feat(orchestrator): Proxmox BFF route (CF-Access service token proxy) #3

2026-04-19T08:29:46Z

nsatoshi commented

2026-04-19 08:29:46 +00:00

feat(orchestrator): Proxmox BFF route (CF-Access service token proxy)

Adds a narrow, safelisted BFF surface so the Solace Bank Group PLC portal
(and other browser clients) can reach the Cloudflare Access protected
Proxmox API without requiring the user to complete a CF-Access SSO flow
in-browser.

Endpoints:
GET /api/proxmox/health — configuration probe (503 when unset)
GET /api/proxmox/cluster/status — aggregated cluster node status

Required orchestrator env:
PROXMOX_API_URL
PROXMOX_CF_ACCESS_CLIENT_ID
PROXMOX_CF_ACCESS_CLIENT_SECRET

When env is missing the endpoints return 503 with an actionable JSON
body and the frontend stays in its mocked state — no crashes, no
partial deploys.

Verification performed this session

`cd orchestrator && npx tsc --noEmit` — clean (orchestrator TS compiles).
Routes registered in `orchestrator/src/index.ts`:
- `GET /api/proxmox/health`
- `GET /api/proxmox/cluster/status`

Not yet done (intentional)

No new deployment in this PR — orchestrator change only.
Frontend is not pointed at these routes yet; the Solace portal still marks Proxmox as `bff-required` (see PR #2). After this lands + deploys, we can flip `src/services/proxmox.ts` over.
No integration test covers the upstream CF-Access call; we'd need a mock fetch and CI secrets.

Required orchestrator env (staging + prod)

`PROXMOX_API_URL` — e.g. `https://proxmox-api.d-bis.org`
`PROXMOX_CF_ACCESS_CLIENT_ID` — CF Access service-token ID
`PROXMOX_CF_ACCESS_CLIENT_SECRET` — CF Access service-token secret

When any of these are missing, both routes return 503 with an actionable JSON body rather than crashing.

feat(orchestrator): Proxmox BFF route (CF-Access service token proxy) Adds a narrow, safelisted BFF surface so the Solace Bank Group PLC portal (and other browser clients) can reach the Cloudflare Access protected Proxmox API without requiring the user to complete a CF-Access SSO flow in-browser. Endpoints: GET /api/proxmox/health — configuration probe (503 when unset) GET /api/proxmox/cluster/status — aggregated cluster node status Required orchestrator env: PROXMOX_API_URL PROXMOX_CF_ACCESS_CLIENT_ID PROXMOX_CF_ACCESS_CLIENT_SECRET When env is missing the endpoints return 503 with an actionable JSON body and the frontend stays in its mocked state — no crashes, no partial deploys. --- ## Verification performed this session - \`cd orchestrator && npx tsc --noEmit\` — clean (orchestrator TS compiles). - Routes registered in \`orchestrator/src/index.ts\`: - \`GET /api/proxmox/health\` - \`GET /api/proxmox/cluster/status\` ## Not yet done (intentional) - No new deployment in this PR — orchestrator change only. - Frontend is **not** pointed at these routes yet; the Solace portal still marks Proxmox as \`bff-required\` (see PR #2). After this lands + deploys, we can flip \`src/services/proxmox.ts\` over. - No integration test covers the upstream CF-Access call; we'd need a mock fetch and CI secrets. ## Required orchestrator env (staging + prod) - \`PROXMOX_API_URL\` — e.g. \`https://proxmox-api.d-bis.org\` - \`PROXMOX_CF_ACCESS_CLIENT_ID\` — CF Access service-token ID - \`PROXMOX_CF_ACCESS_CLIENT_SECRET\` — CF Access service-token secret When any of these are missing, both routes return **503** with an actionable JSON body rather than crashing.

nsatoshi referenced this pull request

2026-04-19 08:41:00 +00:00

feat(portal): wire Solace portal (all 7 pages) to live Chain-138 RPC + SolaceScan Explorer #2

nsatoshi merged commit e4b0be8a63 into main

2026-04-22 17:11:44 +00:00

nsatoshi referenced this issue from a commit

2026-04-22 17:11:46 +00:00

feat(orchestrator): Proxmox BFF route (CF-Access service token proxy) (#3)

nsatoshi deleted branch devin/1776587283-proxmox-bff

2026-04-22 17:11:47 +00:00

Sign in to join this conversation.