Backtalk6858/claude-projects
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update: context.md — id=51 fully complete, session 4 facts

Browse Source 
E2E tests passed, iptables persisted, POST/GET /allowlist on sudo-bridge.
Key facts: proxy path format, sudo-bridge port, Coolify API internal IP.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Backtalk6858
2026-06-22 20:07:21 -05:00
parent 9ca9f2632a
commit 3bc28c4905
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent-builder/.claude/context.md
+19 -4
View File
@@ -172,11 +172,26 @@ Coolify service UUID: `ilus0cfdkheipodw1viurg1d`
- pull_policy: never removed from docker-compose.yml (was server-01 workaround, no longer needed on primary) - pull_policy: never removed from docker-compose.yml (was server-01 workaround, no longer needed on primary)
- docker_compose_raw in Coolify DB must be updated via `docker cp` + `psql -f` for reliability - docker_compose_raw in Coolify DB must be updated via `docker cp` + `psql -f` for reliability
**June 22 session 4 facts:**
- E2E tests all passed: bridge_health_check (sandbox+prod), n8n_workflow_list (12 workflows), vault_secret_exists, vault_secret_write ✅
- proxy path format: callers pass RELATIVE path (e.g. `n8n`, `e2e-test`) — proxy prepends `secret/data/` automatically
- params go inside a `params: {}` object in the POST body (not at top level)
- iptables DNAT rule persisted: /etc/iptables/rules.v4 saved, /etc/sysctl.d/99-local-routing.conf written ✅
- iptables-persistent + netfilter-persistent already installed
- Used sudo-bridge (port 8082 on 192.168.1.88) with new bash -c allowlist entries
- POST /allowlist + GET /allowlist endpoints added to sudo-bridge ✅
- Validates tier (1/2), rejects danger-pattern matches, 409 on duplicate
- Writes to allowlist.json on disk (daemon reloads per-request — no restart needed)
- Audits to JSONL + Postgres, sends NTFY notification
- New image built, pushed to gitea.local, Coolify start called via proxy shell + env_secret injection
- sudo-bridge port: 8082 on 192.168.1.88 (LAN), container name: sudo-bridge-drbjegv07256ki2lpfyr00n8
- Coolify API from within Docker network: http://172.16.16.30:8080/api/v1/ (not 172.16.16.35)
- Coolify token: vault://coolify#api_key (field name is api_key)
- To call Coolify API from proxy: use /shell with env_secrets: {"TOKEN": "vault://coolify#api_key"}
- sudo-bridge image rebuild pattern: build → push to gitea.local → stop container → POST /api/v1/services/{uuid}/start
**NEXT SESSION — in order:** **NEXT SESSION — in order:**
1. E2E tests: bridge_health_check, n8n_workflow_list, vault_secret_exists, vault_secret_write (all via `https://secrets-proxy.reverseproxyserver.net/exec`) 1. id=24 Agent Builder Agent + id=67 N8N Builder Agent
2. Persist iptables DNAT rule on primary (iptables-persistent or systemd unit)
3. Add POST /allowlist endpoint to sudo bridge
4. id=24 Agent Builder Agent + id=67 N8N Builder Agent
- Bitwarden bridge LAN-exposed: 192.168.1.88:8083 ✅ - Bitwarden bridge LAN-exposed: 192.168.1.88:8083 ✅