121 lines
2.8 KiB
Markdown
121 lines
2.8 KiB
Markdown
# Disabled-by-default HTTPS edge for external GPT Online Task access
|
|
|
|
## Purpose
|
|
|
|
The internal ingress (`127.0.0.1:18945`) remains loopback-only. This edge is the only component
|
|
allowed to become Internet-facing, and only after a separate owner approval.
|
|
|
|
It forwards only:
|
|
|
|
```text
|
|
POST /v1/read-only-tasks
|
|
GET /v1/read-only-tasks/{request_id}
|
|
GET /openapi.json
|
|
GET /health
|
|
```
|
|
|
|
It never proxies:
|
|
|
|
```text
|
|
18892 canonical Bridge
|
|
18940 Task API
|
|
WriterLease
|
|
commit
|
|
verification
|
|
release
|
|
tag
|
|
baseline
|
|
arbitrary URLs
|
|
```
|
|
|
|
## Default state
|
|
|
|
The systemd unit is disabled by policy unless the owner creates:
|
|
|
|
```text
|
|
/etc/aios-gitops/gpt-https-edge.approved
|
|
```
|
|
|
|
The base unit still binds only to:
|
|
|
|
```text
|
|
127.0.0.1:18443
|
|
AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED=0
|
|
```
|
|
|
|
Non-loopback bind is rejected by code unless an owner-controlled drop-in sets:
|
|
|
|
```text
|
|
AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED=1
|
|
AIOS_GPT_EDGE_HOST=0.0.0.0
|
|
AIOS_GPT_EDGE_PUBLIC_DOMAIN=<approved hostname>
|
|
```
|
|
|
|
This repository candidate does not create that drop-in or approval marker.
|
|
|
|
## TLS
|
|
|
|
TLS certificate/key are owner-managed systemd credentials:
|
|
|
|
```text
|
|
/etc/aios-gitops/gpt-https-edge-tls.crt
|
|
/etc/aios-gitops/gpt-https-edge-tls.key
|
|
```
|
|
|
|
The service requires TLS 1.2 or newer, disables TLS compression, and never logs or returns key
|
|
material.
|
|
|
|
Certificate/key issuance and renewal are external owner responsibilities until a separately
|
|
governed ACME workflow is implemented.
|
|
|
|
## Request protections
|
|
|
|
The edge provides:
|
|
|
|
- 64 KiB request cap;
|
|
- 256 KiB upstream response cap;
|
|
- JSON validation before proxying;
|
|
- fixed upstream `http://127.0.0.1:18945`;
|
|
- Authorization-only header forwarding;
|
|
- no Cookie/X-Forwarded-* trust;
|
|
- route/method allowlist;
|
|
- per-source-IP in-memory rate limiting;
|
|
- bounded concurrent request handling;
|
|
- optional exact Host-header enforcement;
|
|
- HSTS / no-store / nosniff / no-referrer response headers.
|
|
|
|
The rate limiter is intentionally simple and local. Multi-node/global abuse protection is outside
|
|
the current one-host architecture.
|
|
|
|
## Authentication
|
|
|
|
The HTTPS edge does not create a new authentication scheme. It forwards the external Bearer
|
|
credential to the loopback GPT ingress, which verifies `gpt_ingress_token`.
|
|
|
|
The edge never receives the AIOS control-plane token.
|
|
|
|
## Deployment boundary
|
|
|
|
Public activation is a high-risk network operation and requires explicit owner approval. Before
|
|
activation verify:
|
|
|
|
```text
|
|
host-side GPT ingress E2E=VERIFIED
|
|
owner ingress token provisioned
|
|
TLS certificate/key provisioned
|
|
public hostname owned and DNS configured
|
|
firewall/network exposure reviewed
|
|
explicit public-bind approval recorded
|
|
rollback plan available
|
|
```
|
|
|
|
Only after those gates may an owner-authorized runtime drop-in bind this service publicly.
|
|
|
|
Until then:
|
|
|
|
```text
|
|
GPT_HTTPS_EDGE_IMPLEMENTATION=candidate
|
|
PUBLIC_NETWORK_EXPOSURE=NONE
|
|
PUBLIC_CUSTOM_GPT_DIRECT_AI0S_ACCESS=NOT_VERIFIED
|
|
```
|