Repository navigation
Split Apptainer/Podman into distinct Fileglancer apps; standard security vs. E2E HTTPS - #25
Merged
Merged
Conversation
…rypted Lists the plain-per-job-token runnables first as the normal, standard- security tier (renamed away from "HTTP, testing"), and reframes the TLS runnables around end-to-end encryption to the compute node, recommending personal-certificate-authority and opting out of Fileglancer's own HTTPS-rewriting proxy (service_proxy: false, JaneliaSciComp/fileglancer#445) so it doesn't undermine that claim. Adds a standard-security tier to the Web Terminal app too (previously HTTPS-only): container/terminal-wrap.sh gains --no-tls, which keeps Caddy in front of ttyd for the Basic Auth check (per #23) but drops the TLS directive from its Caddyfile. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…o E2E HTTPS Marimo AI Sandbox and Web Terminal AI Sandbox each become two apps -- one per backend -- instead of bundling both backends' runnables into a single manifest, the same way the web terminal was already split out from Marimo. Podman is the default backend, so it keeps the existing top-level manifest path (runnables.yaml, terminal/runnables.yaml); Apptainer moves to a new sibling manifest (marimo-apptainer/runnables.yaml, terminal-apptainer/runnables.yaml). Each app's manifest-level `requirements:` now matches its backend instead of unconditionally requiring apptainer. Also renames the E2E runnables' `name:` field from "... HTTPS" to "... E2E HTTPS" for clarity against the standard-security tier. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
mkitti
changed the title
fileglancer#448 (not yet merged) is what lets Fileglancer's optional service proxy (apps.service_proxy_domain) propagate HTTP Basic Auth userinfo through to the browser-facing URL. Until it merges, the proxy rejects (403) any published service_url carrying userinfo at all, so the standard-security "terminal" runnable (--no-tls, service_proxy left at its default true) can't safely embed its Basic Auth credential in the URL the way "terminal-https" does -- that one sets service_proxy: false, so it's never proxied in the first place. container/terminal-wrap.sh now publishes a bare URL (no credential) for the --no-tls path, and prints the username/password on both stdout and stderr for the user to enter manually. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Four distinct Fileglancer apps, not two: Apptainer and Podman are now separate app manifests for both Marimo and the Web Terminal, the same way the web terminal was already split out from Marimo. Podman is the default backend (keeps the existing top-level manifest paths,
runnables.yaml/terminal/runnables.yaml); Apptainer moves to new sibling manifests (marimo-apptainer/runnables.yaml,terminal-apptainer/runnables.yaml).runnables.yamlmarimo-apptainer/runnables.yamlterminal/runnables.yamlterminal-apptainer/runnables.yamlEach app's manifest-level
requirements:now matches its own backend ([pixi]for Podman apps,[apptainer, pixi]for Apptainer apps) instead of unconditionally requiringapptainer; the Podman-only--keep-idparameter only appears on Podman apps.Lists the plain-per-job-token runnable first in every app (renamed away from "HTTP, testing" to just Fileglancer's standard security).
Renames the E2E runnables'
name:field from "... HTTPS" to "... E2E HTTPS", and reframes theirdescription:around end-to-end encryption to the compute node, recommendingpersonal-certificate-authorityfor a trusted cert.Adds
service_proxy: falseto all E2E runnables per fileglancer#445, so Fileglancer's own HTTPS-rewriting proxy doesn't silently undermine the end-to-end claim by terminating TLS at its own nginx instead of this job's Caddy.Adds a standard-security tier to the Web Terminal apps (previously HTTPS-only):
container/terminal-wrap.shgains--no-tls, keeping Caddy in front of ttyd for the Basic Auth check but dropping thetlsdirective from its Caddyfile.Shortens all app-level and per-runnable
description:fields.Updates
README.mdthroughout (layout table, a new "Four Fileglancer apps" overview section, renamed HTTPS section, Web Terminal section -- including fixing a stale claim there that predated Stop exposing service tokens via process command-line arguments #23 about ttyd's own Basic Auth).Builds on #22/#23/#24, already merged to
main.Test plan
bash -non all modified shell scriptsrunnables.yamlmanifests validated against fileglancer's actualAppManifest/AppEntryPointpydantic rules (requirementsagainstSUPPORTED_TOOLS,service_proxy/auto_url/service_url_suffixconstraints) -- confirmed by readingfileglancer/model.pydirectly, not just guessing the schemapixi.tomlparses as valid TOMLcaddybinary and confirmedcaddy_start/caddy_start --httpproduce the expected Caddyfile (TLS directive present/absent,basic_auth/reverse_proxyblocks identical otherwise)🤖 Generated with Claude Code