From 801c7671151970c5aeef02d92dac2d5d1f5de883 Mon Sep 17 00:00:00 2001 From: emi Date: Sun, 26 Jul 2026 08:28:18 +0000 Subject: [PATCH] dev: leave /healthz outside the basic-auth boundary (#113) --- infra/deploy/Caddyfile.vps1 | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/infra/deploy/Caddyfile.vps1 b/infra/deploy/Caddyfile.vps1 index 77bbbac..ebd6ac2 100644 --- a/infra/deploy/Caddyfile.vps1 +++ b/infra/deploy/Caddyfile.vps1 @@ -75,7 +75,14 @@ dev.thermograph.org { X-Robots-Tag "noindex, nofollow" } - basic_auth { + # /healthz is deliberately OUTSIDE the auth boundary. It returns liveness and + # nothing else — no data, no version, no configuration — and Centralis polls + # it to report dev in `fleet_status`. Behind basic auth that poll gets a 401 + # and dev reads as permanently down, which is how a monitoring blind spot + # gets created in the name of security. + @protected not path /healthz + + basic_auth @protected { dev $2a$14$LU5sNyxbop3HOsjhXB6ZrOQiveqhbcYVE6.Wi0bydAv4QhNpj4HMC }