From 16c4bba3bd3d963edc08959580903a41cfe03f6f Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 27 Aug 2026 15:44:47 +1000 Subject: [PATCH] Mark cube.yokogawa.tech as the hostname nothing depends on Kept, but labelled. ai-api reaches Cube as cube:4000 over the proxy network and never by name, and the operator UI never touches Cube - the hostname exists so an engineer can open the playground to hand-verify a measure, which a tunnel does equally well. So it is the first one to drop if this host is being tidied or the name is wanted elsewhere. The note is in three places because whoever tidies this host will be reading one of them and not this repo: above the block in ~/Caddyfile, inline on the Authelia rule, and here. Co-Authored-By: Claude Opus 5 --- authelia/access-rules.md | 11 ++++++++++- caddy/ai-routes.caddy | 8 ++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/authelia/access-rules.md b/authelia/access-rules.md index 973dd9d..df886ce 100644 --- a/authelia/access-rules.md +++ b/authelia/access-rules.md @@ -14,7 +14,7 @@ Four hostnames join the existing `HTTPS_UserAccess` `two_factor` rule in | Hostname | Phase | Serves | |---|---|---| | `lf.yokogawa.tech` | 2 | Langfuse — traces, prompts, eval runs | -| `cube.yokogawa.tech` | 5 | Cube semantic layer, playground and REST API | +| `cube.yokogawa.tech` | 5 | Cube semantic layer, playground and REST API — **not essential**, see below | | `api.yokogawa.tech` | 6 | `ai-api` FastAPI | | `ai.yokogawa.tech` | 7 | `ai-web` operator UI | @@ -43,6 +43,15 @@ Add each hostname at the phase that needs it. Every domain added here must also have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and every Caddyfile block must have a rule here. One without the other is a hole. +**`cube.yokogawa.tech` is the one to drop first** if the host is being tidied or the +hostname is wanted for something else. Nothing depends on it — `ai-api` reaches Cube as +`cube:4000` over the proxy network and never by name, and the operator UI never touches +Cube. It exists so an engineer can open the playground to hand-verify a measure, which an +SSH tunnel does equally well. Removing it means deleting the Caddy block **and** this +domain; batch that with an Authelia restart that is happening anyway rather than spending +an all-user logout on it. The same note is on the host, in `~/Caddyfile` above the block +and inline on this rule. + **Applied on lin001:** `lf` on 2026-08-20; `cube`, `api` and `ai` on 2026-08-27, in one Authelia restart. Backup `~/authelia/configuration.yml.bak-ai-20260827`. All four now return 302 to the diff --git a/caddy/ai-routes.caddy b/caddy/ai-routes.caddy index 22e6e3d..76a216f 100644 --- a/caddy/ai-routes.caddy +++ b/caddy/ai-routes.caddy @@ -53,6 +53,14 @@ lf.yokogawa.tech { } # --- Phase 5 ----------------------------------------------------------------- +# NOT ESSENTIAL. Nothing depends on this hostname: ai-api reaches Cube over the +# proxy network as cube:4000 and never by name, and the operator's screen never +# touches Cube at all. It exists so an engineer can open Cube's playground to +# hand-verify a measure - an SSH tunnel does the same job. If this host is being +# tidied, or a name is wanted for something else, drop this one first. Removing +# it means deleting this block AND the domain from the Authelia rule; batch that +# with an Authelia restart that is happening anyway, rather than spending an +# all-user logout on it. cube.yokogawa.tech { import authelia reverse_proxy cube:4000