Brandon Schneider
|
aae680ad3c
|
chore(infra): add internal routing smoke-test script
scripts/verify-internal.sh runs the exact verification sequence before
the edge is touched. Checks (in order):
0. Port listeners — host Caddy owns :80, Traefik NodePort on :30080
1. GET / — 200 Homer or 302 → auth.researchstack.info (not internal IP)
2. /api/* bypass — none of /api/*/health may 302 to Authentik
3. auth.researchstack.info — 200/302 from Authentik, no internal-IP loop
4. Host header passthrough — Traefik :30080 /ping reachable; /api/jobs/health
routes end-to-end through host Caddy → Traefik → Ingress
5. X-Forwarded-Proto — https header survives the server-Caddy hop
Usage:
# on nixos-laptop directly:
bash 4-Infrastructure/k3s-flake/scripts/verify-internal.sh
# from any tailnet node:
bash 4-Infrastructure/k3s-flake/scripts/verify-internal.sh --remote
Exit 0 = safe to deploy edge. Exit 1 = fix red checks first.
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
2026-05-26 21:08:58 -05:00 |
|