mirror of
https://github.com/vectorize-io/hindsight.git
synced 2026-09-14 19:31:49 +08:00
Ariel AI
c0ff87ea10
Add HINDSIGHT_CP_ACCESS_KEY env var to enable a lightweight shared-secret authentication gate for the Control Plane UI. Features: - Login page at /login with access key input form - /api/auth/login endpoint validates key and sets HttpOnly session cookie - /api/auth/logout endpoint clears session cookie - Middleware protects all routes except /login, /api/auth/*, /api/health, /api/version, static assets, and _next - returnTo query param preserves redirect after login - Constant-time comparison for access key to prevent timing attacks - Logout button in sidebar (when a bank is selected) and dashboard header - Updated .env.example and docker-compose docs Security: - HttpOnly, SameSite=lax, Secure (production only) cookie - 24-hour session lifetime - Constant-time string comparison to prevent timing attacks
Nginx Reverse Proxy with Custom Base Path
Deploy Hindsight API under /hindsight (or any custom path) using Nginx reverse proxy.
Quick Start (Published Image - API Only)
docker-compose up
- API: http://localhost:8080/hindsight/docs
- Control Plane: http://localhost:9999 (direct access, not proxied)
Full Stack with Custom Base Path (Requires Build)
Important: You cannot rebuild from the published image with build args. You must build from source.
Build from Source with Custom Base Path
- Clone the repository (if you haven't):
git clone https://github.com/vectorize-io/hindsight.git
cd hindsight
- Build with base path:
docker build \
--build-arg NEXT_PUBLIC_BASE_PATH=/hindsight \
-f docker/standalone/Dockerfile \
-t hindsight:custom \
.
- Update docker-compose.yml to use your built image:
services:
hindsight:
image: hindsight:custom # ← Change this
environment:
HINDSIGHT_API_BASE_PATH: /hindsight
NEXT_PUBLIC_BASE_PATH: /hindsight
-
Update nginx.conf to handle Control Plane routes (see below)
-
Run:
docker-compose up
Required nginx.conf for Full Stack
Replace the current nginx.conf with this to proxy both API and Control Plane:
events { worker_connections 1024; }
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
upstream hindsight_api { server hindsight:8888; }
upstream hindsight_cp { server hindsight:9999; }
server {
listen 80;
# API
location ~ ^/hindsight/(docs|openapi\.json|health|metrics|v1|mcp) {
proxy_pass http://hindsight_api;
proxy_set_header Host $http_host;
}
# Control Plane static files
location ~ ^/hindsight/_next/ {
proxy_pass http://hindsight_cp;
proxy_set_header Host $http_host;
}
# Control Plane UI
location /hindsight {
proxy_pass http://hindsight_cp;
proxy_set_header Host $http_host;
}
location = / { return 301 /hindsight; }
}
}
Why Build is Required
Next.js requires basePath at build time. The published image was built without a custom base path, so you must rebuild from source with the NEXT_PUBLIC_BASE_PATH build arg to deploy the Control Plane under a subpath.
The API works without rebuild because HINDSIGHT_API_BASE_PATH is a runtime environment variable.