colby
c0c01a38d6
Auth is now impossible to turn off by accident. A blank auth_token is never allowed even on loopback: config load generates a token, writes it back into sidecar.toml (preserving the rest of the file), logs it, and continues -- so a forgotten or cleared token self-heals into a working, authenticated setup instead of silently disabling auth. No auth token configured. Generated new token: cb99... Saved to sidecar.toml. Authentication is on. Protocol versioning (PROTOCOL_VERSION = 1) lets the website and sidecar detect a mismatch immediately when a message shape changes. Every response carries an X-UOLink-Version header; /health and ws.hello include "protocol"; a request that declares a different X-UOLink-Version is rejected 409 with both versions so the mismatch is unambiguous. Bump the constant when a contract changes. /health is now a real troubleshooting panel: status (ok/degraded), protocol, plugin_connected (is the shard link up), database (SELECT 1), uptime, and last_event (the timestamp of the last line from the shard). Unauthenticated so monitoring can reach it. Verified: a blank token generates + persists + enforces (401 without, 200 with); X-UOLink-Version header on every response; 409 on a declared mismatch; /health reports degraded/plugin_connected:false with no shard, then flips to ok/true and a populated last_event once the shard connects. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
31 lines
1.2 KiB
Plaintext
31 lines
1.2 KiB
Plaintext
# uo-link sidecar configuration — example.
|
|
#
|
|
# The sidecar reads `sidecar.toml` (override the path with $UOLINK_CONFIG). If that file
|
|
# is absent on first run, one is generated automatically with a random auth_token, so you
|
|
# normally do not create this by hand — just start the sidecar and edit the file it writes.
|
|
# Nothing here is compiled into the binary.
|
|
#
|
|
# Environment variables override the file:
|
|
# UOLINK_SHARD_BIND, UOLINK_WEB_BIND, UOLINK_WEB_TOKEN, UOLINK_DB_PATH
|
|
|
|
[shard]
|
|
# Loopback address the shard dials out to. Keep this on localhost — the game must not
|
|
# be reachable from anywhere else.
|
|
bind = "127.0.0.1:7788"
|
|
|
|
[web]
|
|
# Address the website connects to (WebSocket + REST).
|
|
# 127.0.0.1:8080 -> same host only
|
|
# 0.0.0.0:8080 -> accept remote clients (then auth_token is mandatory)
|
|
bind = "127.0.0.1:8080"
|
|
|
|
# Shared secret the website must present on every request:
|
|
# REST: Authorization: Bearer <token> (or X-Api-Key: <token>)
|
|
# WebSocket: add ?token=<token> to the connect URL
|
|
# Authentication is ALWAYS on. If this is left blank, the sidecar generates a token
|
|
# here on startup and logs it. Rotate by changing this value and restarting.
|
|
auth_token = "replace-with-a-long-random-secret"
|
|
|
|
[store]
|
|
path = "uo-link.db"
|