53 lines
1.6 KiB
Markdown
53 lines
1.6 KiB
Markdown
# Maestro
|
|
|
|
Dcntrlized project coordinator service
|
|
|
|
## Access & transport
|
|
|
|
The dashboard ships session cookies (instance-owner gate), so the deployment
|
|
default is **loopback-only**: `docker-compose.yaml` binds
|
|
`127.0.0.1:8080:8080`, making the listener unreachable from the LAN unless you
|
|
deliberately opt out. Maestro itself stays plaintext HTTP; TLS terminates in a
|
|
reverse proxy (D6 — no TLS machinery inside the process).
|
|
|
|
### Single host
|
|
|
|
Reach the UI over SSH from your workstation:
|
|
|
|
```sh
|
|
ssh -L 8080:127.0.0.1:8080 <host>
|
|
# then open http://localhost:8080
|
|
```
|
|
|
|
### Reverse proxy (LAN / public)
|
|
|
|
Put Caddy, Traefik or nginx in front of `http://127.0.0.1:8080` and terminate
|
|
TLS there:
|
|
|
|
```text
|
|
maestro.example.org {
|
|
reverse_proxy 127.0.0.1:8080
|
|
}
|
|
```
|
|
|
|
- **WebSocket:** the UI uses `/api/ws`. Caddy and Traefik proxy upgrades
|
|
automatically; nginx needs explicit headers:
|
|
```nginx
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8080;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
```
|
|
- **Cookies behind the proxy:** set `COOKIE_SECURE=true` in Maestro's
|
|
environment so both session cookies (`maestro_access` / `maestro_refresh`)
|
|
are marked `Secure`.
|
|
- **Host header:** mutating requests carry an Origin/Referer CSRF check that
|
|
compares hosts. A proxy that preserves `Host` works unchanged; if you rewrite
|
|
the host, keep forwarding `X-Forwarded-*` and serve the UI on the same host
|
|
you proxy to.
|