specverb: base-url from SSM for opaque/tailnet-only targets #149

New issue

Closed

opened 2026-06-17 19:50:38 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-17 19:50:38 +00:00

Owner

ward-kdl's base-url is a committed static string, fine for public hosts (forgejo, trello, tailscale-api). A tailnet-only target like Open WebUI is reachable only at its tailnet FQDN, which is opaque and SSM-bound, and ward is public-mirrored, so the host cannot be committed.

Add a block form:

base-url { ssm "/coilysiren/open-webui/url" }

resolved lazily at request time through the same SSM resolver as the auth token (mounting / --help / unrelated merged members never touch AWS), cached once, offline in --dry-run (symbolic {base-url:ssm <path>}), and named (not resolved) by describe. Mutually exclusive with the string form; the spec must be vendored (no derivable fetch URL). Unblocks adding Open WebUI to ward-kdl.

ward-kdl's `base-url` is a committed static string, fine for public hosts (forgejo, trello, tailscale-api). A tailnet-only target like Open WebUI is reachable only at its tailnet FQDN, which is opaque and SSM-bound, and ward is public-mirrored, so the host cannot be committed. Add a block form: ```kdl base-url { ssm "/coilysiren/open-webui/url" } ``` resolved lazily at request time through the same SSM resolver as the auth token (mounting / --help / unrelated merged members never touch AWS), cached once, offline in --dry-run (symbolic `{base-url:ssm <path>}`), and named (not resolved) by describe. Mutually exclusive with the string form; the spec must be vendored (no derivable fetch URL). Unblocks adding Open WebUI to ward-kdl.

coilysiren referenced this issue from a commit

2026-06-17 19:55:44 +00:00

feat(specverb): resolve base-url from SSM for opaque/tailnet-only hosts

coilysiren closed this issue

2026-06-17 19:55:44 +00:00