cryptolabs-proxy 1.4.0__tar.gz → 1.5.0__tar.gz

{cryptolabs_proxy-1.4.0/src/cryptolabs_proxy.egg-info → cryptolabs_proxy-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cryptolabs-proxy
-Version: 1.4.0
+Version: 1.5.0
 Summary: Unified reverse proxy and fleet management landing page for CryptoLabs products
 Author-email: CryptoLabs <support@cryptolabs.co.za>
 License: MIT

{cryptolabs_proxy-1.4.0 → cryptolabs_proxy-1.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cryptolabs-proxy"
-version = "1.4.0"
+version = "1.5.0"
 description = "Unified reverse proxy and fleet management landing page for CryptoLabs products"
 readme = "README.md"
 license = {text = "MIT"}

{cryptolabs_proxy-1.4.0 → cryptolabs_proxy-1.5.0}/src/cryptolabs_proxy/__init__.py

@@ -1,6 +1,6 @@
 """CryptoLabs Proxy - Unified reverse proxy for CryptoLabs products."""
 
-__version__ = "1.4.0"
+__version__ = "1.5.0"
 
 # Export programmatic setup API
 from .setup import (

{cryptolabs_proxy-1.4.0 → cryptolabs_proxy-1.5.0}/src/cryptolabs_proxy/config.py

@@ -5,6 +5,7 @@ from pathlib import Path
 from jinja2 import Environment, PackageLoader, select_autoescape
 
 CONFIG_DIR = Path("/etc/cryptolabs-proxy")
+_UNSET = object()
 
 
 def get_jinja_env():
@@ -17,13 +18,19 @@ def get_jinja_env():
     )
 
 
-def generate_nginx_config(config_dir: Path, domain: str, letsencrypt: bool = False, services: dict = None, *, host_forward_groups=None, acme_challenge=None):
+def generate_nginx_config(config_dir: Path, domain: str, letsencrypt: bool = False, services: dict = None, *, host_forward_groups=None, acme_challenge=None, hostname_policy=_UNSET, http_policy=_UNSET):
     """Generate nginx.conf from template."""
     from .services import ServiceRegistry
     if host_forward_groups is None:
         host_forward_groups = ServiceRegistry(config_dir).config.get('host_forward_groups', [])
     if acme_challenge is None:
         acme_challenge = ServiceRegistry(config_dir).config.get('acme_challenge')
+    if hostname_policy is _UNSET:
+        hostname_policy = ServiceRegistry(config_dir).config.get("hostname_policy")
+    hostname_policy = validate_hostname_policy(hostname_policy, domain)
+    if http_policy is _UNSET:
+        http_policy = ServiceRegistry(config_dir).config.get("http_policy")
+    http_policy = validate_http_policy(http_policy, domain, acme_challenge)
     acme_challenge = validate_acme_challenge(acme_challenge)
     host_forward_groups = validate_host_forward_groups(host_forward_groups, domain)
     env = get_jinja_env()
@@ -35,6 +42,8 @@ def generate_nginx_config(config_dir: Path, domain: str, letsencrypt: bool = Fal
         services=services or {},
         host_forward_groups=host_forward_groups,
         acme_challenge=acme_challenge,
+        hostname_policy=hostname_policy,
+        http_policy=http_policy,
     )
     
     (config_dir / "nginx.conf").write_text(content)
@@ -57,7 +66,12 @@ def generate_docker_compose(config_dir: Path, domain: str = None, use_letsencryp
     template = env.get_template("docker-compose.yml.j2")
     from .release_selection import load, targets, SelectionError
     from .services import ServiceRegistry
-    release_selection_dir = release_selection_dir or ServiceRegistry(config_dir).config.get('release_selection_dir')
+    registry = ServiceRegistry(config_dir)
+    if domain is None: domain = registry.config.get('domain')
+    release_selection_dir = release_selection_dir or registry.config.get('release_selection_dir')
+    http_policy = validate_http_policy(registry.config.get('http_policy'), domain, registry.config.get('acme_challenge'))
+    healthcheck = policy_healthcheck(registry.config.get('standard_adoption',{}).get('healthcheck'),domain,registry.config.get('hostname_policy'),http_policy,letsencrypt=use_letsencrypt)
+    health_command = healthcheck['Test'][1] if healthcheck else None
     proxy_image = 'ghcr.io/cryptolabsza/cryptolabs-proxy:latest'
     proxy_origin = None
     if release_selection_dir:
@@ -73,6 +87,9 @@ def generate_docker_compose(config_dir: Path, domain: str = None, use_letsencryp
         release_selection_dir=str(Path(release_selection_dir).resolve()) if release_selection_dir else None,
         proxy_image=proxy_image,
         proxy_origin=proxy_origin,
+        http_policy=http_policy,
+        policy_healthcheck=health_command,
+        policy_healthcheck_config=healthcheck,
     )
     
     (config_dir / "docker-compose.yml").write_text(content)
@@ -143,3 +160,77 @@ def validate_acme_challenge(value):
 
 def render_acme_challenge(value, *, legacy_profile=False):
     return get_jinja_env().get_template('acme-challenge.conf.j2').render(acme_challenge=value,legacy_forward_profile=legacy_profile).encode()
+
+
+def validate_hostname_policy(policy, domain):
+    """Only the observed literal-primary $host guard with fixed 444 is supported."""
+    import re
+    import ipaddress
+    if policy is None:
+        return None
+    if not isinstance(policy, str) or policy != 'primary-only':
+        raise ValueError('invalid_hostname_policy')
+    literal = re.compile(r'(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+')
+    if not isinstance(domain, str) or not literal.fullmatch(domain):
+        raise ValueError('hostname_policy_requires_literal_domain')
+    try:
+        ipaddress.ip_address(domain)
+    except ValueError:
+        return policy
+    raise ValueError('hostname_policy_requires_literal_domain')
+
+
+def validate_http_policy(policy, domain, acme_challenge=None):
+    """Closed primary HTTPS redirect and local HTTP ACME transport."""
+    if policy is None:
+        return None
+    if not isinstance(policy, str) or policy != 'redirect-primary-https':
+        raise ValueError('invalid_http_policy')
+    validate_hostname_policy('primary-only', domain)
+    if acme_challenge is not None:
+        raise ValueError('http_policy_local_acme_conflicts_with_upstream')
+    return policy
+
+
+def render_policy_healthcheck(domain, hostname_policy=None, http_policy=None, *, letsencrypt=False):
+    """Public HTTPS loopback uses the declared Host/SNI; internal API stays checked.
+
+    The stored certificate is the explicit local trust anchor. Hostname
+    verification remains enabled; browser and forwarding trust are unchanged.
+    """
+    validate_hostname_policy(hostname_policy, domain)
+    validate_http_policy(http_policy, domain)
+    if hostname_policy is None and http_policy is None:
+        return None
+    validate_hostname_policy('primary-only', domain)
+    certificate='/etc/letsencrypt/live/'+domain+'/fullchain.pem' if letsencrypt else '/etc/nginx/ssl/server.crt'
+    return ('curl -fsS --cacert '+certificate+' --resolve '+domain+':443:127.0.0.1 https://'+domain+
+            '/api/health && curl -f http://127.0.0.1:8080/api/health || exit 1')
+
+
+def policy_healthcheck(current, domain, hostname_policy=None, http_policy=None, *, letsencrypt=False):
+    """Keep the exact independently observed verified probe; map image defaults.
+
+    Recognition compares fixed raw shell syntax, with spaces/tabs only. It
+    never accepts arbitrary operations, flags, URLs, credentials or snippets.
+    """
+    from copy import deepcopy
+    import re
+    command=render_policy_healthcheck(domain,hostname_policy,http_policy,letsencrypt=letsencrypt)
+    if command is None: return None
+    default=['CMD-SHELL','curl -f http://localhost/api/health && curl -f http://localhost:8080/api/health || exit 1']
+    if current is None: return {'Test':['CMD-SHELL',command]}
+    fields={'Test','Interval','Timeout','StartPeriod','StartInterval','Retries'}
+    if not isinstance(current,dict) or set(current)-fields or not isinstance(current.get('Test'),list): raise ValueError('source_healthcheck_unmapped')
+    if any(type(v) is not int or not 0<=v<=2**63-1 for k,v in current.items() if k!='Test'): raise ValueError('source_healthcheck_unmapped')
+    test=current['Test']
+    trusted='curl -fsS --resolve '+domain+':443:127.0.0.1 https://'+domain+'/api/health >/dev/null && curl -fsS http://localhost:8080/api/health >/dev/null || exit 1'
+    if len(test)==2 and test[0]=='CMD-SHELL' and isinstance(test[1],str) and len(test[1])<=4096:
+        # Shell operators must remain operators, not quoted/escaped curl
+        # arguments. Only spaces/tabs may vary in this closed raw skeleton.
+        # The validated domain is escaped with every other literal position.
+        skeleton=re.escape(trusted).replace(r'\ ',r'[ 	]+')
+        if re.fullmatch(skeleton,test[1]): return deepcopy(current)
+    if test not in (default,['CMD-SHELL',command]): raise ValueError('source_healthcheck_unmapped')
+    result=deepcopy(current);result['Test']=['CMD-SHELL',command]
+    return result

{cryptolabs_proxy-1.4.0 → cryptolabs_proxy-1.5.0}/src/cryptolabs_proxy/setup.py

@@ -14,7 +14,7 @@ from dataclasses import dataclass
 from typing import Optional, Dict, List, Tuple
 from datetime import datetime
 
-from .config import generate_nginx_config, generate_docker_compose, CONFIG_DIR
+from .config import generate_nginx_config, generate_docker_compose, validate_hostname_policy, validate_http_policy, render_policy_healthcheck, CONFIG_DIR
 from .ssl import generate_self_signed_cert
 from .services import ServiceRegistry
 from .release_selection import SELECTION_CONTRACT, SelectionError, load as load_selection, targets as selection_targets
@@ -45,8 +45,12 @@ class ProxyConfig:
     # Internal API token - shared secret for service-to-service config API
     internal_api_token: str = ""
     release_selection_dir: Optional[Path] = None
+    hostname_policy: Optional[str] = None
+    http_policy: Optional[str] = None
     
     def __post_init__(self):
+        self.hostname_policy = validate_hostname_policy(self.hostname_policy, self.domain)
+        self.http_policy = validate_http_policy(self.http_policy, self.domain)
         if not self.auth_secret:
             self.auth_secret = secrets.token_hex(32)
         if not self.internal_api_token:
@@ -452,6 +456,13 @@ def setup_proxy(
 
     target_image = 'ghcr.io/cryptolabsza/cryptolabs-proxy:latest'
     recorded = ServiceRegistry(CONFIG_DIR).config
+    try:
+        policy = config.hostname_policy if config.hostname_policy is not None else recorded.get('hostname_policy')
+        config.hostname_policy = validate_hostname_policy(policy, config.domain)
+        http_policy = config.http_policy if config.http_policy is not None else recorded.get("http_policy")
+        config.http_policy = validate_http_policy(http_policy, config.domain, recorded.get("acme_challenge"))
+    except ValueError:
+        return False, 'Invalid hostname policy; setup not started'
     if recorded.get('standard_adoption'):
         from .standard_adoption import StandardAdoption
         return StandardAdoption(CONFIG_DIR).reconfigure(config)
@@ -459,6 +470,8 @@ def setup_proxy(
     if config.release_selection_dir is None and recorded_directory:
         config.release_selection_dir = Path(recorded_directory)
     baseline = config.release_selection_dir is not None
+    if (config.hostname_policy or config.http_policy) and not baseline:
+        return False, 'Hostname policy requires approved standard setup or configuration adoption'
     if baseline and recorded.get('custom_config'):
         from .updates import PROXY_ADOPTION_MESSAGE
         return False, 'Custom Nginx configuration requires host adoption. '+PROXY_ADOPTION_MESSAGE
@@ -568,16 +581,18 @@ def setup_proxy(
                 candidate_dir = Path(temporary)
                 generate_nginx_config(candidate_dir, config.domain, config.use_letsencrypt and ssl_success, registry.services,
                     host_forward_groups=registry.config.get('host_forward_groups', []),
-                    acme_challenge=registry.config.get('acme_challenge'))
+                    acme_challenge=registry.config.get('acme_challenge'),
+                    hostname_policy=config.hostname_policy, http_policy=config.http_policy)
                 validation = ['docker', 'run', '--rm', '--network', DOCKER_NETWORK_NAME,
                     '--entrypoint', '']
                 validation.extend(['-v', f'{CONFIG_DIR / "ssl"}:/etc/nginx/ssl:ro',
                     '-v', f'{candidate_dir / "nginx.conf"}:/etc/nginx/nginx.conf:ro'])
                 if config.use_letsencrypt and ssl_success:
+                    validation.extend(['-v', '/etc/letsencrypt:/etc/letsencrypt:ro'])
+                if config.use_letsencrypt and ssl_success or config.http_policy:
                     webroot = CONFIG_DIR / 'certbot' / 'www'
                     webroot.mkdir(parents=True, exist_ok=True)
-                    validation.extend(['-v', '/etc/letsencrypt:/etc/letsencrypt:ro',
-                        '-v', f'{webroot}:/var/www/certbot:ro'])
+                    validation.extend(['-v', f'{webroot}:/var/www/certbot:ro'])
                 validation.extend([target_image, 'nginx', '-t'])
                 try:
                     tested = subprocess.run(validation, capture_output=True, timeout=60)
@@ -614,8 +629,12 @@ def setup_proxy(
                 '-e', 'RELEASE_SELECTION_REQUIRED=true', '--label', 'io.cryptolabs.update.reference=' + target_image,
                 '--label', 'io.cryptolabs.update.origin=' + proxy_target['origin']])
             if config.use_letsencrypt and ssl_success:
-                cmd.extend(['-v', '/etc/letsencrypt:/etc/letsencrypt:ro',
-                    '-v', f'{CONFIG_DIR / "certbot" / "www"}:/var/www/certbot:ro'])
+                cmd.extend(['-v', '/etc/letsencrypt:/etc/letsencrypt:ro'])
+            if config.use_letsencrypt and ssl_success or config.http_policy:
+                cmd.extend(['-v', f'{CONFIG_DIR / "certbot" / "www"}:/var/www/certbot:ro'])
+            healthcheck = render_policy_healthcheck(config.domain, config.hostname_policy, config.http_policy, letsencrypt=config.use_letsencrypt and ssl_success)
+            if healthcheck:
+                cmd.extend(['--health-cmd', healthcheck])
         cmd.append(target_image)
 
         log("Freeing ports 80/443...")
@@ -681,6 +700,10 @@ def setup_proxy(
     # Step 6: Initialize service registry
     registry = ServiceRegistry(CONFIG_DIR)
     registry.config["domain"] = config.domain
+    if config.hostname_policy is not None:
+        registry.config["hostname_policy"] = config.hostname_policy
+    if config.http_policy is not None:
+        registry.config["http_policy"] = config.http_policy
     registry.config["letsencrypt"] = config.use_letsencrypt and ssl_success
     if baseline:
         registry.config['release_selection_dir'] = str(Path(config.release_selection_dir).resolve())
@@ -731,7 +754,7 @@ def update_proxy_credentials(
             fleet_admin_user=fleet_admin_user, fleet_admin_pass=fleet_admin_pass, auth_secret=auth_secret,
             watchdog_api_key=watchdog_api_key, watchdog_url=watchdog_url,
             internal_api_token=internal_api_token, site_name=existing.get('SITE_NAME', 'DC Overview'),
-            release_selection_dir=Path(release_directory)))
+            release_selection_dir=Path(release_directory), hostname_policy=registry.config.get('hostname_policy'), http_policy=registry.config.get('http_policy')))
     
     # Recreate with new credentials
     subprocess.run(["docker", "rm", "-f", "cryptolabs-proxy"], capture_output=True)

{cryptolabs_proxy-1.4.0 → cryptolabs_proxy-1.5.0}/src/cryptolabs_proxy/standard_adoption.py

@@ -16,7 +16,7 @@ import tarfile
 import time
 from urllib.parse import quote, urlsplit
 
-from .config import get_jinja_env, validate_host_forward_groups, render_host_forward_groups, validate_acme_challenge, render_acme_challenge
+from .config import get_jinja_env, validate_host_forward_groups, render_host_forward_groups, validate_acme_challenge, render_acme_challenge, validate_hostname_policy, validate_http_policy, render_policy_healthcheck, policy_healthcheck
 from .custom_config import render_managed_vpm_config
 from .migration import (DockerEngine, CustomConfigMigrator, MigrationError, SwitchController,
                         build_recreate_request, endpoint_configurations, wait_for_container_healthy,
@@ -139,7 +139,7 @@ def _safe_upstream(words):
 
 def _declaration(value):
     required={'schema_version','domain','tls','release_selection_dir','services','obsolete_overlays','obsolete_owner_labels'}
-    if not isinstance(value,dict) or set(value)-required-{'host_forward_groups','acme_challenge'} or not required<=set(value) or type(value['schema_version']) is not int or value['schema_version']!=1:
+    if not isinstance(value,dict) or set(value)-required-{'host_forward_groups','acme_challenge','hostname_policy','http_policy'} or not required<=set(value) or type(value['schema_version']) is not int or value['schema_version']!=1:
         raise AdoptionError('declaration_schema_invalid')
     domain=value['domain']
     if not isinstance(domain,str) or not DOMAIN.fullmatch(domain) or '..' in domain or domain.endswith('.') or value['tls'] not in ('self-signed','letsencrypt'):
@@ -170,12 +170,74 @@ def _declaration(value):
     try:
         groups=validate_host_forward_groups(value.get('host_forward_groups',[]),domain)
         acme=validate_acme_challenge(value.get('acme_challenge'))
+        policy=validate_hostname_policy(value.get('hostname_policy'),domain)
+        http_policy=validate_http_policy(value.get('http_policy'),domain,acme)
     except ValueError as error: raise AdoptionError(str(error)) from None
-    return {**deepcopy(value),'host_forward_groups':groups,'acme_challenge':acme,'release_selection_dir':str(Path(directory).resolve()),'services':services}
+    canonical=deepcopy(value)
+    for name,setting in [('hostname_policy',policy),('http_policy',http_policy)]:
+        if setting is None: canonical.pop(name,None)
+        else: canonical[name]=setting
+    return {**canonical,'host_forward_groups':groups,'acme_challenge':acme,'release_selection_dir':str(Path(directory).resolve()),'services':services}
 
 
 def render_standard(declaration):
-    return get_jinja_env().get_template('nginx.conf.j2').render(domain=declaration['domain'],letsencrypt=declaration['tls']=='letsencrypt',services=declaration['services'],host_forward_groups=declaration.get('host_forward_groups',[]),acme_challenge=declaration.get('acme_challenge')).encode()
+    return get_jinja_env().get_template('nginx.conf.j2').render(domain=declaration['domain'],letsencrypt=declaration['tls']=='letsencrypt',services=declaration['services'],host_forward_groups=declaration.get('host_forward_groups',[]),acme_challenge=declaration.get('acme_challenge'),hostname_policy=validate_hostname_policy(declaration.get('hostname_policy'),declaration['domain']),http_policy=validate_http_policy(declaration.get('http_policy'),declaration['domain'],declaration.get('acme_challenge'))).encode()
+
+
+def _policy_healthcheck(source, declaration):
+    try:
+        return policy_healthcheck(source.get('Config',{}).get('Healthcheck'),declaration['domain'],declaration.get('hostname_policy'),declaration.get('http_policy'),letsencrypt=declaration['tls']=='letsencrypt')
+    except ValueError: raise AdoptionError('source_healthcheck_unmapped') from None
+
+
+def _guarded_bootstrap_profile(legacy, declaration):
+    """Exact observed legacy delta, checked against an independent full fixture.
+
+    This constructs the supported tree; it never strips unknown source nodes.
+    Only the declared primary literal is substituted, in explicit positions.
+    """
+    domain=declaration['domain']
+    tree=parse_nginx(render_managed_vpm_config(legacy,True))
+    http=next(c for w,c in tree if w==['http'])
+    server=next(c for w,c in http if w==['server'])
+    # The captured HTTPS server is the released bootstrap minus HTTP listen.
+    server.remove([['listen','80','default_server'],None])
+    name=next(n for n in server if n[0]==['server_name','_'])
+    name[0][1]=domain
+    guard=parse_nginx(('if ($host != '+domain+') { return 444; }').encode())[0]
+    server.insert(server.index(name)+1,guard)
+    auth=next(n for n in server if n[0]==['location','=','/_auth_check'])
+    protected=parse_nginx(b"""
+        location = /auth/headers { return 404; }
+        location = /auth/headers/ { return 404; }
+        location = /auth/exporters/authorize { return 404; }
+        location = /auth/exporters/authorize/ { return 404; }
+        location = /_exporter_admin {
+            internal;
+            proxy_pass http://auth_server/auth/exporters/authorize;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+            proxy_set_header Cookie $http_cookie;
+            proxy_set_header X-Original-URI $request_uri;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_pass_header X-Mgmt-Token;
+        }
+    """)
+    index=server.index(auth)+1;server[index:index]=protected
+    login=next(c for w,c in server if w==['location','/auth/'])
+    upstream=next(n for n in login if n[0]==['proxy_pass','http://auth_server/auth/'])
+    index=login.index(upstream)+1
+    login[index:index]=parse_nginx(b'proxy_hide_header X-Mgmt-Token; proxy_cookie_flags fleet_session secure httponly samesite=lax;')
+    for route in ('^/vastai-api/(.*)$','^/runpod-api/(.*)$'):
+        children=next(c for w,c in server if w==['location','~',route])
+        request=next(w for w,c in children if w==['auth_request','/_auth_check'])
+        request[1]='/_exporter_admin'
+    public=parse_nginx(('server { listen 80 default_server; server_name '+domain+'; if ($host != '+domain+') { return 444; } location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type text/plain; try_files $uri =404; } location / { return 308 https://'+domain+'$request_uri; } }').encode())[0]
+    public[1].extend(parse_nginx(get_jinja_env().get_template('vast-price-manager-auth-blocks.conf.j2').render().encode()))
+    index=next(i for i,n in enumerate(http) if n[0]==['server'])
+    http.insert(index,public)
+    http.extend(parse_nginx(render_host_forward_groups(declaration.get('host_forward_groups',[]),legacy_profile=True)))
+    return tree
 
 
 class AdoptionEngine(DockerEngine):
@@ -409,10 +471,20 @@ while True: time.sleep(60)
         self._request('POST','/images/create?fromImage='+quote(reference,safe=''),allowed=(200,))
     def validate(self,image,candidate,inspect,identity):
         CustomConfigMigrator(candidate.parent,candidate.parent,engine=self)._validate_candidate(image,candidate,inspect,identity)
-    def anonymous_auth(self,name,tls):
+    def anonymous_auth(self,name,tls,domain=None):
         # Internal fixed executable probes both auth server and public Nginx.
         import subprocess
         probe="import http.client; c=http.client.HTTPConnection('127.0.0.1',8081,timeout=5); c.request('GET','/auth/exporters/authorize'); assert c.getresponse().status==401; c.close(); c=http.client.HTTPSConnection('127.0.0.1',443,context=__import__('ssl')._create_unverified_context(),timeout=5); c.request('GET','/api/versions'); assert c.getresponse().status==401; c.close(); c=http.client.HTTPSConnection('127.0.0.1',443,context=__import__('ssl')._create_unverified_context(),timeout=5); c.request('GET','/auth/vast-price-manager/session'); assert c.getresponse().status==404"
+        if domain is not None:
+            validate_hostname_policy('primary-only',domain)
+            # Connect only to loopback, while TLS SNI and HTTP Host use the
+            # same declared literal. Preserve existing local unverified probe.
+            connect="class PrimaryHTTPS(http.client.HTTPSConnection):\n def connect(self):\n  sock=__import__('socket').create_connection(('127.0.0.1',443),self.timeout); self.sock=self._context.wrap_socket(sock,server_hostname=self.host)\n"
+            probe=probe.replace("c=http.client.HTTPSConnection('127.0.0.1',443,", "c=PrimaryHTTPS("+repr(domain)+",443,")
+            certificate='/etc/letsencrypt/live/'+domain+'/fullchain.pem' if tls=='letsencrypt' else '/etc/nginx/ssl/server.crt'
+            probe=probe.replace("context=__import__('ssl')._create_unverified_context()", "context=ctx")
+            connect+="ctx=__import__('ssl').create_default_context(); ctx.load_verify_locations(cafile="+repr(certificate)+");\n"
+            probe=probe.replace("import http.client; ", "import http.client\n"+connect+"\n")
         try:
             result=subprocess.run(['docker','exec',name,'python3','-c',probe],capture_output=True,timeout=self.timeout)
             return result.returncode==0
@@ -500,7 +572,7 @@ class StandardAdoption:
             def visit(items):
                 for words,children in items:
                     if words[0]=='server_name':
-                        if words[1:] in ([declaration['domain']],['_']): words[1:]=['DECLARED_DOMAIN']
+                        if words[1:]==[declaration['domain']] or words[1:]==['_'] and not declaration.get('hostname_policy'): words[1:]=['DECLARED_DOMAIN']
                         elif words[1:] not in [g['hostnames'] for g in declaration.get('host_forward_groups',[])]: raise AdoptionError('source_domain_unmapped')
                     if children is not None: visit(children)
             visit(nodes); return nodes
@@ -520,14 +592,22 @@ class StandardAdoption:
                 server[index:index]=parse_nginx(render_acme_challenge(declaration['acme_challenge'],legacy_profile=True))
             next(children for words,children in profile_tree if words==['http']).extend(deepcopy(forwarding_tree))
             profile_trees.append(profile_tree)
-        if any(actual==normalize(p) for p in profile_trees):
+        if not declaration.get('hostname_policy') and any(actual==normalize(p) for p in profile_trees):
             required={'ipmi-monitor','dc-overview','grafana','prometheus','vastai-exporter','runpod-exporter'}
             if b'location = /vast-pricing' in active: required.add('vast-price-manager')
             if not required<=set(declaration['services']) or declaration['tls']!='self-signed': raise AdoptionError('legacy_services_or_tls_unmapped')
             for name in required:
                 if any(declaration['services'][name][k]!=DEFAULT_SERVICES[name][k] for k in ('container_name','port','path')): raise AdoptionError('legacy_target_unmapped')
             return 'released-bootstrap-1.2.0'
-        supported=[expected]+[normalize(p) for p in profile_trees]
+        if declaration.get('hostname_policy')=='primary-only' and declaration.get('http_policy')=='redirect-primary-https' and declaration['tls']=='self-signed' and not declaration.get('acme_challenge'):
+            guarded=_guarded_bootstrap_profile(legacy,declaration)
+            if actual==normalize(guarded):
+                required={'ipmi-monitor','dc-overview','grafana','prometheus','vastai-exporter','runpod-exporter','vast-price-manager'}
+                if not required<=set(declaration['services']): raise AdoptionError('legacy_services_or_tls_unmapped')
+                for name in required:
+                    if any(declaration['services'][name][k]!=DEFAULT_SERVICES[name][k] for k in ('container_name','port','path')): raise AdoptionError('legacy_target_unmapped')
+                return 'released-bootstrap-primary-only'
+        supported=[expected]+([normalize(p) for p in profile_trees] if not declaration.get('hostname_policy') else [])
         actual_words=list(_walk(actual)); actual_set={tuple(w) for w in actual_words}
         closest=min(supported,key=lambda profile:len(actual_set^{tuple(w) for w in _walk(profile)}))
         known={tuple(w) for w in _walk(closest)}
@@ -538,6 +618,7 @@ class StandardAdoption:
     def plan(self,settings,*,environment=None):
         declaration=_declaration(settings); source=self.engine.inspect('cryptolabs-proxy')
         if not source.get('State',{}).get('Running'): raise AdoptionError('source_not_running')
+        healthcheck=_policy_healthcheck(source,declaration)
         active=self.engine.read_config('cryptolabs-proxy')
         recorded=ServiceRegistry(self.config_dir).config.get('standard_adoption',{})
         source_declaration=recorded.get('declaration',declaration)
@@ -568,6 +649,11 @@ class StandardAdoption:
             'declaration_sha256':sha256(_canonical(declaration)),'candidate_sha256':sha256(candidate),'selection_id':snapshot['selection_id'],'selection_sha256':snapshot['selection_sha256'],
             'manifest_sha256':snapshot['manifest_sha256'],'image':artifact['reference'],'platform':platform,'origin':artifact['origin'],'source_profile':profile,
             'environment_sha256':sha256(_canonical(environment or {}))}
+        if healthcheck is not None:
+            original=source.get('Config',{}).get('Healthcheck')
+            plan['healthcheck_sha256']=sha256(_canonical(healthcheck))
+            plan['source_healthcheck_sha256']=sha256(_canonical(original))
+            plan['healthcheck_action']='preserved-verified-source' if original==healthcheck else 'generated-policy-probe'
         plan['plan_id']=sha256(_canonical(plan))[:24]
         return plan
 
@@ -612,6 +698,8 @@ class StandardAdoption:
                 auth_mount=next(m for m in source['Mounts'] if m['Destination']=='/data/auth')
                 clone['Mounts'].append({'Type':'bind','Source':declaration['release_selection_dir'],'Destination':'/etc/cryptolabs/releases','RW':False})
                 nginx=self.config_dir/'nginx.conf'; request=build_recreate_request(clone,plan['image'],str(nginx))
+                if declaration.get('hostname_policy') or declaration.get('http_policy'):
+                    request['Config']['Healthcheck']=_policy_healthcheck(source,declaration)
                 config=request['Config']; config['Labels']=deepcopy(config.get('Labels') or {})
                 config['Labels'].update({'com.centurylinklabs.watchtower.enable':'false','io.cryptolabs.update.origin':plan['origin'],'io.cryptolabs.update.reference':plan['image']})
                 for label in declaration['obsolete_owner_labels']: config['Labels'].pop(label,None)
@@ -698,7 +786,7 @@ class StandardAdoption:
                         guard()
                 def candidate_health(name):
                     guard()
-                    ready=wait_for_proxy_ready(engine,name,lambda:engine.anonymous_auth(name,declaration['tls']),PROXY_READY_TIMEOUT)
+                    ready=wait_for_proxy_ready(engine,name,lambda:engine.anonymous_auth(name,declaration['tls'],declaration['domain']) if declaration.get('hostname_policy') or declaration.get('http_policy') else engine.anonymous_auth(name,declaration['tls']),PROXY_READY_TIMEOUT)
                     if not ready: engine.stop(name,ignore_missing=True)
                     guard()
                     return ready
@@ -715,7 +803,12 @@ class StandardAdoption:
                 # proven candidate/config and private recovery record for repair.
                 registry.services=declaration['services']; registry.config.pop('custom_config',None)
                 registry.config.update(domain=declaration['domain'],letsencrypt=declaration['tls']=='letsencrypt',release_selection_dir=declaration['release_selection_dir'],host_forward_groups=declaration.get('host_forward_groups',[]),acme_challenge=declaration.get('acme_challenge'))
+                for name in ('hostname_policy','http_policy'):
+                    if name in declaration: registry.config[name]=declaration[name]
+                    else: registry.config.pop(name,None)
                 registry.config['standard_adoption']={'plan_id':identity,'serving_sha256':_runtime_identity(engine.inspect('cryptolabs-proxy')),'declaration_sha256':plan['declaration_sha256'],'selection_sha256':plan['selection_sha256'],'auth_mount':{k:auth_mount[k] for k in ('Type','Name','Source','Destination') if k in auth_mount},'declaration':declaration}
+                if declaration.get('hostname_policy') or declaration.get('http_policy'):
+                    registry.config['standard_adoption']['healthcheck']=deepcopy(request['Config']['Healthcheck'])
                 try: registry.save()
                 except OSError:
                     write(backup/'outcome.json',_canonical({'state':'candidate_retained','reason':'registry_forward_repair_required'}))
@@ -750,6 +843,8 @@ class StandardAdoption:
             declaration=deepcopy(registry.config['standard_adoption']['declaration'])
             declaration.update(domain=config.domain,tls='letsencrypt' if config.use_letsencrypt else 'self-signed',services={n:{k:v for k,v in s.items() if k in ('container_name','path','port','display_name')} for n,s in registry.services.items()},obsolete_overlays=[],obsolete_owner_labels=[])
             if config.release_selection_dir: declaration['release_selection_dir']=str(config.release_selection_dir)
+            if config.hostname_policy is not None: declaration['hostname_policy']=config.hostname_policy
+            if config.http_policy is not None: declaration['http_policy']=config.http_policy
             source=self.engine.inspect('cryptolabs-proxy'); current={e.split('=',1)[0]:e.split('=',1)[1] for e in source['Config'].get('Env',[]) if '=' in e}
             environment={}
             for name,value in [('FLEET_ADMIN_USER',config.fleet_admin_user),('FLEET_ADMIN_PASS',config.fleet_admin_pass),('SITE_NAME',config.site_name),('WATCHDOG_API_KEY',config.watchdog_api_key),('WATCHDOG_URL',config.watchdog_url)]:
@@ -758,8 +853,17 @@ class StandardAdoption:
             # default generated values in ProxyConfig are not rotation intent.
             normalized=_declaration(declaration)
             selected=targets(load(normalized['release_selection_dir']),self.engine.image(source['Image'])['Os']+'/'+self.engine.image(source['Image'])['Architecture'])['cryptolabs-proxy']
+            health_current=True
+            if normalized.get('hostname_policy') or normalized.get('http_policy'):
+                # No-op is a positive preservation result; validate both the
+                # runtime probe and its saved policy metadata before claiming it.
+                runtime_health=_policy_healthcheck(source,normalized)
+                recorded_health=registry.config['standard_adoption'].get('healthcheck')
+                if recorded_health is None: raise AdoptionError('recorded_healthcheck_unmapped')
+                saved_health=_policy_healthcheck({'Config':{'Healthcheck':recorded_health}},normalized)
+                health_current=(runtime_health==source['Config'].get('Healthcheck') and saved_health==recorded_health and runtime_health==saved_health)
             labels=source['Config'].get('Labels') or {}
-            if not environment and sha256(self.engine.read_config('cryptolabs-proxy'))==sha256(render_standard(normalized)) and labels.get('io.cryptolabs.update.reference')==selected['reference'] and labels.get('com.centurylinklabs.watchtower.enable')=='false':
+            if health_current and not environment and sha256(self.engine.read_config('cryptolabs-proxy'))==sha256(render_standard(normalized)) and labels.get('io.cryptolabs.update.reference')==selected['reference'] and labels.get('com.centurylinklabs.watchtower.enable')=='false':
                 return True,'Adopted proxy configuration already current; state preserved'
             plan=self.plan(declaration,environment=environment)
             result=self.adopt(declaration,plan['plan_id'],environment=environment)
@@ -774,5 +878,5 @@ class StandardAdoption:
         registry=ServiceRegistry(self.config_dir)
         source=self.engine.inspect('cryptolabs-proxy')
         environment={e.split('=',1)[0]:e.split('=',1)[1] for e in source['Config'].get('Env',[]) if '=' in e}
-        config=ProxyConfig(registry.config['domain'],use_letsencrypt=registry.config.get('letsencrypt',False),fleet_admin_user=environment.get('FLEET_ADMIN_USER','admin'),fleet_admin_pass=environment.get('FLEET_ADMIN_PASS',''),site_name=environment.get('SITE_NAME',''),watchdog_api_key=environment.get('WATCHDOG_API_KEY',''),watchdog_url=environment.get('WATCHDOG_URL',''),release_selection_dir=Path(registry.config['release_selection_dir']))
+        config=ProxyConfig(registry.config['domain'],use_letsencrypt=registry.config.get('letsencrypt',False),fleet_admin_user=environment.get('FLEET_ADMIN_USER','admin'),fleet_admin_pass=environment.get('FLEET_ADMIN_PASS',''),site_name=environment.get('SITE_NAME',''),watchdog_api_key=environment.get('WATCHDOG_API_KEY',''),watchdog_url=environment.get('WATCHDOG_URL',''),release_selection_dir=Path(registry.config['release_selection_dir']),hostname_policy=registry.config.get('hostname_policy'),http_policy=registry.config.get('http_policy'))
         return self.reconfigure(config)

{cryptolabs_proxy-1.4.0 → cryptolabs_proxy-1.5.0}/src/cryptolabs_proxy/templates/docker-compose.yml.j2

@@ -19,6 +19,8 @@ services:
       {% endif %}
       {% if use_letsencrypt %}
       - ./certbot/conf:/etc/letsencrypt:ro
+      {% endif %}
+      {% if use_letsencrypt or http_policy %}
       - ./certbot/www:/var/www/certbot:ro
       {% endif %}
     environment:
@@ -29,10 +31,20 @@ services:
     networks:
       - cryptolabs
     healthcheck:
+      {% if policy_healthcheck %}
+      test: ["CMD-SHELL", {{ policy_healthcheck | tojson }}]
+      {% else %}
       test: ["CMD", "curl", "-f", "http://localhost/api/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
+      {% endif %}
+      interval: {{ (policy_healthcheck_config.Interval | string + 'ns') if policy_healthcheck_config and 'Interval' in policy_healthcheck_config else '30s' }}
+      timeout: {{ (policy_healthcheck_config.Timeout | string + 'ns') if policy_healthcheck_config and 'Timeout' in policy_healthcheck_config else '10s' }}
+      retries: {{ policy_healthcheck_config.Retries if policy_healthcheck_config and 'Retries' in policy_healthcheck_config else 3 }}
+      {% if policy_healthcheck_config and 'StartPeriod' in policy_healthcheck_config %}
+      start_period: {{ policy_healthcheck_config.StartPeriod }}ns
+      {% endif %}
+      {% if policy_healthcheck_config and 'StartInterval' in policy_healthcheck_config %}
+      start_interval: {{ policy_healthcheck_config.StartInterval }}ns
+      {% endif %}
     labels:
       com.centurylinklabs.watchtower.enable: "{{ 'false' if release_selection_dir else 'true' }}"
       {% if release_selection_dir %}

{cryptolabs_proxy-1.4.0 → cryptolabs_proxy-1.5.0}/src/cryptolabs_proxy/templates/nginx.conf.j2

@@ -28,12 +28,28 @@ http {
     # Rate limiting
     limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
 
-    {% if letsencrypt %}
+    {% if letsencrypt or http_policy %}
     # Redirect HTTP to HTTPS
     server {
-        listen 80;
+        listen 80{% if hostname_policy %} default_server{% endif %};
         server_name {{ domain }};
+{% if hostname_policy %}
+        if ($host != {{ domain }}) {
+            return 444;
+        }
+{% endif %}
         
+{% if http_policy %}
+        location ^~ /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+            default_type text/plain;
+            try_files $uri =404;
+        }
+        location / {
+            return 308 https://{{ domain }}$request_uri;
+        }
+        {% include "vast-price-manager-auth-blocks.conf.j2" %}
+{% else %}
         location /.well-known/acme-challenge/ {
             root /var/www/certbot;
         }
@@ -41,23 +57,41 @@ http {
         location / {
             return 301 https://$host$request_uri;
         }
+{% endif %}
     }
 
     server {
-        listen 443 ssl http2;
+        listen 443 ssl http2{% if hostname_policy %} default_server{% endif %};
         server_name {{ domain }};
+{% if hostname_policy %}
+        if ($host != {{ domain }}) {
+            return 444;
+        }
+{% endif %}
 
+    {% if letsencrypt %}
         ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
         ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
         ssl_protocols TLSv1.2 TLSv1.3;
         ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
         ssl_prefer_server_ciphers off;
         ssl_session_cache shared:SSL:10m;
+    {% else %}
+        ssl_certificate /etc/nginx/ssl/server.crt;
+        ssl_certificate_key /etc/nginx/ssl/server.key;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers HIGH:!aNULL:!MD5;
+    {% endif %}
     {% else %}
     server {
-        listen 80;
-        listen 443 ssl http2;
+        listen 80{% if hostname_policy %} default_server{% endif %};
+        listen 443 ssl http2{% if hostname_policy %} default_server{% endif %};
         server_name {{ domain }};
+{% if hostname_policy %}
+        if ($host != {{ domain }}) {
+            return 444;
+        }
+{% endif %}
 
         ssl_certificate /etc/nginx/ssl/server.crt;
         ssl_certificate_key /etc/nginx/ssl/server.key;
@@ -91,6 +125,10 @@ http {
         # Auth server endpoints (public)
         location /auth/ {
             proxy_pass http://127.0.0.1:8081/auth/;
+{% if http_policy %}
+            proxy_hide_header X-Mgmt-Token;
+            proxy_cookie_flags fleet_session secure httponly samesite=lax;
+{% endif %}
             proxy_http_version 1.1;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -98,6 +136,12 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
 
+{% if http_policy %}
+        location = /auth/headers { return 404; }
+        location = /auth/headers/ { return 404; }
+        location = /auth/exporters/authorize { return 404; }
+        location = /auth/exporters/authorize/ { return 404; }
+{% endif %}
         # Internal auth verification endpoint (for auth_request)
         location = /_auth_check {
             internal;