ClintchizandClaude Opus 5
247f360ae7
It was written up in 4.7 but never made the work order, which is exactly how it stayed dangerous in the first place. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
58 lines
1.6 KiB
TypeScript
58 lines
1.6 KiB
TypeScript
import type { WorkspaceConfig } from "@wrnexus/cli/workspace";
|
|
|
|
// Map each app to the domains it serves. `wrnexus gateway` runs them all behind
|
|
// one port and routes by Host header (add these hosts to your /etc/hosts).
|
|
const config: WorkspaceConfig = {
|
|
defaultEnvironment: "development",
|
|
environments: {
|
|
development: {
|
|
protocol: "http",
|
|
rootDomain: "localhost",
|
|
port: 3000,
|
|
runtime: "development",
|
|
hmr: true,
|
|
build: false,
|
|
migrate: false,
|
|
},
|
|
staging: {
|
|
protocol: "https",
|
|
rootDomain: "staging.example.com",
|
|
port: 443,
|
|
runtime: "production",
|
|
hmr: false,
|
|
build: true,
|
|
migrate: true,
|
|
},
|
|
production: {
|
|
protocol: "https",
|
|
rootDomain: "example.com",
|
|
port: 443,
|
|
runtime: "production",
|
|
hmr: false,
|
|
build: true,
|
|
migrate: true,
|
|
},
|
|
},
|
|
// Gateway-wide security (all optional):
|
|
security: {
|
|
trustedHostsOnly: true, // reject requests for unknown domains
|
|
rateLimit: { max: 300, windowMs: 60_000 }, // per client IP
|
|
headers: true, // baseline security headers at the edge
|
|
accessLog: true, // log host → app, method, path, status
|
|
},
|
|
apps: [
|
|
{ name: "web", dir: "apps/web", domains: ["localhost", "web.localhost"] },
|
|
{
|
|
name: "admin",
|
|
dir: "apps/admin",
|
|
domains: ["admin.localhost"],
|
|
// Lock the admin app down at the edge (pick one):
|
|
auth: { basic: { user: "admin", pass: "change-me" } },
|
|
// auth: { allowIps: ["127.0.0.1", "::1"] },
|
|
// auth: { forward: { url: "http://localhost:4001/api/verify" } }, // SSO
|
|
},
|
|
],
|
|
};
|
|
|
|
export default config;
|