Maestro

Dcntrlized project coordinator service

Access & transport

The dashboard ships session cookies (instance-owner gate), so the deployment default is loopback-only: docker-compose.yaml binds 127.0.0.1:8080:8080, making the listener unreachable from the LAN unless you deliberately opt out. Maestro itself stays plaintext HTTP; TLS terminates in a reverse proxy (D6 — no TLS machinery inside the process).

Single host

Reach the UI over SSH from your workstation:

ssh -L 8080:127.0.0.1:8080 <host>
# then open http://localhost:8080

Reverse proxy (LAN / public)

Put Caddy, Traefik or nginx in front of http://127.0.0.1:8080 and terminate TLS there:

maestro.example.org {
    reverse_proxy 127.0.0.1:8080
}

• WebSocket: the UI uses /api/ws. Caddy and Traefik proxy upgrades automatically; nginx needs explicit headers:

  location / {
      proxy_pass http://127.0.0.1:8080;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
  }
  

• Cookies behind the proxy: set COOKIE_SECURE=true in Maestro's environment so both session cookies (maestro_access / maestro_refresh) are marked Secure.
• Host header: mutating requests carry an Origin/Referer CSRF check that compares hosts. A proxy that preserves Host works unchanged; if you rewrite the host, keep forwarding X-Forwarded-* and serve the UI on the same host you proxy to.