@mriekki/project-forge 4.19.1 → 4.20.0

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.19.1",
+  "version": "4.20.0",
   "defaultProfile": "greenfield-project",
   "profiles": {
     "greenfield-project": {
@@ -21,7 +21,7 @@
       "canonicalDescriptor": "distributions/greenfield-workspace.json"
     },
     "deployment": {
-      "revision": "4ce2c2f76556c85a5bc4836a10e197cad425688d",
+      "revision": "977ada7310f649adea34059381339012a0c0daaf",
       "distribution": "greenfield-project",
       "descriptor": "assets/deployment/distribution.json",
       "sourceRoot": "assets/generated/deployment",

package/assets/generated/ASSEMBLY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.19.1",
+  "version": "4.20.0",
   "components": {
     "core": {
       "revision": "4c74c1801b82d3aa438447d392024d32ca5697b0",
@@ -361,7 +361,7 @@
       ]
     },
     "deployment": {
-      "revision": "4ce2c2f76556c85a5bc4836a10e197cad425688d",
+      "revision": "977ada7310f649adea34059381339012a0c0daaf",
       "distribution": "greenfield-project",
       "files": [
         {
@@ -437,12 +437,12 @@
         {
           "source": "src/project_forge_deployment/cloudflare_ingress.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress.py",
-          "sha256": "f462bcc1cb9d1fd20a93cf7fa6ea00402df0be69507308ffbd7e2af0d0f2900f"
+          "sha256": "d07c79b7f9f6c9a0f9b417fd0a1d4502101075b128a12d23b2791c31e03d4f01"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_ingress_remote.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress_remote.py",
-          "sha256": "6f92ec8b50baeb6894f096935450f3cf1f86abf5313a681ee3c5bca2283ddc99"
+          "sha256": "73d9f68cbece33155ccac8ce2e24da8f0ec6698a7b66fba18cb9bf38734ea686"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_route_apply.py",
@@ -502,7 +502,7 @@
         {
           "source": "src/project_forge_deployment/ingress_cli.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/ingress_cli.py",
-          "sha256": "59ff40843573da74dc430b517130f300b3eb2f2e4f00de0eb6dab5f9efb27692"
+          "sha256": "973b89daa7e57d925f0be56fbfc0dc4c6f79ab082036c7fb26462691f2f16d02"
         },
         {
           "source": "src/project_forge_deployment/keys.py",
@@ -647,7 +647,7 @@
         {
           "source": "docs/CLOUDFLARE_INGRESS.md",
           "destination": "docs/project-forge/CLOUDFLARE_INGRESS.md",
-          "sha256": "603cf5e732439efdb4f628a16555eba1226db9ef0a665872fd0341c85f9050ee"
+          "sha256": "b47bfb1ef1dcd7be3c501b88add0dea675907ce3f9e65cf7852c5ffddbe0ce46"
         },
         {
           "source": "docs/DEVELOPER_ENVIRONMENTS.md",

package/assets/generated/deployment/docs/CLOUDFLARE_INGRESS.md

@@ -200,6 +200,12 @@ without a zone or public hostname. Once a domain is registered and active in Clo
 
 The shared Cloudflare zone is environment infrastructure and should not be copied into every Project as a credential-like default. The exact application hostname remains Project/environment state.
 
+## Experimental authenticated public-origin mode (new scopes only)
+
+For an isolated test scope, `ingress cloudflare configure` supports `--authenticated-origin`. This explicit opt-in provisions a private Caddy Unix listener and mounts its socket directory only in the pinned cloudflared connector. Public hostname rules use `unix:/run/project-forge-origin/origin.sock` and the public hostname as Host; the LAN TCP listener and the existing default mode remain unchanged. The remote adapter derives each authenticated route's upstream from its still-owned LAN registry entry and strips/replaces forwarding headers before proxying.
+
+**Not a supported Production setting yet:** origin mount possession is not end-user login. Real pinned cloudflared edge-to-app forwarding, canonical client-IP semantics, app proxy-peer trust, socket replacement, and rollback still need live proof. Do not grant the socket mount to unrelated containers or treat forwarded IP headers as an authorization credential. An installed ingress scope cannot switch modes in place; use a new dedicated scope and the normal host/route write gates. See the canonical Kit's `docs/EXPERIMENTAL_AUTHENTICATED_ORIGIN.md` and issue #78 for the detailed evidence boundary.
+
 ## Current cloudflared runtime
 
 The first partial implementation selects Cloudflare release `2026.10.4` and pins the actual Docker pull to the verified multi-platform image index digest:

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress.py

@@ -43,12 +43,12 @@ CLOUDFLARE_API_TOKEN_ENV = "PROJECT_FORGE_CLOUDFLARE_API_TOKEN"
 _SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
 _REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
 _LABEL_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
-_BOOL_STATUS_KEYS = {"markerPresent", "platformReady", "tokenPresent", "containerRunning", "networkAttached"}
+_BOOL_STATUS_KEYS = {"markerPresent", "platformReady", "tokenPresent", "containerRunning", "networkAttached", "authenticatedOrigin"}
 _STATUS_KEYS = {
     "state", "scope", "markerPresent", "markerSchemaVersion", "markerIngressVersion",
     "markerDistribution", "platformReady", "tokenPresent", "containerRunning",
     "networkAttached", "containerName", "cloudflaredImage", "accountId", "zoneId",
-    "zoneName", "tunnelId", "tunnelName",
+    "zoneName", "tunnelId", "tunnelName", "authenticatedOrigin",
 }
 
 
@@ -199,6 +199,7 @@ def _run_remote(
     spec: dict[str, Any] | None = None,
     expected: dict[str, Any] | None = None,
     tunnel_token: str | None = None,
+    authenticated_origin: bool = False,
 ) -> str:
     if action not in {
         "status", "install", "upgrade", "route-inventory",
@@ -212,6 +213,7 @@ def _run_remote(
         args.append(_route_tsv(expected) if expected is not None else "NONE")
     elif action in {"route-remove", "route-remove-locked"}:
         args.append("")
+    args.append("true" if authenticated_origin else "false")
     remote_command = "sudo -n bash -s -- " + " ".join(shlex.quote(item) for item in args)
     completed = subprocess.run(
         ssh_args(profile, address, command=remote_command),
@@ -424,9 +426,12 @@ def plan_cloudflare_ingress(
     zone_name: str,
     api_token: str,
     tunnel_name: str | None = None,
+    authenticated_origin: bool = False,
 ) -> dict[str, Any]:
     """Plan creation/adoption of one shared remotely managed Cloudflare tunnel."""
     scope = _slug(scope, "scope")
+    if type(authenticated_origin) is not bool:
+        raise DeploymentKitError("Authenticated origin must be an explicit boolean opt-in.")
     zone = cloudflare_api.resolve_zone(api_token, zone_name)
     expected_tunnel_name = tunnel_name or tunnel_name_for_scope(scope)
     if not isinstance(expected_tunnel_name, str) or not expected_tunnel_name.strip():
@@ -452,6 +457,8 @@ def plan_cloudflare_ingress(
         tunnel_config = cloudflare_api.get_tunnel_configuration(api_token, zone["accountId"], str(tunnel["id"]))
 
     if host["state"] in {"ready", "upgrade-required"}:
+        if bool(host["authenticatedOrigin"]) != authenticated_origin:
+            raise DeploymentKitError("Origin authentication mode cannot change on an existing scope; use a new isolated scope.")
         expected = {
             "accountId": zone["accountId"],
             "zoneId": zone["zoneId"],
@@ -485,6 +492,7 @@ def plan_cloudflare_ingress(
         "hostState": host["state"],
         "hostStatusSnapshot": _status_snapshot(host),
         "cloudflaredImage": CLOUDFLARED_IMAGE,
+        "authenticatedOrigin": authenticated_origin,
         "requiredAuthorization": HOST_PUBLIC_INGRESS_WRITE_PHRASE,
         "secrets": {
             "apiToken": "workstation-only; not persisted by Deployment Kit",
@@ -506,10 +514,12 @@ def apply_cloudflare_ingress(plan: dict[str, Any], *, api_token: str) -> dict[st
     required = {
         "targetName", "scope", "action", "zone", "tunnelName", "existingTunnel",
         "existingTunnelConfigSha256", "hostState", "hostStatusSnapshot", "cloudflaredImage",
-        "requiredAuthorization", "secrets",
+        "requiredAuthorization", "secrets", "authenticatedOrigin",
     }
     if not isinstance(plan, dict) or set(plan) != required:
         raise DeploymentKitError("Malformed Cloudflare ingress plan.")
+    if type(plan["authenticatedOrigin"]) is not bool:
+        raise DeploymentKitError("Malformed authenticated-origin plan mode.")
     if plan["cloudflaredImage"] != CLOUDFLARED_IMAGE:
         raise DeploymentKitError("Cloudflare ingress plan uses a different cloudflared image; re-plan with the current package.")
 
@@ -561,6 +571,7 @@ def apply_cloudflare_ingress(plan: dict[str, Any], *, api_token: str) -> dict[st
             scope=scope,
             metadata=metadata,
             tunnel_token=token,
+            authenticated_origin=plan["authenticatedOrigin"],
         )
         final = cloudflare_ingress_status(name, scope)
         if final["state"] != "ready":
@@ -659,7 +670,13 @@ def _lan_route(name: str, spec: dict[str, Any]) -> dict[str, Any]:
     return route
 
 
-def _cloudflare_rule(spec: dict[str, Any]) -> dict[str, Any]:
+def _cloudflare_rule(spec: dict[str, Any], *, authenticated_origin: bool = False) -> dict[str, Any]:
+    if authenticated_origin:
+        return {
+            "hostname": spec["publicHostname"],
+            "service": "unix:/run/project-forge-origin/origin.sock",
+            "originRequest": {"httpHostHeader": spec["publicHostname"]},
+        }
     return {
         "hostname": spec["publicHostname"],
         "service": f"http://{CADDY_CONTAINER}:80",
@@ -800,7 +817,7 @@ def plan_public_route(
 
     config = cloudflare_api.get_tunnel_configuration(api_token, host["accountId"], host["tunnelId"])
     rules, final_rule = _split_ingress(config)
-    desired_rule = _cloudflare_rule(spec)
+    desired_rule = _cloudflare_rule(spec, authenticated_origin=host["authenticatedOrigin"])
     conflicting = [item for item in rules if item.get("hostname") == spec["publicHostname"] and item != desired_rule]
     if conflicting:
         raise DeploymentKitError("Cloudflare tunnel already has a conflicting ingress rule for this hostname.")
@@ -984,7 +1001,7 @@ def plan_public_route_removal(
         raise DeploymentKitError("Cloudflare public-route removal ownership does not match.")
     config = cloudflare_api.get_tunnel_configuration(api_token, host["accountId"], host["tunnelId"])
     rules, final_rule = _split_ingress(config)
-    expected_rule = _cloudflare_rule(route)
+    expected_rule = _cloudflare_rule(route, authenticated_origin=host["authenticatedOrigin"])
     matches = [item for item in rules if item == expected_rule]
     if len(matches) != 1:
         raise DeploymentKitError("Cloudflare tunnel does not contain exactly one expected managed rule for this route.")

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress_remote.py

@@ -8,6 +8,7 @@ SCOPE="$2"
 META="${3:-}"
 SPEC="${4:-}"
 EXPECTED="${5:-}"
+AUTHENTICATED_ORIGIN="${6:-false}"
 
 PLATFORM_ROOT="__PLATFORM_ROOT__"
 NETWORK_NAME="__NETWORK_NAME__"
@@ -38,6 +39,10 @@ MARKER="$ROOT/ingress.env"
 TOKEN_FILE="$ROOT/tunnel-token"
 COMPOSE_FILE="$ROOT/compose.yaml"
 ROUTE_ROOT="$ROOT/routes"
+AUTH_ROOT="$PLATFORM_ROOT/proxy/data/authenticated/$SCOPE"
+AUTH_ROUTES="$AUTH_ROOT/routes"
+AUTH_CADDY="$PLATFORM_ROOT/proxy/conf.d/90-project-forge-auth-$SCOPE.caddy"
+AUTH_SOCKET="$AUTH_ROOT/origin.sock"
 CONTAINER="project-forge-cloudflared-$SCOPE"
 LOCK_FILE="/run/lock/project-forge-cloudflare-$SCOPE.lock"
 
@@ -73,7 +78,9 @@ status() {
     network_attached && attached=true || true
     platform_ready && platform=true || true
 
-    local state marker_schema marker_version marker_distribution marker_image runtime_image
+    local state marker_schema marker_version marker_distribution marker_image runtime_image mode
+    mode="$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)"
+    [[ "$mode" == true ]] || mode=false
     marker_schema="$(marker_value SCHEMA_VERSION 2>/dev/null || true)"
     marker_version="$(marker_value INGRESS_VERSION 2>/dev/null || true)"
     marker_distribution="$(marker_value DISTRIBUTION 2>/dev/null || true)"
@@ -90,6 +97,8 @@ status() {
         state="upgrade-required"
     elif [[ "$running" == true && "$runtime_image" != "$CLOUDFLARED_IMAGE" ]]; then
         state="drifted"
+    elif [[ "$mode" == true && ( ! -S "$AUTH_SOCKET" || ! -f "$AUTH_CADDY" ) ]]; then
+        state="drifted"
     elif [[ "$token" == true && "$running" == true && "$attached" == true && -f "$COMPOSE_FILE" && -d "$ROUTE_ROOT" ]]; then
         state="ready"
     else
@@ -113,6 +122,7 @@ status() {
     printf 'zoneName=%s\n' "$(marker_value ZONE_NAME 2>/dev/null || true)"
     printf 'tunnelId=%s\n' "$(marker_value TUNNEL_ID 2>/dev/null || true)"
     printf 'tunnelName=%s\n' "$(marker_value TUNNEL_NAME 2>/dev/null || true)"
+    printf 'authenticatedOrigin=%s\n' "$mode"
 }
 
 parse_meta() {
@@ -136,6 +146,7 @@ ZONE_NAME=$M_ZONE_NAME
 TUNNEL_ID=$M_TUNNEL_ID
 TUNNEL_NAME=$M_TUNNEL_NAME
 CLOUDFLARED_IMAGE=$CLOUDFLARED_IMAGE
+AUTHENTICATED_ORIGIN=$AUTHENTICATED_ORIGIN
 EOF
     chmod 0600 "$tmp"
     mv -f "$tmp" "$MARKER"
@@ -152,6 +163,11 @@ services:
     command: tunnel --no-autoupdate run --token-file /run/secrets/tunnel-token
     volumes:
       - $TOKEN_FILE:/run/secrets/tunnel-token:ro
+EOF
+    if [[ "$AUTHENTICATED_ORIGIN" == true ]]; then
+        printf '      - %s:/run/project-forge-origin:ro\n' "$AUTH_ROOT" >> "$tmp"
+    fi
+    cat >> "$tmp" <<EOF
     networks:
       - $NETWORK_NAME
     logging:
@@ -169,6 +185,112 @@ EOF
     mv -f "$tmp" "$COMPOSE_FILE"
 }
 
+
+setup_authenticated_origin() {
+    [[ "$AUTHENTICATED_ORIGIN" == true ]] || return 0
+    [[ ! -L "$AUTH_ROOT" && ! -L "$AUTH_CADDY" ]] || {
+        echo "Authenticated origin path is a symbolic link." >&2; exit 27;
+    }
+    install -d -m 0700 "$AUTH_ROOT" "$AUTH_ROUTES"
+    chown 65532:65532 "$AUTH_ROOT"
+    chmod 0700 "$AUTH_ROOT"
+    local tmp="$AUTH_CADDY.tmp.$BASHPID"
+    cat > "$tmp" <<EOF
+http://:19078 {
+    bind unix//data/authenticated/$SCOPE/origin.sock|0222
+    import /data/authenticated/$SCOPE/routes/*.caddy
+    respond "Not Found" 404
+}
+EOF
+    chmod 0644 "$tmp"
+    mv -f "$tmp" "$AUTH_CADDY"
+    docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null
+    [[ -S "$AUTH_SOCKET" ]] || {
+        echo "Authenticated private origin socket did not appear." >&2; exit 27;
+    }
+}
+
+# Public-only Caddy handler: the LAN listener never receives this virtual host.
+# All routing metadata comes from the existing, owned LAN route on this host.
+auth_route_path() { printf '%s/%s.caddy' "$AUTH_ROUTES" "$1"; }
+auth_route_verify_lan() {
+    local lan="$PLATFORM_ROOT/routes/$R_ROUTE.route" hosts
+    [[ -f "$lan" && ! -L "$lan" ]] || { echo "Owned LAN route missing." >&2; exit 35; }
+    [[ "$(route_value "$lan" OWNER_REPO)" == "$R_OWNER" &&
+       "$(route_value "$lan" ENVIRONMENT)" == "$R_ENV" &&
+       "$(route_value "$lan" APP_SLUG)" == "$R_APP" &&
+       "$(route_value "$lan" ROUTE_ID)" == "$R_ROUTE" ]] || {
+        echo "LAN route ownership changed." >&2; exit 35;
+    }
+    hosts="$(route_value "$lan" HOSTNAMES)"
+    [[ ",$hosts," == *",$R_ORIGIN,"* ]] || {
+        echo "LAN origin hostname is no longer owned." >&2; exit 35;
+    }
+    AUTH_UPSTREAM="$(route_value "$lan" UPSTREAM_CONTAINER)"
+    AUTH_PORT="$(route_value "$lan" UPSTREAM_PORT)"
+    [[ "$AUTH_UPSTREAM" =~ ^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$ &&
+       "$AUTH_PORT" =~ ^[0-9]+$ ]] || {
+        echo "LAN upstream is malformed." >&2; exit 35;
+    }
+    (( 10#$AUTH_PORT >= 1 && 10#$AUTH_PORT <= 65535 )) || {
+        echo "LAN port out of range." >&2; exit 35;
+    }
+}
+auth_route_write() {
+    [[ "$(marker_value AUTHENTICATED_ORIGIN)" == true ]] || return 0
+    auth_route_verify_lan
+    local file tmp backup
+    file="$(auth_route_path "$R_ROUTE")"
+    [[ ! -L "$file" ]] || { echo "Unsafe authenticated route symlink." >&2; exit 35; }
+    tmp="$file.tmp.$BASHPID"
+    backup="$file.backup.$BASHPID"
+    [[ ! -f "$file" ]] || cp -a "$file" "$backup"
+    cat > "$tmp" <<EOF
+@pf_$R_ROUTE host $R_PUBLIC
+handle @pf_$R_ROUTE {
+    reverse_proxy $AUTH_UPSTREAM:$AUTH_PORT {
+        header_up Host $R_PUBLIC
+        header_up -Forwarded
+        header_up -X-Forwarded-*
+        header_up -X-Real-IP
+        header_up -True-Client-IP
+        header_up -CF-Visitor
+        header_up -CF-Connecting-IP
+        header_up X-Forwarded-Proto https
+        header_up X-Forwarded-Host $R_PUBLIC
+        header_up X-Forwarded-For {http.request.header.Cf-Connecting-Ip}
+        header_up X-Real-IP {http.request.header.Cf-Connecting-Ip}
+    }
+}
+EOF
+    chmod 0644 "$tmp"
+    mv -f "$tmp" "$file"
+    if ! docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null; then
+        if [[ -f "$backup" ]]; then mv -f "$backup" "$file"; else rm -f "$file"; fi
+        docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null 2>&1 || true
+        echo "Authenticated Caddy route failed validation; restored previous state." >&2
+        exit 35
+    fi
+    rm -f "$backup"
+}
+auth_route_remove() {
+    [[ "$(marker_value AUTHENTICATED_ORIGIN)" == true ]] || return 0
+    local file backup
+    file="$(auth_route_path "$R_ROUTE")"
+    [[ -f "$file" && ! -L "$file" ]] || {
+        echo "Expected authenticated Caddy route is missing." >&2; exit 35;
+    }
+    backup="$file.backup.$BASHPID"
+    mv -f "$file" "$backup"
+    if ! docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null; then
+        mv -f "$backup" "$file"
+        docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null 2>&1 || true
+        echo "Authenticated Caddy removal failed; restored previous route." >&2
+        exit 35
+    fi
+    rm -f "$backup"
+}
+
 write_token() {
     [[ -n "$TOKEN_B64" ]] || { echo "Tunnel token was not supplied." >&2; exit 20; }
     local tmp="$TOKEN_FILE.tmp.$$"
@@ -190,6 +312,9 @@ install_or_upgrade() {
         exit 22
     fi
     install -d -m 0700 "$ROOT" "$ROUTE_ROOT"
+    if [[ "$AUTHENTICATED_ORIGIN" == true ]]; then
+        setup_authenticated_origin
+    fi
     write_token
     write_compose
     write_marker
@@ -289,6 +414,9 @@ PUBLIC_HOSTNAME=$R_PUBLIC
 ORIGIN_HOSTNAME=$R_ORIGIN
 EOF
     chmod 0600 "$tmp"
+    if [[ "$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)" == true ]]; then
+        auth_route_write
+    fi
     mv -f "$tmp" "$path"
 }
 
@@ -298,6 +426,7 @@ route_remove() {
     path="$(route_path "$R_ROUTE")"
     [[ -f "$path" && ! -L "$path" ]] || { echo "Managed public-ingress route does not exist." >&2; exit 34; }
     metadata_matches "$path" "$SPEC" || { echo "Public-ingress route ownership/state mismatch." >&2; exit 34; }
+    auth_route_remove
     rm -f "$path"
 }
 

package/assets/generated/deployment/src/project_forge_deployment/ingress_cli.py

@@ -77,6 +77,7 @@ def build_parser() -> argparse.ArgumentParser:
     configure.add_argument("--scope", required=True)
     configure.add_argument("--zone", required=True, help="Existing active Cloudflare zone, for example example.com")
     configure.add_argument("--tunnel-name", help="Optional explicit tunnel name; default is project-forge-<scope>")
+    configure.add_argument("--authenticated-origin", action="store_true", help="Experimental: isolate the public connector origin on a private Unix socket; only new scopes")
     configure.add_argument("--json", action="store_true")
     configure.add_argument("--yes", action="store_true")
 
@@ -132,6 +133,7 @@ def main(argv: list[str] | None = None) -> int:
                 zone_name=args.zone,
                 api_token=token,
                 tunnel_name=args.tunnel_name,
+                authenticated_origin=args.authenticated_origin,
             )
             _print(plan, as_json=False)
             _confirm(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.19.1",
+  "version": "4.20.0",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {