Add fleet-standard basic auth (admin/DW2024!) for public liveskus subdomain; keep /healthz open

0d3c544ee38e06eb991b4ecb6e9719979429e072 · 2026-07-28 20:10:34 -0700 · steve

Files touched

M server.js

Diff

commit 0d3c544ee38e06eb991b4ecb6e9719979429e072
Author: steve <steve@designerwallcoverings.com>
Date:   Tue Jul 28 20:10:34 2026 -0700

    Add fleet-standard basic auth (admin/DW2024!) for public liveskus subdomain; keep /healthz open
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 1750916..5d33384 100644
--- a/server.js
+++ b/server.js
@@ -48,6 +48,14 @@ http.createServer((req, res) => {
 
   if (p === '/healthz') { res.writeHead(200); return res.end('ok'); }
 
+  // Basic-auth gate (fleet standard admin/DW2024!, override via BASIC_AUTH="user:pass").
+  // Placed AFTER /healthz so the fleet keepalive can still probe an open 200 and never
+  // misreads the authed 401 as a dead process (see "auth-gated service needs /healthz").
+  const AUTH = process.env.BASIC_AUTH || 'admin:DW2024!';
+  const hdr = req.headers['authorization'] || '';
+  const got = hdr.startsWith('Basic ') ? Buffer.from(hdr.slice(6), 'base64').toString() : '';
+  if (got !== AUTH) { res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="LiveSkus"' }); return res.end('auth required'); }
+
   // Live catalog. On any DB failure, fall back to the static snapshot (wrapped to
   // match the {records,totals} contract) so the front end always gets valid data.
   if (p === '/api/data') {

← 0ca6eea trip computer: live processing rate (SKUs/min) + ETA to fini · back to Corvette Dashboard Viewer · Make BASIC_AUTH a real env override in ecosystem.config.js ( 635e992 →