memory+journal: report STATUS round-2 — Gitea Anubis 307-challenges browser UAs; /pr/ proxy pins non-browser UA (cc-ci PR #38, deployed)
This commit is contained in:
@@ -31,6 +31,26 @@ handoff).
|
||||
|
||||
---
|
||||
|
||||
## Session 2026-09-14 ~16:45 UTC — opencode glm-5.3-flash (orchestrator) — round 2: Anubis UA
|
||||
|
||||
**Left off:** The real root cause turned out to be TWO independent layers; the mirror-privacy
|
||||
fix (earlier session entry today) was necessary but not sufficient. Operator's browser console
|
||||
showed CORS failures redirecting to `anubis.swarm.autonomic.zone/.within.website/?redir=…`.
|
||||
Reproduced exactly: the `/pr/` proxy forwards the END browser's User-Agent to Gitea; Gitea sits
|
||||
behind **Anubis**, which 307-challenges browser-like UAs to `anubis.swarm.autonomic.zone`
|
||||
(no CORS headers) → every fetch throws in the browser → all cells "?" (curl passed clean, which
|
||||
is why server-side checks and my earlier headless test never saw it — intermittent/rate-dependent
|
||||
for my playwright run). Fix: cc-ci **PR #38** adds
|
||||
`proxy_set_header User-Agent "ccci-reports-proxy/1.0";` to the reports.nix `/pr/` location.
|
||||
Hot-verified on the host by mount-swapping a fixed conf into the running task (one mis-step:
|
||||
`--mount-rm`+`--mount-add` same-target order wiped the mount; re-added), scoped live, all 16
|
||||
cells rendering with a real Chromium. Merged PR #38, `nix flake update cc-ci`,
|
||||
`nixos-rebuild test` → healthy (reports 200, no failed units) → `switch` (flake.lock commit
|
||||
9e7770f). Final verify: browser-UA curl 200 both gitea/9 + full headless-Chromium sweep 16/16
|
||||
OPEN, zero non-200 /pr fetches. Also flipped memory: `memory/gitea-anubis-ua-challenge.md` +
|
||||
MEMORY.md index.
|
||||
**Open:** nothing blocking; next weekly /recipe-report and STATUS live-checks carry the fix.
|
||||
|
||||
## Session 2026-09-14 ~15:00 UTC — opencode glm-5.3-flash (orchestrator)
|
||||
|
||||
**Left off:** Report STATUS column fix. Operator reported the week-2026-09-11 report's live
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
- [Push commits to remote](push-commits-to-remote.md) — push to git.autonomic.zone right after every commit in this repo
|
||||
- [Regression canary cadence](regression-canary-cadence.md) — server E2E canaries run on polish/review/release, not every commit
|
||||
- [Recipe-mirrors MUST be public](recipe-mirrors-public-org-blocker.md) — org public since ~2026-06, but /recipe-enroll created late mirrors (gitea, wordpress) private-from-birth, darkening report STATUS cells; flipped public + skill fixed 2026-09-14
|
||||
- [Gitea Anubis UA challenge](gitea-anubis-ua-challenge.md) — git.autonomic.zone 307-challenges browser UAs to an un-CORS-able origin; server-side proxies representing browser JS must pin a non-browser UA (cc-ci PR #38, 2026-09-14)
|
||||
- [abra chaos-deploy checkout gotcha](abra-chaos-deploy-checkout-gotcha.md) — `abra app new` moves recipe checkout to release tag; checkout PR branch after, or chaos deploys wrong tree
|
||||
- [Shared recipe-checkout race](shared-recipe-checkout-race.md) — never git-checkout ~/.abra/recipes/<recipe> on cc-ci while its CI build runs; harness deploys from that tree
|
||||
- [immich pgvecto.rs DROP DATABASE panic](immich-pgvectors-drop-database-panic.md) — DROP DATABASE crashes immich's postgres image; use pg_dump --clean --if-exists + search_path rewrite
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
name: gitea-anubis-ua-challenge
|
||||
description: "Gitea (git.autonomic.zone) sits behind Anubis, which 307-challenges browser-like User-Agents to an un-CORS-able counter-domain — any server-side proxy that forwards a browser UA on behalf of client JS breaks; pin a non-browser UA"
|
||||
metadata:
|
||||
node_type: memory
|
||||
type: project
|
||||
---
|
||||
|
||||
`git.autonomic.zone` sits behind **Anubis** (`anubis.swarm.autonomic.zone`). Anubis
|
||||
307-challenges requests whose User-Agent looks like a real browser to
|
||||
`/.within.website/?redir=…` — a JS proof-of-work challenge page on a *different* origin with
|
||||
**no CORS headers**.
|
||||
|
||||
Impact: any server-side proxy that serves client-side JS but forwards the *end browser's* UA
|
||||
hits this asymmetry — `curl` (non-browser UA) passes through cleanly, a real Firefox/Chrome UA
|
||||
gets the 307. Concretely: the Recipe Report's same-origin PR-STATUS proxy
|
||||
(`report./pr/<recipe>/<n>`, cc-ci `nix/modules/reports.nix`) forwarded the browser UA, so
|
||||
every live cell in the browser rendered `?` (week-2026-09-11, operator-CORS console report).
|
||||
|
||||
Fix (cc-ci PR #38, merged 2026-09-14): `proxy_set_header User-Agent "ccci-reports-proxy/1.0";`
|
||||
in the `/pr/` nginx location — a stable non-browser UA passes Anubis unmolested. Deployed via
|
||||
`nix flake update cc-ci` → `nixos-rebuild test` → health → `switch` (flake.lock commit).
|
||||
|
||||
Rule of thumb: server-side callers of the Gitea API (scripts, proxied fetches, harness code
|
||||
running in a browser's name) must pin a non-browser User-Agent or cookie-carry; browser-visit
|
||||
flows keep the JS challenge and that's fine. Related: [[recipe-mirrors-public-org-blocker]].
|
||||
Reference in New Issue
Block a user