Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 9 Projects Releases Packages Wiki Activity Actions

dev: leave /healthz outside the basic-auth boundary (#113)
All checks were successful
Sync infra to hosts / sync-beta (push) Has been skipped
Details
shell-lint / shellcheck (push) Successful in 10s
Details
PR build (required check) / build-backend (pull_request) Has been skipped
Details
PR build (required check) / build-frontend (pull_request) Has been skipped
Details
PR build (required check) / gate (pull_request) Successful in 1s
Details
Sync infra to hosts / sync-prod (push) Has been skipped
Details
Sync infra to hosts / sync-dev (push) Successful in 6s
Details
secrets-guard / encrypted (push) Successful in 6s
Details
PR build (required check) / changes (pull_request) Successful in 5s
Details
secrets-guard / encrypted (pull_request) Successful in 5s
Details
shell-lint / shellcheck (pull_request) Successful in 8s
Details
PR build (required check) / validate-observability (pull_request) Has been skipped
Details

Browse source
This commit is contained in:
emi 2026-07-26 08:28:18 +00:00
parent 4122f4353b
commit 801c767115
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
infra/deploy/Caddyfile.vps1
View file

@ -75,7 +75,14 @@ dev.thermograph.org {
X-Robots-Tag "noindex, nofollow"
}
basic_auth {
# /healthz is deliberately OUTSIDE the auth boundary. It returns liveness and
# nothing else — no data, no version, no configuration — and Centralis polls
# it to report dev in `fleet_status`. Behind basic auth that poll gets a 401
# and dev reads as permanently down, which is how a monitoring blind spot
# gets created in the name of security.
@protected not path /healthz
basic_auth @protected {
dev $2a$14$LU5sNyxbop3HOsjhXB6ZrOQiveqhbcYVE6.Wi0bydAv4QhNpj4HMC
}