mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-26 05:30:18 +00:00
Anso
aabc374b55
Proxy-mode mesh could not get through an access gateway and could not explain itself when it could not. Two knobs on central. SENCHO_MESH_PROXY_HEADERS adds headers to the mesh WebSocket upgrade, either one map for every node or maps keyed by node name with a wildcard fallback, for a gateway that needs its own credential such as a Cloudflare Access service token. SENCHO_MESH_PROXY_CA_FILE adds a PEM bundle to the trust store for a remote whose certificate comes from a private CA; verification is never disabled. Header names are limited to the HTTP token charset and values to printable single-line text, and the headers Sencho owns on the handshake cannot be set, so config cannot shadow or inject into it. Configured headers are refused for a node whose API URL is not HTTPS, because that upgrade goes out in cleartext and the whole point of the knob is to carry a secret. Failure labels now name the cause. The remote marks its own refusals with a response header, so central can tell "this Sencho said no" from "something in front of it said no", and a gateway refusal is the only interpretation left when the marker is absent. A proxy auth challenge and a rate limit are grouped with gateway refusals rather than reported as a missing Upgrade header, and an unexpected failure on the remote is reported as a refusal instead of blaming the operator's token. Docs: a reverse-proxy, tunnel and VPN section covering nginx and friends, Cloudflare, access gateways, private CAs, VPN addressing and mesh subnet collisions with host routes, plus the two variables in the configuration reference and the example environment file.