Two findings from the Codex review of the host-Docker changes:
1. Under-gated host target (security). Listing/actioning/log-reading the
CLUSEV HOST's containers only required `operate`, but the host is the
control-plane machine — a `Stop` on clusev-mariadb takes Clusev down —
and the host TERMINAL is already `manage-fleet`-only. Align it:
- effectiveTarget() resolves to the host only for manage-fleet users;
everyone else is pinned to a fleet server (no host default, no toggle).
- action()/viewLogs() and the ContainerLogs host sentinel (serverId 0)
now abort_unless manage-fleet.
A viewer/operator can no longer reach the host, even by forcing
target=host.
2. HostCredential::toServer() dropped a key passphrase equal to the string
"0" via a falsy `if ($this->passphrase)` check, which would break key
auth. Use an explicit null/'' check.
Added tests: non-admin never targets the host, a forced target=host still
hits a fleet server, operator cannot open host logs. 751 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Docker page only ever targeted fleet servers, so an operator whose
containers run ON the Clusev host itself (the clusev stack + anything
else on that machine) saw nothing — the page has "nothing to do with
the fleet" from their point of view. It now has a target switch:
• Clusev host (default when a host SSH login exists) — lists the
containers on the machine Clusev runs on, reached over the local
Docker gateway with the existing encrypted HostCredential, the same
login the host terminal uses.
• the active fleet server — the previous behaviour, still available.
Mechanics:
- HostCredential::toServer() builds a TRANSIENT Server (never persisted)
carrying the host login; DockerService/FleetService run unchanged
against it. The logs modal resolves serverId 0 to this host server.
- VerifiesHostKey only pins (writes ssh_host_key) for persisted fleet
servers now; a transient host connection no longer spawns a junk
fleet row on every request. The host is the local gateway — no
network path to MITM — so skipping the pin there is safe.
- The `app` service (dev + prod compose) gains the
host.docker.internal:host-gateway mapping the terminal sidecar already
had, so the PHP layer can reach the host's sshd. Without it the app
container cannot resolve the host at all — the real reason host Docker
never worked.
- Absent runtime still renders the clean "not installed" state; a
host target with no login yet shows a setup hint.
Verified end-to-end in a browser: the page defaults to the host and
lists the full running stack (clusev-app/mariadb/redis/… + others) with
Logs/Restart/Stop actions. 748 tests green (5 new host-target tests).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fixes from the security audit (the brute-force/rate-limiting angle matters more now that the
password policy is min(6)/no-complexity, so IP-keyed throttles must not be spoofable):
- bootstrap/app.php: trustProxies(at: '*') → trust only PRIVATE ranges in prod. Caddy reaches
app:80 from the docker bridge (private IP) so it stays trusted, but a public/off-network source
can no longer forge X-Forwarded-For to spoof request()->ip() and bypass the login/2FA/forgot
throttles + the brute-force ban.
- TerminalSession + HostCredential: replace $guarded=[] with an explicit $fillable allowlist; add
$hidden=[secret,passphrase] to HostCredential so it never serializes its credential fields.
- nginx /terminal/ws: access_log off — the single-use session token rode the query string into the
access log.
Verified: full suite 467 pass; all panel pages 200 with zero console errors; server terminal still
connects + runs commands.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The "Clusev host" terminal was a shell inside the sidecar container (node@clusev, no
sudo, not the host). It is now a REAL SSH login into the host machine, like any fleet
server — so it shows the real root@<host> prompt with full rights.
- HostCredential (encrypted singleton) holds the host SSH login; a HostShell modal lets
the operator set host/port/user + password|key. The clear-text secret is never echoed
back; on edit a blank secret keeps the stored one, and switching auth method requires a
fresh secret (no password silently reused as a key).
- open('host') mints a kind=host token only when a login is configured, else opens the
setup modal; the internal resolve endpoint returns a server-shaped SSH spec (decrypted,
internal-net only) for kind=host, or 404 when unconfigured.
- compose: extra_hosts host.docker.internal:host-gateway so the sidecar reaches the host
sshd; Caddy now 404s /_internal/* at the public edge (the sidecar uses app:80 directly).
- rail gains a debounced search box past 5 servers; removed the now-obvious PTY hint line.
Browser-verified (R12): host tile shows "not configured" + gear → modal → SSH login as
root runs commands, zero console errors; search filters; resolve returns the host spec.
15 terminal tests pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
boban