Add authentication: admin/agent bearer tokens for the API, login for the dashboard

control-api: every route now carries a mandatory access level (admin / agent /
open) in a route table. All /api/v1/admin/* require the admin token; the
write calls of validator-agent and prober (self-check, events, results,
complete) require a separate static agent token; register, heartbeat and
fetching the assignment stay open. Tokens come from env vars, are compared in
constant time and never logged. An empty token leaves that level open with a
startup warning (backward compatible).

validator-agent / prober: apiclient sends the agent token only to control-api.

admin-dashboard: login/password (from env) with a stateless HMAC session
cookie, Origin-based CSRF check, per-IP brute-force throttle, HX-Redirect for
htmx polls, logout in the sidebar; the dashboard calls control-api with the
admin token. Login page layout fixed after review.

Also: env plumbing in docker-compose/rxprod-compose/systemd/config examples,
e2e script with token assertions, tests, docs (API, SETUP, USAGE, DASHBOARD,
README), plan and review under docs/changes/, bin/ rebuilt with new
SHA256SUMS.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cmd/admin-dashboard/main.go

@@ -39,11 +39,21 @@ func run(configPath string, log *slog.Logger) error {
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 
+	controlAPIToken := os.Getenv(cfg.ControlAPI.TokenEnv)
+	if controlAPIToken == "" {
+		log.Warn("control-api admin token is not set: calls to control-api are sent without credentials", "env", cfg.ControlAPI.TokenEnv)
+	}
+
 	srv, err := dashboard.New(dashboard.Config{
 		ControlAPIBaseURL:     cfg.ControlAPI.BaseURL,
 		ControlAPITimeout:     time.Duration(cfg.ControlAPI.TimeoutSeconds) * time.Second,
 		LastCompletedCount:    cfg.Overview.LastCompletedCount,
 		OverviewPollIntervalS: cfg.Overview.PollIntervalSeconds,
+		ControlAPIToken:       controlAPIToken,
+		Username:              os.Getenv(cfg.Auth.UsernameEnv),
+		Password:              os.Getenv(cfg.Auth.PasswordEnv),
+		SessionSecret:         os.Getenv(cfg.Auth.SessionSecretEnv),
+		SessionTTL:            time.Duration(cfg.Auth.SessionTTLMinutes) * time.Minute,
 	}, log)
 	if err != nil {
 		return fmt.Errorf("init dashboard: %w", err)

cmd/control-api/main.go

@@ -60,7 +60,16 @@ func run(configPath string, log *slog.Logger) error {
 
 	orch := orchestrator.New(database, osClient, cfg, log)
 
-	srv := httpapi.New(database, orch, log)
+	adminToken := os.Getenv(cfg.Auth.AdminTokenEnv)
+	agentToken := os.Getenv(cfg.Auth.AgentTokenEnv)
+	if adminToken == "" {
+		log.Warn("admin API is open: admin token is not set", "env", cfg.Auth.AdminTokenEnv)
+	}
+	if agentToken == "" {
+		log.Warn("agent write API is open: agent token is not set", "env", cfg.Auth.AgentTokenEnv)
+	}
+
+	srv := httpapi.New(database, orch, log).WithAuth(adminToken, agentToken)
 	httpServer := &http.Server{Addr: cfg.Server.ListenAddr, Handler: srv.Handler()}
 
 	go runOrchestratorLoop(ctx, orch, cfg, log)

cmd/prober/main.go

@@ -31,7 +31,11 @@ func main() {
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 
-	prober := probercore.New(cfg, log)
+	token := os.Getenv(cfg.ControlAPITokenEnv)
+	if token == "" {
+		log.Warn("agent token is not set: result calls will be rejected by an authenticated control-api", "env", cfg.ControlAPITokenEnv)
+	}
+	prober := probercore.New(cfg, log).WithToken(token)
 	if err := prober.Run(ctx); err != nil && err != context.Canceled {
 		log.Error("prober stopped", "err", err)
 		os.Exit(1)

cmd/validator-agent/main.go

@@ -39,7 +39,11 @@ func main() {
 		startStubListeners(ctx, log, *stubPorts)
 	}
 
-	agent := agentcore.New(cfg, log)
+	token := os.Getenv(cfg.ControlAPITokenEnv)
+	if token == "" {
+		log.Warn("agent token is not set: result/event/complete calls will be rejected by an authenticated control-api", "env", cfg.ControlAPITokenEnv)
+	}
+	agent := agentcore.New(cfg, log).WithToken(token)
 	if err := agent.Run(ctx); err != nil && err != context.Canceled {
 		log.Error("agent stopped", "err", err)
 		os.Exit(1)