mirror of
https://github.com/stablyai/orca.git
synced 2026-11-15 10:27:33 +00:00
Neil
d3e6f3270f
Ports the edge halves of two release-branch changes onto main, which production
edge deploys come from (prod edge = ba3f991):
- Ingress mode (#41986): signed ingress header (INGRESS_SECRETS) and token mode
for a cloud load balancer (INGRESS_TOKENS secret, INGRESS_ORIGINS,
INGRESS_SOURCE_CIDRS). All or nothing: a partial or malformed setup turns the
mode off and logs relay_edge_ingress_config_invalid; it never throws. Requests
from the configured egress ranges that fail the trust rule get 403. Admin calls
are matched first. Adds cloud/apps/relay-ingress (stateless proxy) and the
relay-contract ingress-header module.
- POST /__admin/verify (#42538, edge half): the director's check for a phone
resume token or invite that exists only on the edge. Hash only, read-only: an
object that never held the host (or no longer holds it here) answers not_here
before anything is written; otherwise the token's jti is its only write.
Replay and jti_full are 409. Adds hash-input variants to RelayCredentialStore
(shared with the edge; existing methods delegate, behaviour unchanged).
Kept from main: drain, single-use admin tokens (jti), signing-key rotation,
JWKS-outage tolerance, keepalive auto-response, health probe. The place label
keeps main's '<continent>/<colo>' and, only behind a verified ingress, appends
'/<country>/<ingress name>'.
No user effect until the ingress vars/secret are set or the director calls verify.