feat: reverse proxy as a first-class front door (0.12.0)#14
Merged
Conversation
Adds COLLIE_SKIP_SERVE=1 support to collie-ctl.sh so the bridge can run behind a reverse proxy (Caddy, Nginx, etc.) without triggering tailscale serve. The bridge stays on 127.0.0.1 only — your proxy handles TLS, auth, and public access. - cmd_serve/cmd_unserve: early return when COLLIE_SKIP_SERVE=1 - print_status_banner: shows 'proxy' instead of 'tailnet' when skipped - cmd_status: skips tailscale serve status check when skipped - .env.example: documents the new variable - Version bumped to 0.12.0 (minor — new feature) (cherry picked from commit 00307cd)
…warning, COLLIE_PUBLIC_URL - cmd_unserve always attempts teardown (stale serve mapping is a security hazard, and teardown was already idempotent) - bridge warns at startup when COLLIE_TRUSTED_USER is set under COLLIE_SKIP_SERVE=1 (Tailscale-User-Login is never injected, so the identity gate is inert — point at COLLIE_DEVICE_HEADER instead); the Variant-A empty-trustedUser warning no longer fires in that mode - startup warnings extracted to pure startupWarnings(cfg) for bun test - COLLIE_PUBLIC_URL shows the operator's real proxy URL in the status banner Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
README gains Variant C (reverse proxy as the only front door, Caddy example, env block); 'sole ingress' becomes 'exactly one hardened front door' across README, ARCHITECTURE §2/§6, and the CLAUDE.md posture line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes a reverse proxy (Caddy/Nginx) a fully supported alternative to
tailscale serveas Collie's single hardened front door — documented as README Variant C.Builds on and supersedes #13 by @diogenesc: their commit is included here with authorship preserved (ad5833a, cherry-picked onto 0.11.1), plus the hardening the posture change needs.
Changes
From #13 (@diogenesc):
COLLIE_SKIP_SERVE=1—collie-ctl.shnever touches tailscale serve (guards insidecmd_serve/status, sostart/uninstallare covered too)Hardening on top:
cmd_unservealways attempts teardown — skipping it under the flag would strand a stale serve mapping still publishing the app (teardown was already idempotent)COLLIE_TRUSTED_USERis set underCOLLIE_SKIP_SERVE=1: without tailscale serve,Tailscale-User-Loginis never injected andcheckAccessonly enforces it when present — the identity gate is silently inert. The warning points atCOLLIE_DEVICE_HEADER(per-device auth, designed for proxy-injected headers) as the replacement. The Variant-A empty-trustedUser warning no longer fires in skip-serve mode.startupWarnings(cfg)— unit-tested underbun test(6 new cases)COLLIE_PUBLIC_URL— status banner shows the operator's real proxy URLDocs:
COLLIE_PUBLIC_HOSTS,COLLIE_ALLOWED_ORIGINS,COLLIE_DEVICE_HEADER+allowlist), links Variant B's four proxy requirements verbatimfunnel, never a bare port" stays absolute.Default-path behavior (flag unset) is unchanged; the one legacy-string edit is the publicHosts warning no longer naming
COLLIE_SERVE_MODE(which the bridge never read).Test plan
bun run typecheckboth sides (root build)bun run test: 191 pass (was 184; +COLLIE_SKIP_SERVE parsing, +startupWarnings matrix)cd web && bun run test: 719 pass (pre-push hook)bash -n scripts/collie-ctl.sh; banner rendersproxy <url>withCOLLIE_PUBLIC_URL, placeholder withoutscripts/check-version.sh✓ 0.12.0Closes #13 — superseded with the original commit included.
🤖 Generated with Claude Code