feat(reddit): proxy-mode client support + deployment guide - #235
Draft
jack-nsheaps[bot] wants to merge 5 commits into
Draft
feat(reddit): proxy-mode client support + deployment guide#235jack-nsheaps[bot] wants to merge 5 commits into
jack-nsheaps[bot] wants to merge 5 commits into
Conversation
Research evaluating an off-the-shelf reverse-proxy stack (Apache APISIX + etcd + Prometheus + Grafana + cloudflared) to let egress-restricted agents reach Reddit via a Cloudflare Zero Trust-fronted proxy. Covers gateway selection, Reddit OAuth-at-proxy, and the CF Access API-token bypass model. Foundation for the reddit plugin proxy-mode deployment docs. https://claude.ai/code/session_01NQDWmCYRS2c3JaJ1spEp3S
Lets the reddit plugin work from egress-restricted environments by routing fetches through a self-hosted reverse-proxy fronted by Cloudflare Zero Trust. Plugin (client) changes: - reddit-fetch.sh: REDDIT_PROXY_URL / REDDIT_PROXY_TOKEN / REDDIT_PROXY_HEADER (off by default). Split fetch-base (proxy) from display-base so output **Link**: lines always point at www.reddit.com. - README + fetch-reddit SKILL: document proxy mode. - version 0.1.1 -> 0.2.0. Deployment (deploy/): off-the-shelf Apache APISIX gateway + etcd + Prometheus + Grafana + cloudflared + token-refresher sidecar, via docker-compose. Per-agent APISIX consumer keys; Reddit OAuth held only by the proxy; per-consumer usage metrics in Grafana. docs/proxy-deployment.md: full operator guide — cloudflared config, the Cloudflare Zero Trust API-token bypass (CF Access Bypass on the API host + APISIX key-auth as the backend validator; UI hosts gated by Allow/owner-email), per-agent token mint/revoke, observability, and a PROVISIONAL nsheaps/iac "arcane" deploy section with TODO(nate) markers pending the deploy contract. https://claude.ai/code/session_01NQDWmCYRS2c3JaJ1spEp3S
jack-nsheaps
Bot
added
the
request-review
Contributor
Plugin Version PreviewPreview only — plugin versions and
|
jack-nsheaps
Bot
changed the title
jack-nsheaps
Bot
added
request-review
jack-nsheaps
Bot
added
request-review
…ting Per scope review: the request was for DOCS describing how to deploy an off-the-shelf proxy plus a client-side proxy-URL setting — not a runnable stack. Remove the over-built deploy/ tree (APISIX+etcd+Prometheus+Grafana +cloudflared+token-refresher, 11 files) which "created the proxy" against the explicit "use something off the shelf" instruction. Kept (as requested): - docs/proxy-deployment.md — now self-contained (inline reference compose + cloudflared config, no dead deploy/ refs); Prometheus/Grafana documented as OPTIONAL observability for the "graphs of which API tokens have most use" ask - reddit-fetch.sh REDDIT_PROXY_URL/TOKEN/HEADER support (the proxy-URL setting) Fixed dead deploy/ links in README.md and fetch-reddit SKILL.md.
nsheaps
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds optional proxy mode to the
redditplugin so agents in egress-restricted environments can reach Reddit through an operator-deployed reverse proxy, plus an operator guide for deploying one from off-the-shelf components.Scope was deliberately reduced after review: this PR ships client-side support + docs only. It does not ship a runnable proxy stack — building the proxy was out of scope ("use something off the shelf").
What's included
scripts/reddit-fetch.sh—REDDIT_PROXY_URL/REDDIT_PROXY_TOKEN/REDDIT_PROXY_HEADERenv-var support. Off by default; when unset, behavior is unchanged (direct towww.reddit.com). Output**Link**:lines always show canonicalwww.reddit.comURLs even when proxied.docs/proxy-deployment.md— self-contained operator guide: reference architecture (APISIX + cloudflared, with optional Prometheus/Grafana for per-token usage graphs), Cloudflare Zero Trust API-token Bypass setup, per-agent token minting/revocation, Reddit OAuth (client_credentials) + token refresh, observability, and a security-risk table. Includes a provisionalnsheaps/iac"arcane" deploy section withTODO(nate):markers pending the deployment contract.README.md+skills/fetch-reddit/SKILL.md— proxy-mode usage sections.docs/research/reddit-proxy-deployment-options.md— research basis for the approach.Removed after review
deploy/stack (docker-compose + APISIX config + bootstrap script + token-refresher daemon + Prometheus + Grafana provisioning, 11 files). The guide now describes how to stand up an off-the-shelf proxy instead of shipping one.Not yet done / blocked
🤖 Generated with Claude Code
https://claude.ai/code/session_01NQDWmCYRS2c3JaJ1spEp3S