Disabled-by-default HTTPS edge for external GPT Online Task access

Purpose

The internal ingress (127.0.0.1:18945) remains loopback-only. This edge is the only component allowed to become Internet-facing, and only after a separate owner approval.

It forwards only:

POST /v1/read-only-tasks
GET  /v1/read-only-tasks/{request_id}
GET  /openapi.json
GET  /health

It never proxies:

18892 canonical Bridge
18940 Task API
WriterLease
commit
verification
release
tag
baseline
arbitrary URLs

Default state

The systemd unit is disabled by policy unless the owner creates:

/etc/aios-gitops/gpt-https-edge.approved

The base unit still binds only to:

127.0.0.1:18443
AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED=0

Non-loopback bind is rejected by code unless an owner-controlled drop-in sets:

AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED=1
AIOS_GPT_EDGE_HOST=0.0.0.0
AIOS_GPT_EDGE_PUBLIC_DOMAIN=<approved hostname>

This repository candidate does not create that drop-in or approval marker.

TLS

TLS certificate/key are owner-managed systemd credentials:

/etc/aios-gitops/gpt-https-edge-tls.crt
/etc/aios-gitops/gpt-https-edge-tls.key

The service requires TLS 1.2 or newer, disables TLS compression, and never logs or returns key material.

Certificate/key issuance and renewal are external owner responsibilities until a separately governed ACME workflow is implemented.

Request protections

The edge provides:

64 KiB request cap;
256 KiB upstream response cap;
JSON validation before proxying;
fixed upstream http://127.0.0.1:18945;
Authorization-only header forwarding;
no Cookie/X-Forwarded-* trust;
route/method allowlist;
per-source-IP in-memory rate limiting;
bounded concurrent request handling;
optional exact Host-header enforcement;
HSTS / no-store / nosniff / no-referrer response headers.

The rate limiter is intentionally simple and local. Multi-node/global abuse protection is outside the current one-host architecture.

Authentication

The HTTPS edge does not create a new authentication scheme. It forwards the external Bearer credential to the loopback GPT ingress, which verifies gpt_ingress_token.

The edge never receives the AIOS control-plane token.

Deployment boundary

Public activation is a high-risk network operation and requires explicit owner approval. Before activation verify:

host-side GPT ingress E2E=VERIFIED
owner ingress token provisioned
TLS certificate/key provisioned
public hostname owned and DNS configured
firewall/network exposure reviewed
explicit public-bind approval recorded
rollback plan available

Only after those gates may an owner-authorized runtime drop-in bind this service publicly.

Until then:

GPT_HTTPS_EDGE_IMPLEMENTATION=candidate
PUBLIC_NETWORK_EXPOSURE=NONE
PUBLIC_CUSTOM_GPT_DIRECT_AI0S_ACCESS=NOT_VERIFIED

2.8 KiB Raw Blame History