Files

T

jcoffey-dev e8b6a8bc2e Answer 404 for unrouted paths, and keep the route lists honest

web/nginx.conf ended its try_files chain in an unconditional /200.html, so
every path the site does not have -- /wp-login.php, /.env, a typo'd inbound
link -- came back as the SPA shell with a success status. It now answers 404,
which needs nginx to know which routes exist: most it infers from the build
output, but dynamic routes and ones that never opted into prerendering have no
file on disk and are listed by hand.

Those hand-maintained lists drift, and the drift is invisible until it ships:
vite dev and npm run preview route from the client manifest and never read
nginx.conf, so a new dynamic route works everywhere a developer would look and
404s in production. hack/check-web-routes.sh compares the lists against
web/src/routes, and a workflow runs it. Its own workflow rather than another
job on license-compliance.yml, which already carries one unrelated check.

Also turns absolute_redirect off. With nginx's default the trailing-slash
canonicaliser reconstructs the origin from its own listen port, so a request
for https://demo.cairnobs.org/settings/ was answered with
Location: http://127.0.0.1:3000/settings -- the container's internal address,
unreachable from the client, and downgraded to http on the way. Verified by
curl against the built image; it was latent here before the canonicaliser
existed too, through the directory redirect on /dev.

2026-08-28 15:55:28 -07:00

2.0 KiB

Raw Blame History

hack

Local developer tooling that isn't part of any shipped component — scripts you run against your own machine/dev stack, not code that ends up in a container image (except dev-certs' output, which mounts into the ingest container).

Not one of the top-level directories in the original monorepo scaffold — added because dev-only mTLS cert generation didn't have a natural home in /deploy (real deployment manifests), /transport, or any other existing component. /hack is the conventional name for this in a lot of larger Go monorepos (Kubernetes among them).

dev-certs/ — generates a throwaway CA + server/client cert pair for local mTLS between the agent and ingest. See /docs/phase-0-runbook.md for when to run it.
windows-fixture/ — sends synthetic Windows Event Log-shaped records directly to ingest, bypassing the real Windows agent. Tests whether the pipeline handles Windows-shaped data; doesn't test the real EvtSubscribe/ETW integration, which needs actual Windows. See /docs/phase-1-runbook.md.
demo-simulator/ — the public demo's synthetic world: a fictional fleet whose agents check in, report CPU/memory/disk, and ship realistically shaped logs for eight services. Backfills a window of history, then keeps generating in real time. Distinct from benchmark-fixture/ (volume, for the Phase 2 latency benchmark) and windows-fixture/ (correctness, for the Windows ingest path).
check-web-routes.sh — asserts web/nginx.conf's hand-maintained route allowlists still match web/src/routes. nginx.conf 404s unknown paths, so it has to name the routes that have no prerendered file to match (dynamic ones, and any route without prerender = true). Drift here breaks production only — dev and npm run preview never read nginx.conf — so this runs in CI, like check-tenant-boundary.sh.
demo-seed/ — the rest of the demo deployment: its reset script, dashboards, alert rules, and the systemd unit that runs demo-simulator.

2.0 KiB Raw Blame History

hack

2.0 KiB

Raw Blame History