fix(modules): align dashboard smoke with tailnet exposure #256

Merged

pdurlej merged 1 commit from codex/cutover/dashboard-health-smoke-contract into main

2026-05-13 08:10:38 +02:00

codex commented

2026-05-13 07:57:02 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Dashboard auto-apply smoke now reaches plan/apply and validates the manifest/container. The remaining failure is a stale HTTP health contract: https://pdurlej.com/health is not a valid Homepage health endpoint for the deploy runner path. This PR aligns the manifest with the actual runtime exposure and health signal.

What changed

Changes dashboard user-facing outcome from public homepage to Tailnet-allowlisted homepage.
Changes exposure metadata from public/none to tailnet-only/tailscale with ts-allowlist@file and security-headers@file.
Removes the invalid /health HTTP smoke URL and records compose health as the intended health source.
Updates acceptance criteria to match the container healthcheck and running container evidence.

Why it changed

Run #612 / API run #748 showed:

auto-apply scope eligible
plan/apply no-op succeeded
strict-v2 manifest OK
container home-platform-dashboard-1 running
smoke failed only on health-http:FAIL-403-vs-expected-200

Homepage already has a container healthcheck for http://127.0.0.1:3000/; /health is not the right manifest contract here.

Files touched

modules/dashboard/module.yaml

Relevant context

Issue #142 cutover lane
PR #255 dashboard strict-v2 manifest fix
compose/apps/compose.yaml dashboard labels: com.home.exposure: tailnet, ts-allowlist@file
Run #612 / API run #748 evidence artifact

Runtime evidence

RS2000 docker exec home-platform-dashboard-1 wget -qSO- http://127.0.0.1:3000/ returned HTTP 200.
RS2000 external curl to https://pdurlej.com/health returned 403 in smoke context.
Local Mac curl to https://pdurlej.com/health returned 404, confirming /health is not a stable Homepage health endpoint.

Known constraints

This PR changes manifest truth only; it does not change Traefik, compose, or runtime routing.
risk.internet_exposed remains true because the route is internet-facing with access control. exposure.classification now captures the Tailnet allowlist behavior.

Explicit out-of-scope

No production mutation.
No workflow change.
No runner change.
No stateful service apply.

Requested decision

Merge this manifest contract correction, then Codex will sync /opt/pdurlej-platform/current and rerun dashboard workflow_dispatch.

Merge blockers

Evidence shows dashboard should actually be public unauthenticated.
Removing health.http would hide a real required external health check.

Spec sources read

modules/dashboard/module.yaml — changed manifest.
compose/apps/compose.yaml — dashboard exposure labels and container healthcheck.
tests/smoke.sh — HTTP health behavior for manifest health.http.
Forgejo Actions run #612 / API run #748 artifact evidence — failure cause.
RS2000 read-only docker inspect / docker exec wget evidence — container health source.

Verification

/tmp/platformctl-test-venv/bin/python -m platformctl validate --strict-v2 modules/dashboard/module.yaml
/tmp/platformctl-test-venv/bin/pytest control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_health_phase3.py -q

Result: strict-v2 validation OK; 25 passed.

Refs #142

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Dashboard auto-apply smoke now reaches plan/apply and validates the manifest/container. The remaining failure is a stale HTTP health contract: `https://pdurlej.com/health` is not a valid Homepage health endpoint for the deploy runner path. This PR aligns the manifest with the actual runtime exposure and health signal. ### What changed - Changes `dashboard` user-facing outcome from public homepage to Tailnet-allowlisted homepage. - Changes exposure metadata from `public`/`none` to `tailnet-only`/`tailscale` with `ts-allowlist@file` and `security-headers@file`. - Removes the invalid `/health` HTTP smoke URL and records compose health as the intended health source. - Updates acceptance criteria to match the container healthcheck and running container evidence. ### Why it changed Run #612 / API run #748 showed: - auto-apply scope eligible - plan/apply no-op succeeded - strict-v2 manifest OK - container `home-platform-dashboard-1` running - smoke failed only on `health-http:FAIL-403-vs-expected-200` Homepage already has a container healthcheck for `http://127.0.0.1:3000/`; `/health` is not the right manifest contract here. ### Files touched - `modules/dashboard/module.yaml` ### Relevant context - Issue #142 cutover lane - PR #255 dashboard strict-v2 manifest fix - `compose/apps/compose.yaml` dashboard labels: `com.home.exposure: tailnet`, `ts-allowlist@file` - Run #612 / API run #748 evidence artifact ### Runtime evidence - RS2000 `docker exec home-platform-dashboard-1 wget -qSO- http://127.0.0.1:3000/` returned HTTP 200. - RS2000 external curl to `https://pdurlej.com/health` returned 403 in smoke context. - Local Mac curl to `https://pdurlej.com/health` returned 404, confirming `/health` is not a stable Homepage health endpoint. ### Known constraints - This PR changes manifest truth only; it does not change Traefik, compose, or runtime routing. - `risk.internet_exposed` remains `true` because the route is internet-facing with access control. `exposure.classification` now captures the Tailnet allowlist behavior. ### Explicit out-of-scope - No production mutation. - No workflow change. - No runner change. - No stateful service apply. ### Requested decision Merge this manifest contract correction, then Codex will sync `/opt/pdurlej-platform/current` and rerun dashboard workflow_dispatch. ### Merge blockers - Evidence shows dashboard should actually be public unauthenticated. - Removing `health.http` would hide a real required external health check. ## Spec sources read - `modules/dashboard/module.yaml` — changed manifest. - `compose/apps/compose.yaml` — dashboard exposure labels and container healthcheck. - `tests/smoke.sh` — HTTP health behavior for manifest `health.http`. - Forgejo Actions run #612 / API run #748 artifact evidence — failure cause. - RS2000 read-only `docker inspect` / `docker exec wget` evidence — container health source. ## Verification ```bash /tmp/platformctl-test-venv/bin/python -m platformctl validate --strict-v2 modules/dashboard/module.yaml /tmp/platformctl-test-venv/bin/pytest control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_health_phase3.py -q ``` Result: strict-v2 validation OK; 25 passed. Refs #142

codex added 1 commit

2026-05-13 07:57:02 +02:00

fix(modules): align dashboard smoke with tailnet exposure

canary-required / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

canary-required / canary (pull_request) Successful in 13s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

5478a1a35c