feat(local): run the anonymous surface with no WAF captcha #6

Merged

picklemustard merged 2 commits from fix/nuget-cli-home into main 2026-09-11 22:41:51 +00:00

Conversation 0 Commits 2 Files changed 6 +331 -59

picklemustard commented 2026-09-11 22:36:10 +00:00

Owner

Copy link

The local overlay turned the anonymous surface off entirely, so
verification, the Redis-backed enforcement counters and the ban path went
untested locally and development against them was blocked.

Turn it on with captcha.provider "none". The real challenge is AWS WAF's
CAPTCHA action in front of POST /api/v1/verify/mint, and there is no
CloudFront in front of a k3d cluster; under "none" challengeView returns
nil, so GET /api/v1/human-session omits the challenge key and the frontend
never loads the awswaf.com SDK or holds a token. No Go source change: the
escape hatch already existed.

That combination is legal only with no edge secret set -- RequireCaptcha
treats provider "none" and an edge secret as a matched pair -- so edge.secret
stays empty and the README says not to create a gbb-edge Secret. The sealing
key comes from a gbb-captcha Secret the base StatefulSet already projects
with optional: true, rather than inline, since a ConfigMap is not a secret.

The https GBB_PUBLIC_ORIGIN check and the Secure, __Host- prefixed cookies
are satisfied without touching code: TLS terminates at the edge Traefik, so
the browser is on https and only the inward hop is plain HTTP. For the same
reason auth.cookie_secure goes back to true and the ingress keeps the web
entrypoint.

Redis becomes a hard requirement, pointed at the same instance and db the
gateway already uses -- the gateway revokes sessions by deleting keys the
server wrote, and split instances fail silently.

GBB_ADMIN_GROUP is mandatory under captcha.enabled and is not inert: it
switches requireAdmin to Authelia forward-auth and retires POST
/api/v1/session and the admin token routes, and POST /api/v1/builds moves
behind requireVerified. Documented rather than worked around.

TestLocalOverlayConfigMapParses supplies the key via t.Setenv, matching how
it already handles the Secret-supplied DSN, and now pins provider "none", an
absent edge secret and both Require gates so the overlay cannot drift into
the combination that refuses at startup.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

The local overlay turned the anonymous surface off entirely, so verification, the Redis-backed enforcement counters and the ban path went untested locally and development against them was blocked. Turn it on with captcha.provider "none". The real challenge is AWS WAF's CAPTCHA action in front of POST /api/v1/verify/mint, and there is no CloudFront in front of a k3d cluster; under "none" challengeView returns nil, so GET /api/v1/human-session omits the challenge key and the frontend never loads the awswaf.com SDK or holds a token. No Go source change: the escape hatch already existed. That combination is legal only with no edge secret set -- RequireCaptcha treats provider "none" and an edge secret as a matched pair -- so edge.secret stays empty and the README says not to create a gbb-edge Secret. The sealing key comes from a gbb-captcha Secret the base StatefulSet already projects with optional: true, rather than inline, since a ConfigMap is not a secret. The https GBB_PUBLIC_ORIGIN check and the Secure, __Host- prefixed cookies are satisfied without touching code: TLS terminates at the edge Traefik, so the browser is on https and only the inward hop is plain HTTP. For the same reason auth.cookie_secure goes back to true and the ingress keeps the web entrypoint. Redis becomes a hard requirement, pointed at the same instance and db the gateway already uses -- the gateway revokes sessions by deleting keys the server wrote, and split instances fail silently. GBB_ADMIN_GROUP is mandatory under captcha.enabled and is not inert: it switches requireAdmin to Authelia forward-auth and retires POST /api/v1/session and the admin token routes, and POST /api/v1/builds moves behind requireVerified. Documented rather than worked around. TestLocalOverlayConfigMapParses supplies the key via t.Setenv, matching how it already handles the Secret-supplied DSN, and now pins provider "none", an absent edge secret and both Require gates so the overlay cannot drift into the combination that refuses at startup. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

picklemustard added 1 commit 2026-09-11 22:36:10 +00:00

feat(local): run the anonymous surface with no WAF captcha ... a5a5dfe5d5

The local overlay turned the anonymous surface off entirely, so
verification, the Redis-backed enforcement counters and the ban path went
untested locally and development against them was blocked.

Turn it on with captcha.provider "none". The real challenge is AWS WAF's
CAPTCHA action in front of POST /api/v1/verify/mint, and there is no
CloudFront in front of a k3d cluster; under "none" challengeView returns
nil, so GET /api/v1/human-session omits the challenge key and the frontend
never loads the awswaf.com SDK or holds a token. No Go source change: the
escape hatch already existed.

That combination is legal only with no edge secret set -- RequireCaptcha
treats provider "none" and an edge secret as a matched pair -- so edge.secret
stays empty and the README says not to create a gbb-edge Secret. The sealing
key comes from a gbb-captcha Secret the base StatefulSet already projects
with optional: true, rather than inline, since a ConfigMap is not a secret.

The https GBB_PUBLIC_ORIGIN check and the Secure, __Host- prefixed cookies
are satisfied without touching code: TLS terminates at the edge Traefik, so
the browser is on https and only the inward hop is plain HTTP. For the same
reason auth.cookie_secure goes back to true and the ingress keeps the web
entrypoint.

Redis becomes a hard requirement, pointed at the same instance and db the
gateway already uses -- the gateway revokes sessions by deleting keys the
server wrote, and split instances fail silently.

GBB_ADMIN_GROUP is mandatory under captcha.enabled and is not inert: it
switches requireAdmin to Authelia forward-auth and retires POST
/api/v1/session and the admin token routes, and POST /api/v1/builds moves
behind requireVerified. Documented rather than worked around.

TestLocalOverlayConfigMapParses supplies the key via t.Setenv, matching how
it already handles the Secret-supplied DSN, and now pins provider "none", an
absent edge secret and both Require gates so the overlay cannot drift into
the combination that refuses at startup.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

picklemustard added 1 commit 2026-09-11 22:41:05 +00:00

Merge branch 'main' into fix/nuget-cli-home 27e8fe10a0

picklemustard merged commit 4b5d34deba into main 2026-09-11 22:41:51 +00:00

picklemustard referenced this pull request from a commit 2026-09-11 22:41:52 +00:00

Merge pull request 'feat(local): run the anonymous surface with no WAF captcha' (#6) from fix/nuget-cli-home into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

StudioTeal/GodotBinaryBuilder!6

No description provided.