46 lines
1.6 KiB
Markdown
46 lines
1.6 KiB
Markdown
# platform-gateway
|
|
|
|
Bun + Hono service for mobility platform access control.
|
|
|
|
This service is intentionally separate from LMS APIs. LMS decides education-domain eligibility, while this gateway owns platform access grants, session ownership, agent command proxying, connection status, monitoring events, release, and emergency-stop workflows.
|
|
|
|
## Run
|
|
|
|
```bash
|
|
bun install
|
|
bun run dev
|
|
```
|
|
|
|
Default URL: `http://localhost:4500`
|
|
|
|
## Core APIs
|
|
|
|
- `GET /health`
|
|
- `GET /api/platforms`
|
|
- `GET /api/platforms/:id/status`
|
|
- `GET /api/connections`
|
|
- `POST /api/platform-access-grants`
|
|
- `DELETE /api/platform-access-grants/:grantId`
|
|
- `POST /api/platform-sessions`
|
|
- `POST /api/platforms/:id/commands`
|
|
- `POST /api/platforms/:id/release`
|
|
- `POST /api/platforms/:id/emergency-stop`
|
|
- `GET /api/events`
|
|
|
|
## Network Model
|
|
|
|
Students and instructors never connect directly to Headscale/Tailscale device endpoints. Clients call this gateway only. The gateway verifies auth, checks platform grants/session ownership, records audit context, and proxies allowed operations to the mobility agent running on each platform node.
|
|
|
|
## Kubernetes Tailscale Sidecar
|
|
|
|
The Kubernetes deployment runs a Tailscale sidecar in the same network namespace as
|
|
the gateway. Create the one-time Headscale key secret before the first deployment:
|
|
|
|
```bash
|
|
kubectl -n studio-system create secret generic platform-gateway-tailscale-auth \
|
|
--from-literal=authkey='tskey-auth-...'
|
|
```
|
|
|
|
The sidecar persists its machine state in `platform-gateway-tailscale-state`, so
|
|
subsequent Gateway pod restarts do not consume another pre-auth key.
|