mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 12:43:16 +00:00
fcbdfb67aa
AppService construct wires the per-env EC2 box and its internet path. The
seahaven-vpc and the internet-facing seahaven-com ALB are SHARED with the
on-prem seahaven-site stack, so everything VPC/ALB/zone-side is IMPORTED and
never owned/mutated; open-swe only ADDS its own resources.
Per env (open-swe-stack.ts → AppService):
- ARM64 EC2 box (t4g.medium dev / t4g.large prod) in private1 (us-east-1a,
in-AZ NAT egress). requireImdsv2, gp3-encrypted root, deleteOnTermination
(no RETAIN volume — replacement-tolerant; see ami-cache.ts).
userDataCausesReplacement; user-data rendered from deploy/ami/user-data.sh.
- Standalone instance SG: ingress ONLY from the shared ALB SG on :80; egress
via NAT. The ALB SG is opened to the box via a STANDALONE CfnSecurityGroupEgress
(the imported, on-prem-owned SG is never mutated).
- Target group → instance:80 (nginx is sole ingress; LangGraph :2024 stays
loopback). Health check GET /healthz.
- Two rules on the imported :443 listener, both → the TG:
* webhooks (priority 2 dev / 3 prod): host∈{openswe,hooks}-<env> AND /webhooks/*
* site (priority 10 dev / 11 prod): host=openswe-<env> (dashboard SPA + api)
Webhooks MUST sit below the on-prem host-agnostic /webhooks/* rule (priority 5)
or it would steal every webhook — first-match-by-ascending-priority.
- Route53 alias records (openswe[-dev] + hooks[-dev]) → shared ALB.
- 4 CloudWatch log groups at 30-day retention (IaC-owned; mirrors CW-agent config).
Security (/sh-security-review T12): iac-iam pass clean. Logic pass → 1 confirmed
medium fixed (OSWE-T12-01: nginx 1MB default client_max_body_size would 413 large
GitHub webhooks pre-signature-verification → set 25m on /webhooks/, 10m on
/dashboard/api/); hooks host scoped to /webhooks/* only (OSWE-T12-02 hygiene);
XFF-spoof candidate killed (no code trusts leftmost XFF). No confirmed
critical/high.
Synth-only; not deployed. AMI is the cdk.context.json placeholder until the baked
open-swe-base-arm64 id is pinned pre-deploy. tsc/synth(dev+prod)/jest(16) clean.
Next: T13 GPT-4.1 cross-review of the SG/listener diff before any deploy.
62 lines
2.7 KiB
Text
62 lines
2.7 KiB
Text
# Open SWE dashboard frontend (TanStack Start SPA) + scoped API proxy.
|
|
# TEMPLATE: tokens (@@...@@) are rendered at first boot by user-data.sh.
|
|
#
|
|
# nginx is the SOLE ingress and security boundary (T5 OSWE-IAC-03): the backend
|
|
# binds 127.0.0.1:2024 and is NOT network-reachable. nginx proxies exactly two
|
|
# prefixes to it — /dashboard/api/* and /webhooks/* — and nothing else. The
|
|
# unauthenticated LangGraph agent API (/threads, /runs, /assistants, /store) is
|
|
# NEVER proxied; those paths return the SPA shell.
|
|
#
|
|
# Both ALB target groups (dashboard host + hooks host) point at this nginx :80,
|
|
# not at :2024 directly, so there is no path to the raw control plane even from
|
|
# inside the SG. Webhook signature verification still happens in the app (the raw
|
|
# body + GitHub/Slack/Linear signature headers are passed through unmodified).
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
server_name @@SERVER_NAME@@;
|
|
|
|
root @@WWW_ROOT@@;
|
|
index _shell.html;
|
|
|
|
# ALB target-group health check (dashboard TG).
|
|
location = /healthz { default_type text/plain; return 200 "ok\n"; }
|
|
|
|
# Dashboard API + OAuth callback -> backend webapp.
|
|
location /dashboard/api/ {
|
|
proxy_pass http://@@BACKEND_ADDR@@;
|
|
proxy_http_version 1.1;
|
|
client_max_body_size 10m;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 300s;
|
|
}
|
|
|
|
# Inbound webhooks (GitHub/Slack/Linear) -> backend webapp. Routed through
|
|
# nginx so :2024 stays loopback-only (T5 OSWE-IAC-03). The raw request body +
|
|
# signature headers pass through unmodified for in-app signature verification.
|
|
location /webhooks/ {
|
|
proxy_pass http://@@BACKEND_ADDR@@;
|
|
proxy_http_version 1.1;
|
|
# GitHub permits webhook payloads up to 25 MB; nginx's 1 MB default would
|
|
# 413 large push/PR events at the edge BEFORE in-app signature verification
|
|
# runs, silently dropping them (OSWE-T12-01). proxy_request_buffering off
|
|
# does not relax the size cap — set it explicitly.
|
|
client_max_body_size 25m;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_request_buffering off;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
|
|
# Static assets + SPA shell fallback (client-side routing).
|
|
location / {
|
|
try_files $uri $uri/ /_shell.html;
|
|
}
|
|
}
|