feat: refresh admin UI and local deployment

Author: smiggleworth

.github/assets/fitz-social-preview.png

@@ -32,7 +32,7 @@ codegen-units = 1
 ahash = "0.8"
 argon2 = "0.5"
 async-trait = "0.1"
-base64 = "0.22.1"
+base64 = "0.23.0"
 brotli = "8"
 bytes = "1.12"
 chrono = { version = "0.4", features = ["serde"] }
@@ -50,7 +50,7 @@ hyper = { version = "1", features = ["full"] }
 hyper-tungstenite = "0.30"
 hyper-util = { version = "0.1", features = ["server", "tokio"] }
 http-body-util = "0.1"
-jsonwebtoken = { version = "10", features = ["rust_crypto"] }
+jsonwebtoken = { version = "11", features = ["rust_crypto"] }
 lz4_flex = "0.14.0"
 num_cpus = "1.17"
 num-traits = "0.2"

Cargo.lock

@@ -50,6 +50,7 @@ services:
     environment:
       <<: *broker-common-env
       FITZ_AUTH_REQUIRED: "true"
+      FITZ_ASSUME_LOCAL_LOOPBACK_EDGE: "true"
       FITZ_ADMIN_AUTH_MODE: "open"
       FITZ_HTTP_PORT: "${FITZ_AUTH_HTTP_PORT:-4090}"
       FITZ_TCP_PORT: "${FITZ_AUTH_TCP_PORT:-4091}"

Cargo.toml

@@ -39,6 +39,7 @@ services:
     environment:
       <<: *broker-common-env
       FITZ_AUTH_REQUIRED: "true"
+      FITZ_ASSUME_LOCAL_LOOPBACK_EDGE: "true"
       FITZ_ADMIN_AUTH_MODE: "open"
       FITZ_HTTP_PORT: "${FITZ_AUTH_HTTP_PORT:-4090}"
       FITZ_TCP_PORT: "${FITZ_AUTH_TCP_PORT:-4091}"

compose.cloud.yml

@@ -699,6 +699,7 @@ Brokers deployed with runtime auth or protected admin on non-loopback binds must
    - Set `FITZ_ASSUME_EXTERNAL_TLS=true` in TLS-terminated deployments. Fitz fails startup when runtime auth or protected admin is enabled on a non-loopback bind without this explicit assertion
    - Configure exact public `FITZ_WS_ALLOWED_ORIGINS` for browser WebSocket clients; Fitz defaults only to loopback local-development origins
    - HTTP headers, request bodies, WebSocket frames, and total HTTP connection lifetimes are bounded at ingress so unauthenticated clients cannot retain unlimited parser or connection resources
+   - Repo-owned local Compose examples set `FITZ_ASSUME_LOCAL_LOOPBACK_EDGE=true` because Fitz binds inside a container while Docker publishes only to host loopback. The assertion requires loopback browser origins, does not enable HSTS, and is not valid for production
 2. **TCP traffic:**
    - Use a TLS-capable load balancer, sidecar, or private trusted network for raw TCP
    - Disable raw TCP with `FITZ_TCP_ENABLED=false` when only browser traffic is needed

compose.yml

@@ -77,5 +77,6 @@ Do not carry these local-dev conveniences into production:
 - `FITZ_ADMIN_AUTH_MODE=open`
 - `FITZ_JWT_HMAC_SECRET`
 - `FITZ_JWT_ALLOW_INSECURE_HTTP=true`
+- `FITZ_ASSUME_LOCAL_LOOPBACK_EDGE=true`
 - loopback-only or placeholder origins
 - repo compose files as deployment manifests

docs/development/architecture.md

@@ -12,6 +12,7 @@ This page is the central reference for environment variables supported by Fitz r
 | FITZ_TCP_PORT | u16 port | 4091 | Raw TCP listener port. |
 | FITZ_BIND_ADDR | IP or hostname | 0.0.0.0 | Bind address for listeners. |
 | FITZ_ASSUME_EXTERNAL_TLS | true or false | false | Confirms that a trusted external edge terminates TLS and enables TLS-dependent browser behavior such as HSTS. Fitz refuses to start with runtime auth or protected admin on a non-loopback bind unless this is true. Loopback development can leave it unset. |
+| FITZ_ASSUME_LOCAL_LOOPBACK_EDGE | true or false | false | Confirms that a trusted local container edge publishes Fitz listeners only on host loopback. This allows authenticated local Compose without asserting TLS or enabling HSTS, and requires loopback WebSocket and admin origins. Never enable it outside local development. |
 | FITZ_WS_ALLOWED_ORIGINS | Comma-separated exact browser origins, e.g. https://app.example.com | Local loopback origins for ports 3000 and 4090 | Browser WebSocket Origin allowlist. Values are HTTP origins, not wss URLs, and must not include a path, query, fragment, or trailing slash. Public browser deployments should set this to their exact SPA origins. |
 | FITZ_DRAIN_GRACE_SECONDS | Positive integer seconds | 25 | Planned redeploy drain grace. During drain, `/healthz` and `/readyz` fail and new TCP/WebSocket sessions are rejected before active sessions are closed on shutdown. Set lower than the external termination grace. |
 | FITZ_DRAIN_CLOSE_REASON | Non-empty string | broker draining for redeploy | Server close reason recorded when planned drain shutdown closes active sessions. |
@@ -71,6 +72,7 @@ The repo compose files are local-development examples only:
 - `compose.yml`, `compose.cloud.yml`, and `compose.sqrzl.yml` publish only to loopback and are not production deployment manifests.
 - `compose.yml` and `compose.cloud.yml` keep `fitz-auth` on `FITZ_JWT_HMAC_SECRET` by default so `docker compose up` stays the shortest successful path.
 - Those same compose files keep `FITZ_ADMIN_AUTH_MODE=open` because the admin surface is loopback-only and meant for local inspection.
+- Those same compose files set `FITZ_ASSUME_LOCAL_LOOPBACK_EDGE=true` because Fitz binds inside its container while Docker publishes the listeners only on host loopback. This does not assert TLS or enable HSTS.
 - The built-in loopback defaults for `FITZ_WS_ALLOWED_ORIGINS` are only for local development.
 
 To exercise issuer/JWKS plumbing locally instead of the default HMAC flow:
@@ -88,6 +90,7 @@ For authenticated browser or API deployments outside local development:
 - Set `FITZ_AUTH_REQUIRED=true`.
 - Configure runtime JWT verification with `FITZ_JWT_JWKS_MAP`. Do not rely on `FITZ_JWT_HMAC_SECRET` in production.
 - Set `FITZ_ASSUME_EXTERNAL_TLS=true` when TLS terminates outside Fitz.
+- Do not set `FITZ_ASSUME_LOCAL_LOOPBACK_EDGE`; it is only for host-loopback local container publishing.
 - Set `FITZ_WS_ALLOWED_ORIGINS` to the exact public SPA origins allowed to open browser WebSockets.
 - Set `FITZ_ADMIN_AUTH_MODE=protected`, `FITZ_ADMIN_PUBLIC_ORIGIN=https://admin.example.com`, and keep `FITZ_ADMIN_COOKIE_SECURE=true`.
 - Expect protected-admin session cookies to expire on broker restart because the signing key is generated in memory per process.

docs/operations/production-auth.md

@@ -3332,7 +3332,7 @@ components:
           type: array
           items:
             type: string
-          description: Public bootstrap Route Family grants. Empty in protected mode; use the authenticated session endpoint for admin grants after login.
+          description: Provisioned Route Families available to public bootstrap in open mode. Empty in protected mode; use the authenticated session endpoint for admin grants after login.
         route_families_wildcard:
           type: boolean
           description: True only when public bootstrap runs with wildcard Route Family access, such as open admin mode.

docs/user-guides/vars.md

@@ -17,6 +17,7 @@ use once_cell::sync::Lazy;
 use std::path::Path;
 
 const CACHE_CONTROL: &str = "public, max-age=3600";
+const HTML_CACHE_CONTROL: &str = "no-cache";
 const INDEX_PATH: &str = "index.html";
 const PUBLIC_ASSET_ROOT: &str = "/app/public";
 const VARY_ACCEPT_ENCODING: &str = "Accept-Encoding";