feat(control-panel): web admin UI for the zero-touch tunnel

Browse Source

Loopback Fastify auth-broker + esbuild SPA. Operator password login (constant-time,
signed HttpOnly session cookie, per-forwarded-IP rate-limit) → session-gated proxy
that mints a fresh 60s manage capability token per call to the control-plane admin
API: list hosts, mint pairing codes (with QR + pair command), revoke hosts. Security
headers + CSP, CP_URL pinned loopback (anti-SSRF), hostId dot-segment guard. 55 tests
pass; security-reviewed. Deployed behind nginx panel.terminal.yaojia.wang.

...

This commit is contained in:

Yaojia Wang

2026-07-19 19:47:51 +02:00

parent 7c1d43376d

commit 675de771c7

38 changed files with 5207 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

2902

control-panel/package-lock.json generated Normal file

File diff suppressed because it is too large Load Diff