cryptolabs-proxy 1.1.7__tar.gz → 1.4.0__tar.gz

{cryptolabs_proxy-1.1.7/src/cryptolabs_proxy.egg-info → cryptolabs_proxy-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cryptolabs-proxy
-Version: 1.1.7
+Version: 1.4.0
 Summary: Unified reverse proxy and fleet management landing page for CryptoLabs products
 Author-email: CryptoLabs <support@cryptolabs.co.za>
 License: MIT
@@ -74,6 +74,15 @@ Unified reverse proxy and fleet management landing page for CryptoLabs products.
 | Grafana | `/grafana/` | Metrics visualization |
 | Prometheus | `/prometheus/` | Metrics collection (with auth) |
 
+### CryptoLabs' own public sites
+
+This product is the fleet proxy for customer datacenters. It does **not** route
+CryptoLabs' own public sites under `cryptolabs.co.za`. Those are served by the
+common proxy owned by `cryptolabs-ai-platform`
+([services/nginx-configs](https://github.com/cryptolabsza/cryptolabs-ai-platform/tree/dev/services/nginx-configs),
+deployed by its Synchronized Platform Deployment).
+Add or change public-site routing there, not here.
+
 ## Quick Start
 
 The easiest way to deploy is through **DC Overview** or **IPMI Monitor** quickstart, which automatically sets up cryptolabs-proxy:
@@ -154,6 +163,68 @@ Config files are stored in `/etc/cryptolabs-proxy/`:
 └── ssl/                # SSL certificates
 ```
 
+The image ships a bootstrap Nginx configuration. Service lifecycle commands
+regenerate the configuration above and require it to be mounted at
+`/etc/nginx/nginx.conf` in the running proxy container. This is how optional
+Vast Price Manager routing is enabled and removed; the CLI refuses to claim a
+route change when the container is still using the bundled configuration.
+The bootstrap configuration intentionally contains no Vast Price Manager route.
+Before an installer enables or disables VPM, it must first create the registry
+configuration, render `/etc/cryptolabs-proxy/nginx.conf`, bind-mount that file
+as `/etc/nginx/nginx.conf`, and verify the proxy is using it. The subsequent
+`cryptolabs-proxy register` or `unregister` command then validates and reloads
+that mounted configuration atomically with the registry update.
+
+### Existing custom proxy configuration
+
+Do not use the generic CLI alone to migrate a proxy that already runs a custom
+unmounted `nginx.conf`: it regenerates the full configuration. Use the reviewed
+`scripts/vpm-custom-config-migrate.py` helper first. Its read-only `plan` mode
+derives a migration ID from the source container and config hash. Its explicit
+`apply` stores root-only backups, mounts a byte-preserved custom baseline with
+only the canonical managed blocks added, and can perform a proxy-only
+`rollback`. Custom-config mode then permits only normal VPM
+`register`/`unregister`; it rejects changes to every other service. Its managed
+Fleet auth deny block remains installed in every HTTP server block after VPM is unregistered, so the
+always-running internal VPM session and reauthentication endpoints cannot fall
+through a preserved public <code>/auth/</code> route. Rollback restores the
+original stored baseline exactly.
+
+Supported DC monitoring adoption uses the private durable
+[controller adoption guard](docs/controller-adoption-guard.md), including normal
+updater and proxy-adoption exclusion during crash recovery.
+
+### Vast Price Manager Fleet sign-in
+
+### Vast Price Manager prerequisite
+
+Before a new Vast Price Manager route can be added, the local Vast.ai exporter
+must be running and report at least one connected account. Complete setup at
+`/vastai/`. Existing VPM installations remain available for maintenance if the
+exporter later loses connectivity; they are never automatically disabled.
+
+The proxy checks the exporter from inside its container using its internal
+management token, which must be provisioned by the exporter setup. It records
+only whether setup is ready and the count of connected accounts; API keys,
+account names, balances, and tokens are not returned.
+
+When Vast Price Manager runs in Fleet mode, it uses the existing Fleet
+`fleet_session` cookie and does not create a second VPM account or login. VPM
+introspects the current Fleet session on the Docker network at
+`http://cryptolabs-proxy:8081/auth/vast-price-manager/session`; the public
+Nginx configuration explicitly returns `404` for that endpoint and its
+reauthentication companion, including their trailing-slash variants.
+
+The internal session response is limited to the current enabled Fleet admin's
+username, role, and two purpose-separated HMAC values derived from the signed
+cookie: a subject and a CSRF token. It never returns the cookie, password,
+password hash, or signing key. The proxy rereads the user record for every
+session, reauthentication, and VPM proxy authorization check, so a disabled,
+deleted, demoted, or password-change-required account loses VPM access
+immediately. Sensitive VPM confirmation calls
+`POST /auth/vast-price-manager/reauth` internally with the Fleet password and
+the returned CSRF token; it uses the normal Fleet password throttle.
+
 User authentication data is stored in `/data/auth/`:
 
 ```
@@ -320,3 +391,28 @@ MIT License - See [LICENSE](LICENSE) for details.
 
 - [CryptoLabs](https://cryptolabs.co.za)
 - [Documentation](https://cryptolabs.co.za/dc-monitoring/)
+
+## NetBox environment link
+
+NetBox starts in **Available Products** on the Fleet dashboard. An administrator
+can select **Set up NetBox**, enter that site's environment URL, and select
+**Save NetBox**. The card then moves to **Services**, where **Open NetBox** opens
+the saved environment in a new tab. NetBox keeps its own login and permissions.
+
+Use **Configure** to edit the destination. **Remove NetBox**, or saving an empty
+URL, returns the card to Available Products. Each installation keeps its own
+link in the existing persistent Fleet authentication data volume. Ordinary
+Fleet users can open the link; only administrators can change it.
+
+URLs must be absolute HTTP or HTTPS links without embedded credentials. Use
+HTTPS for NetBox Cloud. The card indicates a configured external service; it
+does not poll NetBox or claim that the environment is healthy.
+
+For API configuration, authenticate to Fleet and fetch `/auth/api/netbox`.
+Administrators receive a session-bound `csrf_token` with the public link
+metadata. POST JSON containing `netbox_url` to `/auth/api/settings`, with that
+token in the `X-CSRF-Token` header. An empty string clears the link; omitting
+the field preserves it. Invalid URLs or failed saves preserve existing settings.
+
+SSO is a separate integration. A NetBox environment link does not establish
+NetBox authentication or grant inventory permissions.

{cryptolabs_proxy-1.1.7 → cryptolabs_proxy-1.4.0}/README.md

@@ -46,6 +46,15 @@ Unified reverse proxy and fleet management landing page for CryptoLabs products.
 | Grafana | `/grafana/` | Metrics visualization |
 | Prometheus | `/prometheus/` | Metrics collection (with auth) |
 
+### CryptoLabs' own public sites
+
+This product is the fleet proxy for customer datacenters. It does **not** route
+CryptoLabs' own public sites under `cryptolabs.co.za`. Those are served by the
+common proxy owned by `cryptolabs-ai-platform`
+([services/nginx-configs](https://github.com/cryptolabsza/cryptolabs-ai-platform/tree/dev/services/nginx-configs),
+deployed by its Synchronized Platform Deployment).
+Add or change public-site routing there, not here.
+
 ## Quick Start
 
 The easiest way to deploy is through **DC Overview** or **IPMI Monitor** quickstart, which automatically sets up cryptolabs-proxy:
@@ -126,6 +135,68 @@ Config files are stored in `/etc/cryptolabs-proxy/`:
 └── ssl/                # SSL certificates
 ```
 
+The image ships a bootstrap Nginx configuration. Service lifecycle commands
+regenerate the configuration above and require it to be mounted at
+`/etc/nginx/nginx.conf` in the running proxy container. This is how optional
+Vast Price Manager routing is enabled and removed; the CLI refuses to claim a
+route change when the container is still using the bundled configuration.
+The bootstrap configuration intentionally contains no Vast Price Manager route.
+Before an installer enables or disables VPM, it must first create the registry
+configuration, render `/etc/cryptolabs-proxy/nginx.conf`, bind-mount that file
+as `/etc/nginx/nginx.conf`, and verify the proxy is using it. The subsequent
+`cryptolabs-proxy register` or `unregister` command then validates and reloads
+that mounted configuration atomically with the registry update.
+
+### Existing custom proxy configuration
+
+Do not use the generic CLI alone to migrate a proxy that already runs a custom
+unmounted `nginx.conf`: it regenerates the full configuration. Use the reviewed
+`scripts/vpm-custom-config-migrate.py` helper first. Its read-only `plan` mode
+derives a migration ID from the source container and config hash. Its explicit
+`apply` stores root-only backups, mounts a byte-preserved custom baseline with
+only the canonical managed blocks added, and can perform a proxy-only
+`rollback`. Custom-config mode then permits only normal VPM
+`register`/`unregister`; it rejects changes to every other service. Its managed
+Fleet auth deny block remains installed in every HTTP server block after VPM is unregistered, so the
+always-running internal VPM session and reauthentication endpoints cannot fall
+through a preserved public <code>/auth/</code> route. Rollback restores the
+original stored baseline exactly.
+
+Supported DC monitoring adoption uses the private durable
+[controller adoption guard](docs/controller-adoption-guard.md), including normal
+updater and proxy-adoption exclusion during crash recovery.
+
+### Vast Price Manager Fleet sign-in
+
+### Vast Price Manager prerequisite
+
+Before a new Vast Price Manager route can be added, the local Vast.ai exporter
+must be running and report at least one connected account. Complete setup at
+`/vastai/`. Existing VPM installations remain available for maintenance if the
+exporter later loses connectivity; they are never automatically disabled.
+
+The proxy checks the exporter from inside its container using its internal
+management token, which must be provisioned by the exporter setup. It records
+only whether setup is ready and the count of connected accounts; API keys,
+account names, balances, and tokens are not returned.
+
+When Vast Price Manager runs in Fleet mode, it uses the existing Fleet
+`fleet_session` cookie and does not create a second VPM account or login. VPM
+introspects the current Fleet session on the Docker network at
+`http://cryptolabs-proxy:8081/auth/vast-price-manager/session`; the public
+Nginx configuration explicitly returns `404` for that endpoint and its
+reauthentication companion, including their trailing-slash variants.
+
+The internal session response is limited to the current enabled Fleet admin's
+username, role, and two purpose-separated HMAC values derived from the signed
+cookie: a subject and a CSRF token. It never returns the cookie, password,
+password hash, or signing key. The proxy rereads the user record for every
+session, reauthentication, and VPM proxy authorization check, so a disabled,
+deleted, demoted, or password-change-required account loses VPM access
+immediately. Sensitive VPM confirmation calls
+`POST /auth/vast-price-manager/reauth` internally with the Fleet password and
+the returned CSRF token; it uses the normal Fleet password throttle.
+
 User authentication data is stored in `/data/auth/`:
 
 ```
@@ -292,3 +363,28 @@ MIT License - See [LICENSE](LICENSE) for details.
 
 - [CryptoLabs](https://cryptolabs.co.za)
 - [Documentation](https://cryptolabs.co.za/dc-monitoring/)
+
+## NetBox environment link
+
+NetBox starts in **Available Products** on the Fleet dashboard. An administrator
+can select **Set up NetBox**, enter that site's environment URL, and select
+**Save NetBox**. The card then moves to **Services**, where **Open NetBox** opens
+the saved environment in a new tab. NetBox keeps its own login and permissions.
+
+Use **Configure** to edit the destination. **Remove NetBox**, or saving an empty
+URL, returns the card to Available Products. Each installation keeps its own
+link in the existing persistent Fleet authentication data volume. Ordinary
+Fleet users can open the link; only administrators can change it.
+
+URLs must be absolute HTTP or HTTPS links without embedded credentials. Use
+HTTPS for NetBox Cloud. The card indicates a configured external service; it
+does not poll NetBox or claim that the environment is healthy.
+
+For API configuration, authenticate to Fleet and fetch `/auth/api/netbox`.
+Administrators receive a session-bound `csrf_token` with the public link
+metadata. POST JSON containing `netbox_url` to `/auth/api/settings`, with that
+token in the `X-CSRF-Token` header. An empty string clears the link; omitting
+the field preserves it. Invalid URLs or failed saves preserve existing settings.
+
+SSO is a separate integration. A NetBox environment link does not establish
+NetBox authentication or grant inventory permissions.

{cryptolabs_proxy-1.1.7 → cryptolabs_proxy-1.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cryptolabs-proxy"
-version = "1.1.7"
+version = "1.4.0"
 description = "Unified reverse proxy and fleet management landing page for CryptoLabs products"
 readme = "README.md"
 license = {text = "MIT"}

{cryptolabs_proxy-1.1.7 → cryptolabs_proxy-1.4.0}/src/cryptolabs_proxy/__init__.py

@@ -1,6 +1,6 @@
 """CryptoLabs Proxy - Unified reverse proxy for CryptoLabs products."""
 
-__version__ = "1.1.7"
+__version__ = "1.4.0"
 
 # Export programmatic setup API
 from .setup import (