feat(hosted): serve the deployment-test phone page from the stack origin - #439
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
35bbe33 to
7632080
Compare
The phone page for remote access is published to a private S3 bucket and served by the existing CloudFront distribution under /remote/ with a strict Content-Security-Policy, so the page, the browser binding worker, the witness gateway, and the relay share one origin. remote-page.sh builds the page and the deployment-test browser binding pinned to this stack's witness trust and uploads them; remote-config.sh writes the daemon's remote configuration. Signed-off-by: Lokesh <lokeshselvam7025@gmail.com>
Signed-off-by: Lokesh <lokeshselvam7025@gmail.com>
7632080 to
fbc74a8
Compare
1 participant
Summary
Stacked on #434. Review only the top two commits:
feat(hosted): serve the deployment-test phone page from the stack origindocs(hosted): describe scanning the pairing code and unsafe daemonsThe deployment-test distribution serves the phone page for
/remoteunder/remote/. The page, the browser binding's worker, the control plane, the witness, and the relay then share one origin./remote*behaviour (GET and HEAD, caching disabled). A CloudFront function redirects/remoteto/remote/and maps directory paths toindex.html.default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self'; connect-src 'self'; style-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'DENYframing, no referrer, HSTS,no-store, and COOPremote-page.shbuilds the browser binding with this stack's witness trust, builds the page, and publishes it with explicit content types.remote-config.shwrites a daemon's owner-only remote config from the stack secret.remote_page_url,remote_page_bucket.Test plan
terraform applyon the deployment-test stack: 8 added, 1 changed, 0 destroyedhttps://<distribution>/remote/with the headers above. It loads its module, worker, and WebAssembly under the CSP.