Hypothesis test for the intermittent
"Fetch API cannot load … SubscribeEvents due to access control
checks" error visible to Safari users on https://www.galaxy.lan.
Server-side CORS headers are present and correct (verified live);
the browser reports 0 bytes received and the gateway sees the
stream context canceled after ~2 s. galaxy-caddy's reverse_proxy
log shows the same window: `error: reading: context canceled` with
sub-millisecond upstream duration on every retry. The EventStream
client treats the transport-level abort as a transient error and
reconnects with backoff, producing the tight open/close pattern
observed in `push_fanout.go` logs.
`flush_interval -1` disables Caddy's default response buffering
on the streaming path so the gateway's initial
`gateway.service_time` event reaches the browser without waiting
for a buffer flush. If Safari was canceling the stream because
no bytes landed within its fetch-streaming idle window, this
should stop the reconnect loop. To be verified on dev-deploy via
workflow_dispatch on this branch, no merge to `development` yet.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`api.galaxy.lan` was proxying every path to `galaxy-api:8080` (the
public REST listener), so authenticated Connect-Web calls
(`/galaxy.gateway.v1.EdgeGateway/ExecuteCommand`,
`/galaxy.gateway.v1.EdgeGateway/SubscribeEvents`) collapsed to a 404
from the public route table — the lobby loaded the static bundle
but every authenticated query failed silently.
Split routing by path: `/galaxy.gateway.v1.EdgeGateway/*` goes to
the authenticated listener on `:9090`, everything else stays on
`:8080`. Mirrors the Vite dev-server proxy in
`ui/frontend/vite.config.ts`.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
A docker-compose stack that hosts postgres, redis, mailpit, backend,
gateway, and an app-routing Caddy. Reachable through the host Caddy at
https://www.galaxy.lan (static SPA) and https://api.galaxy.lan (REST +
gRPC). Coexists with tools/local-dev/ and tools/local-ci/ by giving
every name (compose project, container, network, volume) a distinct
galaxy-dev-* prefix.
State is persisted in named volumes; game-state lives under
${GALAXY_DEV_GAME_STATE_DIR:-$HOME/.galaxy-dev/game-state} so the
default works for a non-root runner without sudo.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ilia Denisov