fix(pangolin): gate converge-created resources with SSO by default (#238) - #239
Merged
Merged
Conversation
) ReconcileResourcesAsync set `ssl` on create but never `sso`, and the integration-API create defaults `sso` to null (OPEN). So a from-scratch converge would create admin UIs with NO auth gate — publicly reachable — contradicting the "gated by Pangolin auth" contract. Set sso explicitly on create: default ON, with a per-resource `sso: false` opt-out for native clients that can't render the SSO interstitial (Plex, audiobookshelf). Also codify the live `power.lab.chrison.dev` resource (PowerOrchestrator dashboard + Wake/Sleep/Arm control API, #191) declaratively so it survives converge; the add-only reconcile skips the already-live one. Extracted the sso decision to ResourceSsoEnabled + a theory test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes the core of #238. Correction to the original issue: the EE /
*.labpublic-ingress model, the rollout fixes, and the wildcard grey-cloud A-record converge are already inmain(#215 / #216 / #219 / #221 / #223) — the "unmerged branches" premise in #238 was stale. What actually remained was a latent security bug plus codifying the one live resource that was created out-of-band.The bug
ReconcileResourcesAsyncsetsslon resource create but never setsso. The Pangolin integration-API create defaultsssotonull(OPEN), so a from-scratchconvergewould create every admin UI with no auth gate — publicly reachable — directly contradicting the "gated by Pangolin auth (badger)" contract in the stack yaml. Confirmed via the code path + thesso:nullobserved whenpower.labwas created by hand through the samePUT /resourcecall.The fix
ssoexplicitly on create: default ON, with a per-resourcesso: falseopt-out for native clients that can't render the SSO interstitial (Plex, audiobookshelf — the case flagged in the media-exposure notes).ResourceSsoEnabled+ a theory test.power.lab.chrison.devresource (PowerOrchestrator dashboard + Wake/Sleep/Arm control API, Demand-driven node power management — auto sleep/wake Proxmox nodes (WoL + presence) #191) into the declarativeresources:so it survives converge. The add-only reconcile skips the already-live one, so no disruption.Testing
dotnet test— 96 passed, incl. the newPangolin_Resource_SsoDefaultsOn_UnlessOptedOuttheory (5 cases).power.lab.chrison.devalready verified end-to-end (valid LE cert + SSO 302).Out of scope (remaining #238 follow-ups)
:443port-forward is still hand-managed — already documented inpangolin.lxc.yamland gated on BL-011: UniFi write path + network shapes #102 (UniFi write path).ssoonto resources created before this fix (none are open today —traefik.labandpower.labare both gated).🤖 Generated with Claude Code