[platform] hero_proxy should default-deny unrouted hosts at boot so a tester is never briefly reachable without sign in during install #290
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
lhumina_code/home_lhumina#290
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
During install the deployer now always seeds a catch-all deny route on the tester's hero_proxy and pushes it before the sign-in route, so a tester is fail-closed once that step runs (lhumina_code/home#253). One brief gap remains: setup-binaries.sh starts hero_proxy and the cockpit near the start of the install, but the deny route is only added at the end of the install payload, so for the minute or so in between a request that reaches the VM (by its public address or its raw overlay address) can be served without sign in. The clean fix is to have hero_proxy itself start in a default-deny posture at boot, so it refuses any unrouted host from its very first request and the install only ever opens specific routes on top of that. This is a hero_proxy change, separate from the deployer-side fix above; filing it so the brief install-time window is closed properly rather than only narrowed.