2 Commits

Author	SHA1	Message	Date
Ilia Denisov	cb8491c200	feat(dev-deploy): one /_gm gate for console + Grafana + Mailpit ... Consolidate the operator console and the observability / captured-mail UIs behind a single Basic Auth gate, so one password (the admin-console account, dev: gm/gm-dev-password) unlocks all three, with links in the console nav: - Caddyfile.dev: a single basic_auth on /_gm/* fronts nested routes — /_gm/grafana/ -> Grafana, /_gm/mailpit/ -> Mailpit, catch-all -> the gateway/backend console. Caddy forwards the same Authorization header, which the backend console also accepts, so there is one prompt. The former top-level /grafana/ and /mailpit/ routes are removed. - Grafana: served under /_gm/grafana/ (sub-path) as anonymous Admin with the login form and basic auth disabled, so it relies solely on the /_gm gate and ignores the forwarded credentials. - Mailpit: MP_WEBROOT=/_gm/mailpit (and the healthcheck path) so its UI lives under the gate. - Operator console: add Grafana and Mailpit links to the nav.	2026-06-01 06:30:15 +02:00
Ilia Denisov	27916bbe61	feat(admin-console): Stage 1 — pipe + skeleton behind the gateway ... Add the server-rendered operator console at /_gm, exposed publicly through the gateway behind the existing admin_accounts Basic Auth. Backend: - new internal/adminconsole package (html/template Renderer, stateless HMAC CSRF signer, embedded stylesheet) - /_gm route group reusing basicauth.Middleware(admin.Service) + a CSRF guard (per-operator token + same-origin check); dashboard landing page - BACKEND_ADMIN_CONSOLE_CSRF_KEY config (per-process random fallback) Gateway: - new "admin" public route class (per-IP rate limit, body + GET/HEAD/POST method limits) classifying /_gm traffic - reverse proxy to the backend /_gm surface, preserving Host and relaying the backend 401 Basic Auth challenge; 502 when the backend is unreachable - GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_ADMIN_* config dev-deploy: - Caddy routes /_gm/* to the gateway - bootstrap admin + stable CSRF key; enable Prometheus /metrics exporters on backend and gateway (forward-compat for a future Prometheus/Grafana stack) Docs: ARCHITECTURE 14.1/16, FUNCTIONAL 10.2.1 (+ru mirror), backend and gateway READMEs, new backend/docs/admin-console.md. Tests: renderer + CSRF unit tests; backend router auth/render/asset/CSRF; gateway classifier, proxy forwarding/Host/401/405/413/429/502.	2026-05-31 19:50:15 +02:00