Brandon Schneider 7f64942fd2 chore(infra): add internal routing smoke-test script ... scripts/verify-internal.sh runs the exact verification sequence before the edge is touched. Checks (in order): 0. Port listeners — host Caddy owns :80, Traefik NodePort on :30080 1. GET / — 200 Homer or 302 → auth.researchstack.info (not internal IP) 2. /api/* bypass — none of /api/*/health may 302 to Authentik 3. auth.researchstack.info — 200/302 from Authentik, no internal-IP loop 4. Host header passthrough — Traefik :30080 /ping reachable; /api/jobs/health routes end-to-end through host Caddy → Traefik → Ingress 5. X-Forwarded-Proto — https header survives the server-Caddy hop Usage: # on nixos-laptop directly: bash 4-Infrastructure/k3s-flake/scripts/verify-internal.sh # from any tailnet node: bash 4-Infrastructure/k3s-flake/scripts/verify-internal.sh --remote Exit 0 = safe to deploy edge. Exit 1 = fix red checks first. Generated with Devin (https://cli.devin.ai/docs) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>		2026-05-26 21:08:58 -05:00
..
deploy-services.sh	feat(k3s-server): Traefik NodePort + host Caddy pass-through (internal-only)	2026-05-26 21:03:54 -05:00
join-agent.sh	WIP: accumulated changes	2026-05-25 16:24:21 -05:00
verify-internal.sh	chore(infra): add internal routing smoke-test script	2026-05-26 21:08:58 -05:00