From 3bc28c49055efb52a875d153127fcdb07d33d168 Mon Sep 17 00:00:00 2001 From: Backtalk6858 Date: Mon, 22 Jun 2026 20:07:21 -0500 Subject: [PATCH] =?UTF-8?q?update:=20context.md=20=E2=80=94=20id=3D51=20fu?= =?UTF-8?q?lly=20complete,=20session=204=20facts?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit E2E tests passed, iptables persisted, POST/GET /allowlist on sudo-bridge. Key facts: proxy path format, sudo-bridge port, Coolify API internal IP. Co-Authored-By: Claude Sonnet 4.6 --- agent-builder/.claude/context.md | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/agent-builder/.claude/context.md b/agent-builder/.claude/context.md index 868d16b..8df526f 100644 --- a/agent-builder/.claude/context.md +++ b/agent-builder/.claude/context.md @@ -172,11 +172,26 @@ Coolify service UUID: `ilus0cfdkheipodw1viurg1d` - pull_policy: never removed from docker-compose.yml (was server-01 workaround, no longer needed on primary) - docker_compose_raw in Coolify DB must be updated via `docker cp` + `psql -f` for reliability +**June 22 session 4 facts:** +- E2E tests all passed: bridge_health_check (sandbox+prod), n8n_workflow_list (12 workflows), vault_secret_exists, vault_secret_write ✅ +- proxy path format: callers pass RELATIVE path (e.g. `n8n`, `e2e-test`) — proxy prepends `secret/data/` automatically +- params go inside a `params: {}` object in the POST body (not at top level) +- iptables DNAT rule persisted: /etc/iptables/rules.v4 saved, /etc/sysctl.d/99-local-routing.conf written ✅ + - iptables-persistent + netfilter-persistent already installed + - Used sudo-bridge (port 8082 on 192.168.1.88) with new bash -c allowlist entries +- POST /allowlist + GET /allowlist endpoints added to sudo-bridge ✅ + - Validates tier (1/2), rejects danger-pattern matches, 409 on duplicate + - Writes to allowlist.json on disk (daemon reloads per-request — no restart needed) + - Audits to JSONL + Postgres, sends NTFY notification + - New image built, pushed to gitea.local, Coolify start called via proxy shell + env_secret injection +- sudo-bridge port: 8082 on 192.168.1.88 (LAN), container name: sudo-bridge-drbjegv07256ki2lpfyr00n8 +- Coolify API from within Docker network: http://172.16.16.30:8080/api/v1/ (not 172.16.16.35) +- Coolify token: vault://coolify#api_key (field name is api_key) +- To call Coolify API from proxy: use /shell with env_secrets: {"TOKEN": "vault://coolify#api_key"} +- sudo-bridge image rebuild pattern: build → push to gitea.local → stop container → POST /api/v1/services/{uuid}/start + **NEXT SESSION — in order:** -1. E2E tests: bridge_health_check, n8n_workflow_list, vault_secret_exists, vault_secret_write (all via `https://secrets-proxy.reverseproxyserver.net/exec`) -2. Persist iptables DNAT rule on primary (iptables-persistent or systemd unit) -3. Add POST /allowlist endpoint to sudo bridge -4. id=24 Agent Builder Agent + id=67 N8N Builder Agent +1. id=24 Agent Builder Agent + id=67 N8N Builder Agent - Bitwarden bridge LAN-exposed: 192.168.1.88:8083 ✅