Add an always-on agent-proxy role in infrastructure

coilysiren commented

2026-07-02 05:16:13 +00:00

Owner

Add an always-on agent-proxy rollout in the infrastructure repo, shaped like the existing host-level dockerized roles such as mac-proxy, dozzle, and logdy.

Target outcome:

a host-local, always-on agent-proxy service managed by infrastructure ansible
same house shape as the sibling roles:
- role under ansible/roles/agent-proxy/
- defaults/main.yml with *_enabled, *_dir, *_port, and any required config knobs
- files/compose.yaml
- tasks/main.yml that gates on docker CLI, converges the compose dir/file, brings the container up, and waits on the loopback port
- docs/FEATURES entry and any needed runbook/docs

Constraints and context:

the proxy is a host-local front door to the local tower, not a k3s app
keep the UI/API bound to loopback unless there is a documented reason otherwise
PROXY_ runtime config should come from env / SSM-backed settings, never tracked opaque values
if the current agent-proxy repo lacks the container artifact needed for this rollout, use the granted writable repo to add the minimum viable container support there in the same carry
keep the implementation inside phase-1 reliability proxy scope. no capability-phase work

Acceptance criteria:

infrastructure can converge an always-on local agent-proxy container in the same operational style as mac-proxy/dozzle
the role has sane defaults and is disabled by default unless the relevant host vars opt in
docs describe where it binds, how it reaches the tower, and how to validate it
if cross-repo changes are needed in coilyco-flight-deck/agent-proxy, land them in that repo too before exit

Add an always-on `agent-proxy` rollout in the infrastructure repo, shaped like the existing host-level dockerized roles such as `mac-proxy`, `dozzle`, and `logdy`. Target outcome: - a host-local, always-on agent-proxy service managed by infrastructure ansible - same house shape as the sibling roles: - role under `ansible/roles/agent-proxy/` - `defaults/main.yml` with `*_enabled`, `*_dir`, `*_port`, and any required config knobs - `files/compose.yaml` - `tasks/main.yml` that gates on docker CLI, converges the compose dir/file, brings the container up, and waits on the loopback port - docs/FEATURES entry and any needed runbook/docs Constraints and context: - the proxy is a host-local front door to the local tower, not a k3s app - keep the UI/API bound to loopback unless there is a documented reason otherwise - `PROXY_` runtime config should come from env / SSM-backed settings, never tracked opaque values - if the current `agent-proxy` repo lacks the container artifact needed for this rollout, use the granted writable repo to add the minimum viable container support there in the same carry - keep the implementation inside phase-1 reliability proxy scope. no capability-phase work Acceptance criteria: - infrastructure can converge an always-on local agent-proxy container in the same operational style as mac-proxy/dozzle - the role has sane defaults and is disabled by default unless the relevant host vars opt in - docs describe where it binds, how it reaches the tower, and how to validate it - if cross-repo changes are needed in `coilyco-flight-deck/agent-proxy`, land them in that repo too before exit

coilyco-ops commented

2026-07-02 05:16:23 +00:00

Member

🔒 Reserved by ward agent --driver codex — container engineer-codex-infrastructure-425 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T05:16:21Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Codex, via ward agent

🔒 Reserved by `ward agent --driver codex` — container `engineer-codex-infrastructure-425` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T05:16:21Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Codex, via `ward agent`

coilysiren referenced this issue from a commit

2026-07-02 05:19:54 +00:00

feat(ansible): add agent-proxy rollout

coilysiren closed this issue

2026-07-02 05:19:54 +00:00

coilysiren commented

2026-07-02 05:20:26 +00:00

Author

Owner

WARD-OUTCOME: done - added an always-on agent-proxy ansible role, wired it into mac sync, and documented the loopback rollout and tower resolution.\n\nThe work was straightforward once I matched the dozzle/mac-proxy pattern. The only wrinkle was making the container build context host-safe, so I switched it to the remote agent-proxy repo instead of a local path. Confidence is solid, but I would still keep an eye on the remote compose build path the first time it runs on a host.

coilysiren referenced this issue

2026-07-02 07:55:36 +00:00

agent-proxy: container binds PROXY_PORT=8082 but compose maps to container :8080 - proxy never serves on 127.0.0.1:8082 #430

Rows
Columns

Add an always-on agent-proxy role in infrastructure #425