Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 10 Projects Releases Packages Wiki Activity Actions

dev: leave /healthz outside the basic-auth boundary
All checks were successful
PR build (required check) / changes (pull_request) Successful in 8s
Details
secrets-guard / encrypted (pull_request) Successful in 7s
Details
PR build (required check) / build-backend (pull_request) Has been skipped
Details
shell-lint / shellcheck (pull_request) Successful in 9s
Details
PR build (required check) / build-frontend (pull_request) Has been skipped
Details
PR build (required check) / validate-observability (pull_request) Has been skipped
Details
PR build (required check) / gate (pull_request) Successful in 1s
Details

Browse source 
Centralis polls ${appUrl}/healthz to report each environment in fleet_status.
Behind basic auth that poll returns 401 and dev reads as permanently down --
a monitoring blind spot created in the name of security.

/healthz returns liveness and nothing else: no data, no version, no config.
This commit is contained in:
Emi Griffith 2026-07-26 01:25:07 -07:00
parent 4122f4353b
commit 492f64a581
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
infra/deploy/Caddyfile.vps1
View file

@ -75,7 +75,14 @@ dev.thermograph.org {
X-Robots-Tag "noindex, nofollow"
}
basic_auth {
# /healthz is deliberately OUTSIDE the auth boundary. It returns liveness and
# nothing else — no data, no version, no configuration — and Centralis polls
# it to report dev in `fleet_status`. Behind basic auth that poll gets a 401
# and dev reads as permanently down, which is how a monitoring blind spot
# gets created in the name of security.
@protected not path /healthz
basic_auth @protected {
dev $2a$14$LU5sNyxbop3HOsjhXB6ZrOQiveqhbcYVE6.Wi0bydAv4QhNpj4HMC
}