feat(discord-bridge): dashboard publicat in tailnet prin tailscale serve

https://claude-agent.tailf7372d.ts.net/punte — acelasi tipar ca /echo de pe
moltbot: procesul ramane legat de 127.0.0.1, tailscaled il proxeaza si pune HTTPS.

Montarea sub prefix a cerut doua schimbari:

- toate URL-urile din pagini sunt acum relative, fiindca --set-path TAIE prefixul
  inainte de a proxa (serverul vede /api/status, browserul cere /punte/api/status).
  DASHBOARD_PREFIX ramane necesar doar pentru redirectul de login, si e acceptat
  si intact pe intrare, ca sa mearga si curl direct pe localhost.
- adresa fara slash final (/punte) primeste 301 catre /punte/: altfel URL-urile
  relative s-ar rezolva la radacina hostului, unde proxy-ul nu trimite nimic
  incoace, si panoul ar arata gol fara nicio eroare vizibila.

ops/install.sh configureaza serve-ul daca sudo permite; altfel spune comanda.
Sase teste noi pentru montarea sub prefix (31 in total pe dashboard).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B29CApsP1JkSdjYaGaHpE7

CLAUDE.md

@@ -47,7 +47,7 @@ input/                      # Oracle DMP files for import
 - **Chatbot architecture**: `proxmox/lxc104-flowise/docs/prd.md`
 - **Docker Sandboxes (sbx) — agenți AI izolați**: `proxmox/lxc102-docker/README.md`
 - **Punte Discord → Claude Code (comandă LXC 171 de pe telefon, dintr-un guild privat)**: `proxmox/lxc171-claude-agent/discord-bridge/README.md`
-- **Dashboard de control al punții Discord (stare, restart, orfani, confirmări; tunel SSH pe 18790)**: `proxmox/lxc171-claude-agent/discord-bridge/dashboard/README.md`
+- **Dashboard de control al punții Discord (stare, restart, orfani, confirmări; https://claude-agent.tailf7372d.ts.net/punte)**: `proxmox/lxc171-claude-agent/discord-bridge/dashboard/README.md`
 - **Disaster recovery**: `proxmox/vm109-windows-dr/README.md`
 - **Instalare/migrare Oracle — care director se folosește**: `proxmox/lxc108-oracle/docs/instalare-si-migrare-oracle.md`
 - **ROA Windows setup scripts (XE/SE 21c)**: `proxmox/lxc108-oracle/roa-windows-setup/README.md`

proxmox/lxc171-claude-agent/discord-bridge/README.md

@@ -189,12 +189,15 @@ systemctl --user restart claude-discord         # repornire
 
 Aceleasi lucruri, cu butoane, in **dashboard-ul de control**
 ([dashboard/README.md](dashboard/README.md)) — stare, restart, orfani, confirmari,
-jurnale, la `http://127.0.0.1:18790` (tunel SSH; e legat de localhost intentionat):
+jurnale:
 
-```bash
-ssh -L 18790:127.0.0.1:18790 -N claude@10.0.20.171 &
-grep DASHBOARD_TOKEN ~/.claude-discord/env
 ```
+https://claude-agent.tailf7372d.ts.net/punte     # din tailnet (ca /echo la moltbot)
+grep DASHBOARD_TOKEN ~/.claude-discord/env       # tokenul de login
+```
+
+Procesul e legat de `127.0.0.1:18790`; in tailnet il publica `tailscale serve`.
+Fara Tailscale: `ssh -L 18790:127.0.0.1:18790 -N claude@10.0.20.171`.
 
 | Fisier | Ce e |
 |--------|------|

proxmox/lxc171-claude-agent/discord-bridge/dashboard/README.md

@@ -6,7 +6,8 @@ de server (stdlib `http.server`, zero dependinte), aceiasi tokeni de design, ace
 tipar de endpoint-uri ca in `handlers/eco.py`.
 
 ```
-http://127.0.0.1:18790
+https://claude-agent.tailf7372d.ts.net/punte      <- din tailnet, ca /echo la moltbot
+http://127.0.0.1:18790                            <- local / prin tunel SSH
 ```
 
 ## Ce arata si ce poate face
@@ -97,15 +98,43 @@ systemctl --user enable --now claude-discord-dashboard
 ```
 
 Setari optionale in `~/.claude-discord/env`: `DASHBOARD_BIND` (implicit `127.0.0.1`),
-`DASHBOARD_PORT` (implicit `18790`).
+`DASHBOARD_PORT` (implicit `18790`), `DASHBOARD_PREFIX` (implicit gol; `/punte` cand e
+publicat prin `tailscale serve --set-path`).
 
 ## Acces
 
-Fiind legat de localhost, se ajunge la el prin tunel SSH — la fel ca la dashboard-ul
+### Prin Tailscale (recomandat)
-lui echo:
+
+Exact tiparul de la echo (`https://moltbot.tailf7372d.ts.net/echo/`): procesul ramane
+legat de `127.0.0.1`, iar `tailscaled` e singurul care ajunge la el si il publica in
+tailnet, cu HTTPS si certificat de la Tailscale.
+
+```bash
+sudo tailscale serve --bg --set-path /punte http://127.0.0.1:18790
+tailscale serve status
+```
+
+```
+https://claude-agent.tailf7372d.ts.net/punte
+```
+
+Vizibil doar in tailnet (`tailnet only`) — nu e `funnel`, deci nu iese in internet.
+Configuratia e persistata de `tailscaled`, deci supravietuieste repornirilor.
+
+**Montarea sub prefix**, cele doua capcane si cum sunt rezolvate:
+
+- `tailscale serve --set-path` **taie** prefixul inainte de a proxa, deci serverul
+  vede `/api/status`, nu `/punte/api/status`. Toate URL-urile din pagini sunt
+  **relative**, deci merg la orice prefix, fara sa stie de el. `DASHBOARD_PREFIX`
+  e nevoie doar pentru redirecturi si e acceptat si intact pe intrare (`curl`
+  direct pe localhost cu `/punte/...` functioneaza).
+- adresa **fara slash final** (`/punte`) ar rezolva `api/status` la radacina
+  hostului, unde proxy-ul nu mai trimite nimic incoace; de aceea forma fara slash
+  primeste un 301 catre `/punte/`.
+
+### Prin tunel SSH
 
 ```bash
-# de pe statia de lucru (direct sau prin Tailscale: 100.95.55.51)
 ssh -L 18790:127.0.0.1:18790 -N claude@10.0.20.171 &
 # apoi http://localhost:18790
 ```
@@ -119,7 +148,8 @@ cd proxmox/lxc171-claude-agent/discord-bridge
 python3 -m pytest tests/test_dashboard.py -q
 ```
 
-25 de teste, fara retea si fara `systemctl` real (dublura inregistreaza apelurile).
+31 de teste, fara retea si fara `systemctl` real (dublura inregistreaza apelurile).
 Acopera autentificarea, faptul ca unitatea nu poate fi aleasa din cerere, blocajul pe
 tur in zbor si trecerea cu `force`, traversarea de cale in `request_id`, `state.json`
-corupt si verificarea de regresie pentru `deny(ssh)`.
+corupt, montarea sub prefix (cu si fara slash final) si verificarea de regresie
+pentru `deny(ssh)`.

proxmox/lxc171-claude-agent/discord-bridge/dashboard/api.py

@@ -60,6 +60,27 @@ def infra_log() -> Path:
 COOKIE_NAME = "dashboard"
 COOKIE_MAX_AGE = 60 * 60 * 24 * 30
 
+
+def mount_prefix() -> str:
+    """Prefixul sub care e montat panoul (`DASHBOARD_PREFIX`, ex. `/punte`).
+
+    `tailscale serve --set-path /punte` TAIE prefixul inainte de a proxa, deci in
+    mod normal aici ajunge `/api/status`. Prefixul e acceptat totusi si intact,
+    pentru cazul unui proxy care nu taie si pentru `curl` direct pe localhost.
+    Paginile nu depind de el: toate URL-urile din HTML sunt relative.
+    """
+    pfx = (config.get("DASHBOARD_PREFIX") or "").strip().rstrip("/")
+    if pfx and not pfx.startswith("/"):
+        pfx = "/" + pfx
+    return pfx
+
+
+def strip_prefix(path: str) -> str:
+    pfx = mount_prefix()
+    if pfx and (path == pfx or path.startswith(pfx + "/")):
+        return path[len(pfx):] or "/"
+    return path
+
 _TOKEN: str | None = None
 
 
@@ -378,19 +399,34 @@ class Handler(SimpleHTTPRequestHandler):
 
     # --- GET -----------------------------------------------------------
     def do_GET(self):
-        path = urlparse(self.path).path
+        raw = urlparse(self.path).path
+        path = strip_prefix(raw)
+        if path == "/" and not raw.endswith("/"):
+            # `/punte` fara slash final: URL-urile relative din pagina s-ar
+            # rezolva la radacina hostului (`/api/status`), unde proxy-ul nu mai
+            # trimite nimic incoace. Fortam forma cu slash.
+            self.send_response(301)
+            self.send_header("Location", raw + "/")
+            self.send_header("Content-Length", "0")
+            self.end_headers()
+            return
         if path.startswith("/api/"):
             if not self.authed():
                 return self.deny()
             return self.route_get(path)
         if path in ("/", "/index.html") and not self.authed():
+            # Prefixul reintra AICI in mod deliberat. Un "/login.html" absolut ar
+            # arunca browserul in radacina hostului (alt serviciu), iar un
+            # "login.html" relativ se rezolva gresit cand adresa vine fara slash
+            # final (`/punte` -> `/login.html`). Cu prefixul reatasat, ambele
+            # forme ajung unde trebuie, si direct pe localhost la fel: calea de
+            # intrare e curatata oricum de `strip_prefix`.
             self.send_response(302)
-            self.send_header("Location", "/login.html")
+            self.send_header("Location", mount_prefix() + "/login.html")
             self.send_header("Content-Length", "0")
             self.end_headers()
             return
-        if path == "/":
+        self.path = "/index.html" if path == "/" else path
-            self.path = "/index.html"
         return super().do_GET()
 
     def route_get(self, path: str):
@@ -428,7 +464,7 @@ class Handler(SimpleHTTPRequestHandler):
 
     # --- POST ----------------------------------------------------------
     def do_POST(self):
-        path = urlparse(self.path).path
+        path = strip_prefix(urlparse(self.path).path)
         if path == "/api/auth/login":
             return self.handle_login()
         if path == "/api/auth/logout":

proxmox/lxc171-claude-agent/discord-bridge/dashboard/index.html

@@ -4,8 +4,8 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Punte Discord — control</title>
-<link rel="stylesheet" href="/static/tokens.css">
+<link rel="stylesheet" href="static/tokens.css">
-<link rel="stylesheet" href="/static/app.css">
+<link rel="stylesheet" href="static/app.css">
 </head>
 <body>
 
@@ -102,7 +102,7 @@ function toast(msg, kind) {
 }
 async function api(path, opts) {
   var r = await fetch(path, opts || {});
-  if (r.status === 401) { location.href = '/login.html'; throw new Error('neautentificat'); }
+  if (r.status === 401) { location.href = 'login.html'; throw new Error('neautentificat'); }
   var data = null;
   try { data = await r.json(); } catch (e) { data = {}; }
   return { ok: r.ok, status: r.status, data: data };
@@ -130,7 +130,7 @@ function mb(bytes) {
 // ── stare ─────────────────────────────────────────────────────
 var busy = false;
 async function refresh() {
-  var res = await api('/api/status');
+  var res = await api('api/status');
   if (!res.ok) return;
   var s = res.data, svcInfo = s.service;
 
@@ -173,7 +173,7 @@ async function refresh() {
 }
 
 async function refreshApprovals() {
-  var res = await api('/api/approvals');
+  var res = await api('api/approvals');
   if (!res.ok) return;
   var list = res.data.approvals || [];
   document.getElementById('approvals').innerHTML = list.length ? list.map(function (a) {
@@ -188,13 +188,13 @@ async function refreshApprovals() {
 }
 
 async function decide(id, d) {
-  var res = await post('/api/approvals/decide', { request_id: id, decision: d });
+  var res = await post('api/approvals/decide', { request_id: id, decision: d });
   toast(res.ok ? 'Trimis: ' + d : ('Eșuat: ' + (res.data.error || res.status)), res.ok ? 'ok' : 'bad');
   refresh();
 }
 
 async function refreshDoctor() {
-  var res = await api('/api/doctor');
+  var res = await api('api/doctor');
   if (!res.ok) return;
   document.getElementById('doctor').innerHTML = (res.data.checks || []).map(function (c) {
     return '<div class="check ' + (c.pass ? 'pass' : 'fail') + '"><span class="mark">' +
@@ -210,7 +210,7 @@ async function svc(action, force) {
       !confirm('Sigur „' + action + '” pe serviciul punții?')) return;
   busy = true;
   try {
-    var res = await post('/api/service', { action: action, force: !!force });
+    var res = await post('api/service', { action: action, force: !!force });
     if (res.status === 409) {
       var n = (res.data.inflight || []).length;
       if (confirm(n + ' fir(e) au tur în desfășurare. Le întrerupi?')) {
@@ -232,7 +232,7 @@ async function svc(action, force) {
 
 async function cleanup(dry) {
   if (!dry && !confirm('Omor procesele orfane găsite?')) return;
-  var res = await post('/api/cleanup', { dry_run: dry });
+  var res = await post('api/cleanup', { dry_run: dry });
   if (!res.ok) { toast('Eșuat: ' + (res.data.error || res.status), 'bad'); return; }
   var n = (res.data.orphans || []).length;
   toast(dry ? (n + ' orfan(i) găsiți') : (n + ' orfan(i) tratați'), n ? 'bad' : 'ok');
@@ -241,14 +241,14 @@ async function cleanup(dry) {
 
 async function restartSelf() {
   if (!confirm('Repornesc dashboard-ul? Pagina se reîncarcă în câteva secunde.')) return;
-  await post('/api/restart-self', {});
+  await post('api/restart-self', {});
   toast('Dashboard-ul repornește…', '');
   setTimeout(function () { location.reload(); }, 4000);
 }
 
 async function logout() {
-  await post('/api/auth/logout', {});
+  await post('api/auth/logout', {});
-  location.href = '/login.html';
+  location.href = 'login.html';
 }
 
 // ── jurnal ────────────────────────────────────────────────────
@@ -257,7 +257,7 @@ function setLog(which) { logFile = which; refreshLogs(); }
 async function refreshLogs() {
   document.getElementById('tabBot').className = 'small' + (logFile === 'bot' ? ' primary' : '');
   document.getElementById('tabInfra').className = 'small' + (logFile === 'infra' ? ' primary' : '');
-  var res = await api('/api/logs?lines=300&file=' + logFile);
+  var res = await api('api/logs?lines=300&file=' + logFile);
   if (!res.ok) return;
   var el = document.getElementById('log');
   el.textContent = (res.data.lines || []).join('\n') || '(gol)';

proxmox/lxc171-claude-agent/discord-bridge/dashboard/login.html

@@ -4,8 +4,8 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Autentificare — Punte Discord</title>
-<link rel="stylesheet" href="/static/tokens.css">
+<link rel="stylesheet" href="static/tokens.css">
-<link rel="stylesheet" href="/static/app.css">
+<link rel="stylesheet" href="static/app.css">
 </head>
 <body>
 <div class="login">
@@ -27,12 +27,12 @@ document.getElementById('f').addEventListener('submit', async function (e) {
   var err = document.getElementById('err');
   err.textContent = '';
   try {
-    var r = await fetch('/api/auth/login', {
+    var r = await fetch('api/auth/login', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ token: document.getElementById('token').value })
     });
-    if (r.ok) { location.href = '/'; return; }
+    if (r.ok) { location.href = './'; return; }
     err.textContent = 'Token invalid.';
   } catch (ex) {
     err.textContent = 'Serverul nu răspunde.';

proxmox/lxc171-claude-agent/discord-bridge/ops/env.example

@@ -60,3 +60,7 @@ DASHBOARD_TOKEN=
 # spre tot clusterul, deci accesul se face prin tunel SSH, nu expus in LAN.
 DASHBOARD_BIND=127.0.0.1
 DASHBOARD_PORT=18790
+# Prefixul sub care il publica `tailscale serve --set-path` (vezi dashboard/README.md).
+# Gol = montat in radacina. Paginile au URL-uri relative, deci prefixul e nevoie
+# doar pentru redirecturi.
+DASHBOARD_PREFIX=/punte

proxmox/lxc171-claude-agent/discord-bridge/ops/install.sh

@@ -137,6 +137,25 @@ else
     rm -f "$TMP_CRON"
 fi
 
+# --- 6b. tailscale serve pentru dashboard ----------------------------------
+# Publica panoul in tailnet la https://<host>.<tailnet>.ts.net/punte, exact ca
+# dashboard-ul lui echo de pe LXC 110 (/echo). Serviciul ramane legat de
+# 127.0.0.1: tailscaled e singurul care ajunge la el.
+DASH_PREFIX="$(grep -E '^DASHBOARD_PREFIX=' "$STATE_DIR/env" 2>/dev/null | cut -d= -f2- || true)"
+DASH_PREFIX="${DASH_PREFIX:-/punte}"
+DASH_PORT="$(grep -E '^DASHBOARD_PORT=' "$STATE_DIR/env" 2>/dev/null | cut -d= -f2- || true)"
+DASH_PORT="${DASH_PORT:-18790}"
+if ! command -v tailscale >/dev/null 2>&1; then
+    warn "tailscale lipseste — dashboard-ul ramane doar pe 127.0.0.1:$DASH_PORT (tunel SSH)"
+elif tailscale serve status 2>/dev/null | grep -q "$DASH_PREFIX proxy"; then
+    info "tailscale serve: $DASH_PREFIX exista deja"
+elif sudo -n tailscale serve --bg --set-path "$DASH_PREFIX" "http://127.0.0.1:$DASH_PORT" >/dev/null 2>&1; then
+    info "tailscale serve: https://$(tailscale status --json | python3 -c 'import json,sys;print(json.load(sys.stdin)["Self"]["DNSName"].rstrip("."))')$DASH_PREFIX"
+else
+    warn "nu am putut configura tailscale serve; ruleaza manual:"
+    warn "  sudo tailscale serve --bg --set-path $DASH_PREFIX http://127.0.0.1:$DASH_PORT"
+fi
+
 # --- 7. mail ---------------------------------------------------------------
 if command -v mail >/dev/null 2>&1; then
     info "binarul mail: $(command -v mail)"

proxmox/lxc171-claude-agent/discord-bridge/tests/test_dashboard.py

@@ -334,3 +334,50 @@ def test_ruta_necunoscuta(server):
     server.login()
     assert server.call("/api/nope")[0] == 404
     assert server.call("/api/nope", {})[0] == 404
+
+
+# --- montare sub prefix (tailscale serve --set-path) ------------------------
+
+@pytest.fixture()
+def server_cu_prefix(server, state_dir):
+    """Acelasi server, dar cu DASHBOARD_PREFIX=/punte in env."""
+    (state_dir / "env").write_text(
+        "DASHBOARD_TOKEN=secret-de-test\nDASHBOARD_PREFIX=/punte\n", encoding="utf-8")
+    config.reload(state_dir)
+    return server
+
+
+def test_prefixul_e_normalizat():
+    assert api.strip_prefix("/api/status") == "/api/status"
+
+
+def test_rutele_merg_si_cu_prefix_si_fara(server_cu_prefix):
+    """Proxy-ul taie prefixul, dar `curl` direct pe localhost nu — merg ambele."""
+    server_cu_prefix.login()
+    assert server_cu_prefix.call("/api/status")[0] == 200
+    assert server_cu_prefix.call("/punte/api/status")[0] == 200
+
+
+def test_prefixul_gol_nu_taie_nimic(server):
+    server.login()
+    assert server.call("/api/status")[0] == 200
+    assert server.call("/punte/api/status")[0] == 404
+
+
+def test_redirect_de_login_pastreaza_prefixul(server_cu_prefix):
+    """Un `/login.html` absolut ar arunca browserul in radacina hostului."""
+    status, _, resp = server_cu_prefix.call("/punte/")
+    assert status == 200
+    assert resp.url.endswith("/punte/login.html")
+
+
+def test_calea_fara_slash_final_e_redirectionata(server_cu_prefix):
+    """`/punte` fara slash ar rezolva `api/status` la radacina hostului."""
+    _, _, resp = server_cu_prefix.call("/punte")
+    assert resp.url.endswith("/punte/login.html")
+
+
+def test_static_servit_si_sub_prefix(server_cu_prefix):
+    server_cu_prefix.login()
+    status, data, _ = server_cu_prefix.call("/punte/static/app.css")
+    assert status == 200 and ".card" in data["_html"]