marvinandClaude Opus 5.5
90176e1cca
Caddy forwards /wizard/api/* and /wizard/website/* with the prefix stripped, so the server received /ws instead of /api/ws and the website connected to /api/ws on the domain root. - Server routes are now /ws and /health (was /api/ws, /api/health) - Website derives the websocket URL from its own location (../api/ws), giving /wizard/api/ws in production and /api/ws in development - Vite dev proxy strips /api like the production proxy - nginx back to the plain SPA config since Caddy strips the prefix - /internal/ai rejects requests that came through the reverse proxy, in addition to the shared secret - Docs updated for the prefixed deployment Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
85 lines
2.7 KiB
Python
85 lines
2.7 KiB
Python
"""FastAPI application of the Wizard game server.
|
|
|
|
Routes (the reverse proxy strips its path prefix, e.g. ``/wizard/api``):
|
|
- ``GET /health`` health check
|
|
- ``WS /ws`` web clients (see ``app.protocol``)
|
|
- ``WS /internal/ai`` AI service (see ``app.ai_bridge``); only accepted from
|
|
direct connections on the internal network and protected by ``AI_SHARED_SECRET``
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
import contextlib
|
|
import logging
|
|
import secrets
|
|
from collections.abc import AsyncIterator
|
|
|
|
from fastapi import FastAPI, WebSocket
|
|
|
|
from .config import Settings, settings
|
|
from .service import WizardService
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
def create_app(config: Settings = settings) -> FastAPI:
|
|
service = WizardService(config)
|
|
|
|
@contextlib.asynccontextmanager
|
|
async def lifespan(_: FastAPI) -> AsyncIterator[None]:
|
|
if not config.ai_shared_secret:
|
|
logger.warning("AI_SHARED_SECRET is not set, /internal/ai is unauthenticated")
|
|
cleanup = asyncio.create_task(service.cleanup_loop())
|
|
try:
|
|
yield
|
|
finally:
|
|
cleanup.cancel()
|
|
|
|
app = FastAPI(title="Wizard game server", lifespan=lifespan, docs_url=None, redoc_url=None)
|
|
app.state.service = service
|
|
|
|
@app.get("/health")
|
|
async def health() -> dict:
|
|
return {
|
|
"status": "ok",
|
|
"lobbies": len(service.lobbies),
|
|
"sessions": len(service.sessions),
|
|
"ai_available": service.bridge.available,
|
|
}
|
|
|
|
@app.websocket("/ws")
|
|
async def client_socket(websocket: WebSocket) -> None:
|
|
await service.handle_client(websocket)
|
|
|
|
@app.websocket("/internal/ai")
|
|
async def ai_socket(websocket: WebSocket) -> None:
|
|
if _via_proxy(websocket) or not _ai_authorized(websocket, config.ai_shared_secret):
|
|
await websocket.close(code=1008)
|
|
return
|
|
await service.handle_ai(websocket)
|
|
|
|
return app
|
|
|
|
|
|
def _via_proxy(websocket: WebSocket) -> bool:
|
|
# The reverse proxy forwards everything below its prefix, including
|
|
# /internal/ai. Requests that went through it carry forwarding headers;
|
|
# the AI service connects directly over the internal network.
|
|
return any(name in websocket.headers for name in ("x-forwarded-for", "forwarded", "via"))
|
|
|
|
|
|
def _ai_authorized(websocket: WebSocket, secret: str) -> bool:
|
|
if not secret:
|
|
return True
|
|
header = websocket.headers.get("authorization", "")
|
|
token = header.removeprefix("Bearer ").strip() if header.startswith("Bearer ") else ""
|
|
return secrets.compare_digest(token.encode(), secret.encode())
|
|
|
|
|
|
logging.basicConfig(
|
|
level=settings.log_level.upper(),
|
|
format="%(asctime)s %(levelname)s %(name)s: %(message)s",
|
|
)
|
|
app = create_app()
|