shows services down + +## Process + +1. **Run the project healthcheck** + ```bash + bash scripts/healthcheck.sh + ``` + +2. **Validate by access mode** + - `local`: + - `curl -sf http://localhost:8000/healthz` (Honcho) + - `curl -sf http://localhost:6333/readyz` (Qdrant) + - `curl -sf http://localhost:8080/search?q=healthcheck&format=json` (SearXNG) + - `curl -sf http://localhost:8083/` (Obsidian) + - `tailscale`: + - `curl -sf http://:/...` + - `cloudflare` / `all`: + - `curl -k https://arah./honcho/healthz` + - `curl -k https://arah./qdrant/readyz` + - verify tunnel: `systemctl status cloudflared` + +3. **NOC dashboard status API** + ```bash + curl -sf http://localhost:9500/api/status | jq '.services' + ``` + +4. **Failure checklist** + - Service image pull failure → disk space / network + - Port conflict → `ss -tlnp | grep ` + - Tunnel 404 → path mismatch in `~/.cloudflared/config.yml` + - DB connection failure → PostgreSQL health / credentials + +## Success Criteria +- `scripts/healthcheck.sh` exits 0 +- All `http` services return `< 500` +- NOC dashboard shows green or graceful warning diff --git a/skills/arah-launch/SKILL.md b/skills/arah-launch/SKILL.md new file mode 100644 index 0000000..5e3461c --- /dev/null +++ b/skills/arah-launch/SKILL.md @@ -0,0 +1,52 @@ +--- +name: arah-launch +description: Launches arah after setup. Use when the stack is configured and ready to start. Use after setup wizard or manual `.env` edits. +--- + +# arah Launch + +## Overview +Bring the stack online in the correct order, verify access from the intended path, and confirm the dashboard is reachable. + +## When to Use +- After applying a profile +- After tunnel DNS changes +- After adding new services +- First deployment to a host + +## Process + +1. **Preflight** + - Confirm `.env` exists and `STACK_MODE` is set + - Confirm Docker is running + - Confirm ports are free: `ss -tlnp | grep -E '8000|6333|8080|8083|8090|9500'` + +2. **Launch** + - Local/tailscale: + ```bash + sudo docker compose up -d + ``` + - Cloudflare/all: + ```bash + sudo systemctl enable --now cloudflared || sudo systemctl restart cloudflared + sudo docker compose up -d + ``` + +3. **Verify access** + - Local: `http://localhost:` + - Tailscale: `http://:` + - Cloudflare: `https://arah./` + +4. **Confirm dashboard** + - Open NOC UI at the appropriate base URL + - Confirm services show green + +## Rollback +```bash +sudo docker compose down +``` + +## Boundaries +- Always run `scripts/healthcheck.sh` after launch +- Ask before publishing tunnel DNS to users +- Never launch with `.env` missing or placeholder values