bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(hololake): render bounded release front door config

Browse source
This commit is contained in:
冰朔 2026-08-13 19:16:15 +08:00
commit 461517c25f
6 changed files with 131 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
product-source/hololake-native-desktop/server/release-broadcast/README.md
View file

@ -23,6 +23,14 @@ preserve the full request URI. Its loopback tunnel port remains deliberately
unassigned until the BS-GZ-006 route owner returns the live, non-conflicting
topology.
Once that port is returned and independently verified, `render-front-door.mjs
--loopback-port PORT` renders the bounded Nginx location. It refuses an omitted
port, preserves the full public request path by leaving `proxy_pass` without a
URI suffix, accepts only GET and HEAD, forwards no request body, and strips
authorization, cookies, and client forwarding headers. Rendering is not
deployment; Nginx validation, transactional install, public certificate/readback,
and a separate server receipt remain required.
`operator.mjs` supplies the separate, root-operated verification and activation
boundary. `verify` reconstructs a private candidate tree and accepts it only when
the broadcast, pipeline receipt, package bytes, Developer ID receipt, Apple