From f20980bdc09fc218a336f3cac2c471bf02d5bde7 Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Sat, 18 Apr 2026 17:01:12 +0800 Subject: [PATCH] fix(bridge): allow public access to /api/ping and update ACP validation URLs - Exempt `/` and `/api/ping` from Bearer token authentication in xworkmate-bridge Caddyfile to fix health check failures (401 Unauthorized). - Update validation tasks to use `https://{{ xworkmate_bridge_domain }}` instead of `http://127.0.0.1`. - Correct the upstream ACP paths in validation logic (e.g. `/acp-server/codex`). - Remove redundant Host headers from validation requests. --- .../templates/xworkmate-bridge-site.caddy.j2 | 1 + roles/vhosts/xworkmate_bridge/tasks/validate.yml | 12 ++++-------- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/roles/vhosts/gateway_openclaw/templates/xworkmate-bridge-site.caddy.j2 b/roles/vhosts/gateway_openclaw/templates/xworkmate-bridge-site.caddy.j2 index 6eb3ccc..5b0f561 100644 --- a/roles/vhosts/gateway_openclaw/templates/xworkmate-bridge-site.caddy.j2 +++ b/roles/vhosts/gateway_openclaw/templates/xworkmate-bridge-site.caddy.j2 @@ -8,6 +8,7 @@ # 统一鉴权拦截 (Bearer Token) @unauthorized { + not path / /api/ping not header Authorization "Bearer {{ xworkmate_bridge_auth_token }}" } handle @unauthorized { diff --git a/roles/vhosts/xworkmate_bridge/tasks/validate.yml b/roles/vhosts/xworkmate_bridge/tasks/validate.yml index d9b5129..d597153 100644 --- a/roles/vhosts/xworkmate_bridge/tasks/validate.yml +++ b/roles/vhosts/xworkmate_bridge/tasks/validate.yml @@ -11,10 +11,9 @@ - name: Check Codex route through unified ACP ingress ansible.builtin.uri: - url: "http://127.0.0.1/codex" + url: "https://{{ xworkmate_bridge_domain }}/acp-server/codex" method: GET headers: - Host: "{{ xworkmate_bridge_domain }}" Authorization: "Bearer {{ xworkmate_bridge_auth_token }}" follow_redirects: none status_code: [200, 301, 302, 307, 308, 401, 403, 404, 502] @@ -25,10 +24,9 @@ - name: Check OpenCode route through unified ACP ingress ansible.builtin.uri: - url: "http://127.0.0.1/opencode" + url: "https://{{ xworkmate_bridge_domain }}/acp-server/opencode" method: GET headers: - Host: "{{ xworkmate_bridge_domain }}" Authorization: "Bearer {{ xworkmate_bridge_auth_token }}" follow_redirects: none status_code: [200, 301, 302, 307, 308, 401, 403, 404, 502] @@ -39,10 +37,9 @@ - name: Check Gemini route through unified ACP ingress ansible.builtin.uri: - url: "http://127.0.0.1/gemini" + url: "https://{{ xworkmate_bridge_domain }}/acp-server/gemini" method: GET headers: - Host: "{{ xworkmate_bridge_domain }}" Authorization: "Bearer {{ xworkmate_bridge_auth_token }}" follow_redirects: none status_code: [200, 301, 302, 307, 308, 401, 403, 404, 502] @@ -53,10 +50,9 @@ - name: Check xworkmate-bridge public domain root ansible.builtin.uri: - url: "http://127.0.0.1/" + url: "https://{{ xworkmate_bridge_service_domain }}/" method: GET headers: - Host: "{{ xworkmate_bridge_service_domain }}" Authorization: "Bearer {{ xworkmate_bridge_auth_token }}" follow_redirects: none status_code: [200, 301, 302, 307, 308]