Skip to content

Commit 93bbcd6

Browse files
authored
arch: remove local web control plane (#110)
1 parent ab13d8f commit 93bbcd6

17 files changed

Lines changed: 5 additions & 2640 deletions

.c8rc.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
"all": false,
33
"include": [
44
"slack-bridge/security.mjs",
5-
"control-plane/server.mjs",
65
"bin/scan-extensions.mjs"
76
],
87
"exclude": [

AGENTS.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ bin/ security & operations scripts
2020
prune-session-logs.sh retention cleanup for old pi session logs
2121
config.sh env var validation helper
2222
broker-register.mjs Slack broker workspace registration CLI
23-
control-plane.sh starts the admin web dashboard
2423
doctor.sh system health checks
2524
uninstall.sh clean removal of baudbot
2625
test.sh runs all test suites
@@ -52,9 +51,6 @@ pi/
5251
dev-agent/ coding agent
5352
sentry-agent/ monitoring/triage agent
5453
settings.json pi agent settings
55-
control-plane/
56-
server.mjs admin-owned web dashboard + API (port 28800)
57-
server.test.mjs control plane tests
5854
slack-bridge/
5955
bridge.mjs Slack ↔ agent bridge (legacy Socket Mode)
6056
broker-bridge.mjs Slack ↔ agent bridge (broker pull mode — preferred)

CONFIGURATION.md

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -135,17 +135,6 @@ These are **command-time overrides** for `baudbot update` / `baudbot rollback` (
135135
| `BAUDBOT_UPDATE_REPO` | Update source repo URL/path override | auto-detected / remembered |
136136
| `BAUDBOT_UPDATE_BRANCH` | Update source branch override | remembered / `main` |
137137

138-
### Control Plane
139-
140-
The control plane runs as the admin user, not `baudbot_agent`. These env vars are for the admin's environment.
141-
142-
| Variable | Description | Default |
143-
|----------|-------------|---------|
144-
| `BAUDBOT_CP_PORT` | Control plane listen port | `28800` |
145-
| `BAUDBOT_CP_TOKEN` | Bearer token for API auth | *(empty — no auth, localhost only)* |
146-
147-
Port 28800 is intentionally outside the agent's firewall allowlist — the agent cannot reach the control plane.
148-
149138
### Setup Overrides
150139

151140
Set during `setup.sh` / `baudbot install` via env vars:

SECURITY.md

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -86,18 +86,6 @@ the admin can re-deploy from the untampered source at any time.
8686

8787
**baudbot_agent → admin access**: None. Admin home is `700`, baudbot_agent is not in the admin user's group.
8888

89-
## Control Plane Isolation
90-
91-
The control plane (`control-plane/server.mjs`) is an admin-owned web server on port 28800.
92-
93-
- Runs as the **admin user**, not `baudbot_agent`
94-
- Port 28800 is **not** in the agent's firewall allowlist — the agent cannot reach it
95-
- Provides read-only visibility into agent state (processes, config, sessions)
96-
- Optional bearer token auth (`BAUDBOT_CP_TOKEN`)
97-
- Config endpoint shows which env vars are set, **never** their values
98-
99-
The agent cannot use the control plane to reconfigure or inspect itself.
100-
10189
## Data Flows
10290

10391
```

bin/ci/setup-arch.sh

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ export PATH="/home/baudbot_agent/opt/node-v22.14.0-linux-x64/bin:$PATH"
6969
cd /home/baudbot_admin/baudbot
7070
npm install --ignore-scripts 2>&1 | tail -1
7171
cd slack-bridge && npm install 2>&1 | tail -1
72-
cd ../control-plane && npm install 2>&1 | tail -1
7372
cd ..
7473

7574
echo "=== Running tests ==="

bin/ci/setup-ubuntu.sh

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,6 @@ export PATH="/home/baudbot_agent/opt/node-v22.14.0-linux-x64/bin:$PATH"
107107
cd /home/baudbot_admin/baudbot
108108
npm install --ignore-scripts 2>&1 | tail -1
109109
cd slack-bridge && npm install 2>&1 | tail -1
110-
cd ../control-plane && npm install 2>&1 | tail -1
111110
cd ..
112111

113112
echo "=== Running tests ==="

bin/control-plane.sh

Lines changed: 0 additions & 35 deletions
This file was deleted.

bin/setup-firewall.sh

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -84,10 +84,6 @@ iptables -w -A "$CHAIN" -o lo -p tcp --dport 53 -j ACCEPT
8484
# Allow localhost responses (established connections back to us)
8585
iptables -w -A "$CHAIN" -o lo -m state --state ESTABLISHED,RELATED -j ACCEPT
8686

87-
# ── NOTE: control plane (28800) is intentionally NOT allowed ──────────
88-
# The admin-owned control plane runs on port 28800. The agent must not
89-
# be able to reach it — the default-deny below handles this.
90-
9187
# Block everything else on localhost
9288
iptables -w -A "$CHAIN" -o lo -j LOG --log-prefix "BAUDBOT_LOCAL_BLOCKED: " --log-level 4
9389
iptables -w -A "$CHAIN" -o lo -j DROP

bin/test.sh

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@ JS_TEST_FILES=(
5252
slack-bridge/security.test.mjs
5353
bin/scan-extensions.test.mjs
5454
bin/broker-register.test.mjs
55-
control-plane/server.test.mjs
5655
)
5756

5857
JS_TEST_NAMES=(
@@ -62,7 +61,6 @@ JS_TEST_NAMES=(
6261
"bridge security"
6362
"extension scanner"
6463
"broker register"
65-
"control-plane"
6664
)
6765

6866
run_js_tests() {

0 commit comments

Comments
 (0)