docs+feat: Fly.io Agent Gateway docs, and gate internal sections behind auth - #48
Merged
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
shamwari-docs-ai | 552dd4b | Commit Preview URL Branch Preview URL |
Jul 31 2026, 04:18 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nyuchi-docs-mcp | 552dd4b | Commit Preview URL Branch Preview URL |
Jul 31 2026, 04:19 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nyuchi-docs | 552dd4b | Commit Preview URL Branch Preview URL |
Jul 31 2026, 04:19 PM |
Rewrite in full - the page still described the Vercel phase (domain, build files, port model, deploy commands) after the gateway moved to Fly.io. Covers fundi.nyuchi.com, the single-port fly.toml, the config.yaml chown fix and its durability caveat, dedicated IPs, and a History section. Adds a Fly.io subsection to the deployment overview stub and moves the cross-link there from Vercel.
Marks deployment/* and mzizi-tools/*, tools/* as `visibility: internal` in frontmatter (site/src/content.config.ts extends docsSchema with the field). scripts/generate-internal-paths.mjs scans that frontmatter at build time and emits the manifest both surfaces below read. - site: adds a `main` worker (src/worker/gate.ts) in front of the Workers Static Assets binding — internal pages redirect to a WorkOS OIDC login (PKCE, session cookie is the WorkOS ID token itself, re-verified on each request via JWKS) and fall through to assets on success; public pages are untouched. - nyuchi-docs-mcp-worker: verifies each MCP caller's own bearer token (src/auth.ts) before deciding whether to surface internal content. read_page denies internal paths outright for unauthenticated callers, and forwards a shared INTERNAL_FETCH_KEY on the internal fetch for authorized ones so that read skips the browser OIDC flow. search_docs/ask_docs filter internal URLs out of citations for unauthenticated callers as a defensive backstop — the AI Search index is built from a public crawl, so it shouldn't contain internal content in the first place. Known limitation, not solved here: if the AI Search crawler is ever allowlisted past the site gate, search_docs/ask_docs would need the crawler's ingestion to respect visibility too, not just this filter. Secrets needed post-merge (not committed): WORKOS_CLIENT_ID/SECRET + WORKOS_ISSUER for a new "Nyuchi Docs" WorkOS Connect app (redirect URI https://docs.nyuchi.com/oauth/callback) on the site worker, and a shared INTERNAL_FETCH_KEY on both workers.
bryanfawcett
force-pushed
the
claude/docker-deployment-setup-thgk8o
branch
from
July 31, 2026 16:18
47587b7 to
552dd4b
Compare
bryanfawcett
marked this pull request as ready for review
July 31, 2026 16:18
This was referenced Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
deployment/agentgateway.mdxand thedeployment/overview.mdxcross-link for the actual current state:nyuchi/agentgatewaymoved from Vercel to Fly.io (fundi.nyuchi.com, single-portfly.toml, dedicated IPs, theconfig.yaml--chownfix, the ephemeral-filesystem and new-port caveats). Previously merged content here (docs(deployment): document agentgateway's Docker deploy on Vercel #45/docs(deployment): explicitly disable agentgateway's admin UI #46/docs(deployment): document the OIDC admin UI and OIDC_COOKIE_SECRET #47) still described the Vercel phase.deployment/*,mzizi-tools/*, andtools/*visibility: internalin frontmatter (site/src/content.config.tsextendsdocsSchema).site/scripts/generate-internal-paths.mjsscans that frontmatter at build time into a manifest both surfaces below consume.site: adds amainworker (src/worker/gate.ts) in front of the existing Workers Static Assets binding. Internal pages redirect to a WorkOS OIDC login (PKCE; the session cookie is the WorkOS ID token itself, re-verified via JWKS on each request); public pages are untouched — same assets-only behavior as before.nyuchi-docs-mcp-worker: verifies each MCP caller's own bearer token (src/auth.ts) before deciding whether to surface internal content.read_pagedenies internal paths outright for unauthenticated callers, and forwards a sharedINTERNAL_FETCH_KEYon the internal fetch for authorized ones so that read skips the browser OIDC flow.search_docs/ask_docsfilter internal URLs out of citations for unauthenticated callers as a defensive backstop.Known limitation, not solved here: the AI Search index backing
search_docs/ask_docsis built from a public crawl, so it shouldn't contain internal content regardless of caller auth — if the crawler is ever allowlisted past the site gate, its ingestion would need to respectvisibilitytoo, not just the MCP-side filter.Secrets needed post-merge (not committed):
WORKOS_CLIENT_ID/WORKOS_CLIENT_SECRETfor a new "Nyuchi Docs" WorkOS Connect app (redirect URIhttps://docs.nyuchi.com/oauth/callback) on the site worker, plus a sharedINTERNAL_FETCH_KEYset on both workers viawrangler secret put.Test plan
pnpm -r build— all packages build clean, including the newsiteworker (wrangler deploy --dry-run) andnyuchi-docs-mcp-worker(tsc --noEmit+ dry-run)pnpm -r test— 35 existing tests pass unchangedfundi.nyuchi.com)nyuchi-docs-mcp-worker's bearer-auth path against a real WorkOS token once the "Nyuchi Docs" Connect app existsGenerated by Claude Code