Task 9d121e76: Reverse proxy and TLS for the API #214

2026-09-24T07:57:09-04:00

dev_agent commented

2026-09-24 07:57:09 -04:00

Maestro task: 9d121e76-e1ce-479f-aef5-0e5e9756fda8 (Feature 17).

Done condition: TLS reverse proxy for https://nestquest.cubecraftlabs.com proxying to the containerized API; proven by an external /health 200 over trusted TLS.

Owner-provided infra (not changed here): Traefik v3.6 on nukapi-03 with the nestquest-ccl.yml routers + Cloudflare DNS-01 ACME resolver. This task binds the API to 10.60.1.14:8080 (where Traefik points) and deploys it.

Head: 3321a70ffd
Base: feature/911b11a7-... @ 859737f

Verified externally: /health 200 over trusted TLS, HTTP->HTTPS 308, /docs + /openapi.json 200, panel route 403 externally (Traefik allow-list). Container healthy, non-root (nestquest), DB on the named volume.

Maestro task: 9d121e76-e1ce-479f-aef5-0e5e9756fda8 (Feature 17). Done condition: TLS reverse proxy for https://nestquest.cubecraftlabs.com proxying to the containerized API; proven by an external /health 200 over trusted TLS. Owner-provided infra (not changed here): Traefik v3.6 on nukapi-03 with the nestquest-ccl.yml routers + Cloudflare DNS-01 ACME resolver. This task binds the API to 10.60.1.14:8080 (where Traefik points) and deploys it. Head: 3321a70ffd06ed06c4fa666de30b89700da8cdf9 Base: feature/911b11a7-... @ 859737f Verified externally: /health 200 over trusted TLS, HTTP->HTTPS 308, /docs + /openapi.json 200, panel route 403 externally (Traefik allow-list). Container healthy, non-root (nestquest), DB on the named volume.

dev_agent added 16 commits 2026-09-24 07:57:10 -04:00

Add the re-imagined architecture document 10f365ef9f

Merge pull request 'Add the re-imagined architecture document' (#140 ) from docs/architecture-reimagining into main 0972761994

Reviewed-on: #140

Automatically prepare releases for completed features (#182 ) 415ababc8e

Co-authored-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>
Co-committed-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>

Make the missed-sweep watermark claim safe across processes (#184 ) 70ee4ec111

Co-authored-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>
Co-committed-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>

merge: origin/main into 0.6.0 release (bring the architecture doc; keep dev versions and notes) c57d950101

release: advance version to 0.6.0 and add the re-imagined architecture release notes 0ed35ab85a

release: correct the 0.6.0 notes - no containerization artifacts ship in this release 8676bdc6ad

Merge pull request 'Release: Re-imagined architecture - Features 15, 16, 18, 20 (2026-09-23)' (#185 ) from release/2026-09-23-reimagining into main 939556a38a

Reviewed-on: #185
Reviewed-by: The Reviewer <18+review_agent@code.cubecraftcreations.com>

Merge pull request 'Reconcile dev from main (release 0.6.0 commits)' (#186 ) from main into dev 22f1a6861d

Feature 21: Admin Today Snapshot API (#190 ) (#191 ) a808f89993

Co-authored-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>
Co-committed-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>

Feature 22: Admin Definitions Read and skip_on_away (#193 , #194 ) (#195 ) 42ea5710d7

Co-authored-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>
Co-committed-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>

Feature 22 follow-up: Editable definition assignees (#196 ) (#197 ) 4b39af4b67

Co-authored-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>
Co-committed-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>

Feature 23: Admin API Completion - preview, presence, live (#199-#202) (#203 ) b8532bacde

Co-authored-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>
Co-committed-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>

Feature 19: Admin PWA (#187-#210) (#211 ) fe44740450

Co-authored-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>
Co-committed-by: dev_agent <17+dev_agent@code.cubecraftcreations.com>

Merge dev into feature/911b11a7 (Features 19, 21-23) 859737faec

Bind the API port to a configurable LAN address for the reverse proxy 3321a70ffd

Publish port 8080 on ${NESTQUEST_BIND_ADDRESS:-127.0.0.1} so the shared
Traefik proxy (TLS for nestquest.cubecraftlabs.com) can reach the API
box, while an unconfigured deployment stays localhost-only. Document the
variable in deploy/.env.example and the production topology in
api/README.md.

Maestro task 9d121e76-e1ce-479f-aef5-0e5e9756fda8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-09-24 07:58:02 -04:00

review_agent left a comment

Independent Codex gpt-5.6-terra review completed for this exact commit.

dev_agent merged commit f6d222764c into feature/911b11a7-bdbb-4305-86f6-d666e181ed51-api-deployment-and-identity

2026-09-24 08:00:05 -04:00

dev_agent referenced this pull request

2026-09-24 09:32:57 -04:00

Feature 17: API Deployment and Identity #217

Sign in to join this conversation.