coilyco-gaming/sirens-echo

Watch

Remove the SIRENS_ECHO_HTTP_TOKEN startup requirement #105

New issue

Closed

opened 2026-08-11 09:31:51 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-08-11 09:31:51 +00:00

Member

SIRENS_ECHO_HTTP_TOKEN is a hard startup requirement whenever the HTTP listener is not bound to loopback. Remove the requirement.

Where it lives

internal/community/config.go - LoadConfig returns an error when loopbackListener(cfg.HTTPListenAddr) is false and HTTPToken is empty.
docs/sirens-echo-http.md - documents it as mandatory, constant-time compared, with health routes exempt.

Why it is not necessary

Both k3s lanes bind 0.0.0.0:8080 and expose only a ClusterIP Service. There is no Ingress, no ExternalDNS record, no certificate, and no NodePort. The only route in is each pod's Tailscale sidecar, so reaching /v1/turn already requires being an authorized node on the tailnet. The token is a second gate behind an authenticated network boundary that already decides the same question.

The cost is real. The check turns a bind-address choice into a mandatory secret, which means an SSM parameter per lane, an ExternalSecret mapping per lane, and a shared credential that every legitimate caller has to carry. Rotation touches every caller. None of that buys a boundary the tailnet is not already holding.

Suggested shape

Drop the startup failure. Keep the bearer check itself as opt-in, so a deployment that genuinely fronts the listener with something other than a tailnet can still set the variable and get the existing constant-time comparison. Absent variable means no token check, which matches how SIRENS_ECHO_ACCESS_POLICY already treats an absent file for the environment-configured path.

If the requirement should stay for some case not visible from deploy, say so on this issue and the deployment will keep mapping the parameter. What should not persist is a mandatory secret justified only by the bind address.

Current state in deploy

coilyco-bridge/deploy#356 maps SIRENS_ECHO_HTTP_TOKEN for both lanes purely to satisfy this check, since the image at e0b3dc12 refuses to start without it. That mapping and its two SSM parameters can be deleted once this lands, and existing tailnet callers of /v1/turn stop needing an Authorization: Bearer header.

`SIRENS_ECHO_HTTP_TOKEN` is a hard startup requirement whenever the HTTP listener is not bound to loopback. Remove the requirement. ## Where it lives * `internal/community/config.go` - `LoadConfig` returns an error when `loopbackListener(cfg.HTTPListenAddr)` is false and `HTTPToken` is empty. * `docs/sirens-echo-http.md` - documents it as mandatory, constant-time compared, with health routes exempt. ## Why it is not necessary Both k3s lanes bind `0.0.0.0:8080` and expose only a ClusterIP Service. There is no Ingress, no ExternalDNS record, no certificate, and no NodePort. The only route in is each pod's Tailscale sidecar, so reaching `/v1/turn` already requires being an authorized node on the tailnet. The token is a second gate behind an authenticated network boundary that already decides the same question. The cost is real. The check turns a bind-address choice into a mandatory secret, which means an SSM parameter per lane, an ExternalSecret mapping per lane, and a shared credential that every legitimate caller has to carry. Rotation touches every caller. None of that buys a boundary the tailnet is not already holding. ## Suggested shape Drop the startup failure. Keep the bearer check itself as opt-in, so a deployment that genuinely fronts the listener with something other than a tailnet can still set the variable and get the existing constant-time comparison. Absent variable means no token check, which matches how `SIRENS_ECHO_ACCESS_POLICY` already treats an absent file for the environment-configured path. If the requirement should stay for some case not visible from deploy, say so on this issue and the deployment will keep mapping the parameter. What should not persist is a mandatory secret justified only by the bind address. ## Current state in deploy `coilyco-bridge/deploy#356` maps `SIRENS_ECHO_HTTP_TOKEN` for both lanes purely to satisfy this check, since the image at `e0b3dc12` refuses to start without it. That mapping and its two SSM parameters can be deleted once this lands, and existing tailnet callers of `/v1/turn` stop needing an `Authorization: Bearer` header.

coilyco-ops referenced this issue from a commit

2026-08-11 22:18:58 +00:00

refactor(http): remove the HTTP token and let the network layer decide access

coilyco-ops closed this issue

2026-08-11 22:18:58 +00:00

coilyco-ops commented

2026-08-11 22:20:49 +00:00

Author

Member

Landed in 10ec199 on main.

Removed outright rather than made opt-in, per Kai's direction: the whole HTTP-token concept is gone instead of the startup check alone. SIRENS_ECHO_HTTP_TOKEN, the HTTPToken config field, authorizedHTTPTurn and its constant-time comparison, the loopbackListener helper, and the turn_unauthorized exception are all deleted. 130 deletions against 23 insertions, and the exception catalog drops to 23 entries.

Enforcement is the network layer only. The process no longer reasons about who may reach POST /v1/turn.

Docs updated to match: docs/sirens-echo-http.md (the section is now "Access and limits" and the curl example drops the bearer header), README.md, and docs/FEATURES.md.

ward exec vet, ward exec test, ward exec policy-check, and the full pre-commit gate all pass. Nothing was run against a live cluster.

Deploy-side follow-up filed as coilyco-bridge/deploy#363, carrying the ordering constraint that the image has to publish before the mapping is removed.

Landed in `10ec199` on main. Removed outright rather than made opt-in, per Kai's direction: the whole HTTP-token concept is gone instead of the startup check alone. `SIRENS_ECHO_HTTP_TOKEN`, the `HTTPToken` config field, `authorizedHTTPTurn` and its constant-time comparison, the `loopbackListener` helper, and the `turn_unauthorized` exception are all deleted. 130 deletions against 23 insertions, and the exception catalog drops to 23 entries. Enforcement is the network layer only. The process no longer reasons about who may reach `POST /v1/turn`. Docs updated to match: `docs/sirens-echo-http.md` (the section is now "Access and limits" and the curl example drops the bearer header), `README.md`, and `docs/FEATURES.md`. `ward exec vet`, `ward exec test`, `ward exec policy-check`, and the full pre-commit gate all pass. Nothing was run against a live cluster. Deploy-side follow-up filed as coilyco-bridge/deploy#363, carrying the ordering constraint that the image has to publish before the mapping is removed.

coilyco-ops referenced this issue

2026-08-11 23:05:41 +00:00

Serve Echo's turn over MCP, so fleet clients call it natively #119

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-gaming/sirens-echo#105

No description provided.

Rows
Columns