Backtalk6858/claude-projects
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update: context.md + session summary — proxy migration to primary, iptables LAN fix

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Backtalk6858
2026-06-22 16:09:56 -05:00
parent 8d23962c13
commit e7c6db19d7
1 changed files with 21 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent-builder/.claude/context.md
+21 -10
View File
@@ -154,16 +154,27 @@ All sandbox prereqs done. Sandbox mirrors production.
- n8n_agent_worker postgres role — api_business DB, scoped to automation_ideas + agent_test_results - n8n_agent_worker postgres role — api_business DB, scoped to automation_ideas + agent_test_results
- Credential in production Vault: secret/postgres/n8n-agent-worker - Credential in production Vault: secret/postgres/n8n-agent-worker
### id=51 — DEPLOYED but NOT COMPLETE (June 22) ### id=51 — MIGRATING TO PRIMARY (June 22 session 2)
- Container: secrets-proxy-lv3xeu2manuimle458wbm9u9 on server-01, Coolify UUID: lv3xeu2manuimle458wbm9u9 **Decision: move proxy from server-01 → primary server.** Reasons: security infrastructure (not a test workload), Claude Code runs on primary, all deps (Vault, bridge, N8N, ntfy) already local. Cloudflare route stays `http://coolify-proxy:80`.
- Working: n8n_workflow_list ✅, vault_secret_exists ✅
- PENDING before builder agents: **June 22 session 2 facts:**
1. Redeploy with latest image (bridge_health_check fix already in app.py + pushed to gitea.local) - gitea.local pulls from server-01 now work: iptables DNAT rule applied on primary (192.168.1.88:80 → 127.0.0.1:80 via enp1s0 route_localnet=1) — NOT persisted across reboot yet (needs iptables-persistent or systemd unit)
2. User adds Cloudflare route: secrets-proxy.reverseproxyserver.net → http://coolify-proxy:80 - Cloudflare route `secrets-proxy.reverseproxyserver.net` already exists but pointed to primary's coolify-proxy which doesn't know about server-01 container — confirms proxy should be on primary
3. Add `192.168.1.88 gitea.local` to /etc/hosts on server-01 - Coolify API: secrets-proxy is a SERVICE type (not application) — use /api/v1/services endpoint
4. E2E test: bridge_health_check, bitwarden_item_exists, vault_secret_write - Server-01 service UUID: lv3xeu2manuimle458wbm9u9 (to be stopped/deleted after migration)
- Caller keys in Vault at secret/proxy/callers; claude-code key: 0ce8c396...591e9 - Image at gitea.local/backtalk6858/secrets-proxy:latest (digest sha256:5bf92d2e...) — bridge_health_check fix included
- Bitwarden bridge now LAN-exposed: 192.168.1.88:8083 - Caller keys: claude-code: 0ce8c396...591e9, agent-builder-agent: 473d9e1f...3573, n8n-builder-agent: 233e6aa9...cb
**NEXT SESSION — in order:**
1. Stop/delete secrets-proxy service on server-01 (Coolify UUID lv3xeu2manuimle458wbm9u9)
2. Deploy secrets-proxy on primary via Coolify (same docker-compose.yml, Traefik labels, coolify network)
3. Cloudflare route already correct (http://coolify-proxy:80) — no change needed
4. Full E2E test: bridge_health_check, bitwarden_item_exists, n8n_workflow_list, vault_secret_write
5. Persist iptables DNAT rule on primary (iptables-persistent or systemd unit) — so server-01 can always pull from gitea.local
6. Add sudo-bridge allowlist management endpoint (POST /allowlist) — gap discovered this session
7. id=24 Agent Builder Agent + id=67 N8N Builder Agent
- Bitwarden bridge LAN-exposed: 192.168.1.88:8083 ✅
### June 21 session 2 facts for next session: ### June 21 session 2 facts for next session:
- server-01 Coolify UUID: hvzbj1gkqb5696s7cc9lcf8y - server-01 Coolify UUID: hvzbj1gkqb5696s7cc9lcf8y