Implement Unified API Gateway Proxy for Secure Admin Actions

[google-labs-jules]

Why This Change is Necessary

Previously, the administrative dashboard communicated directly from the client's browser to the unauthenticated backend orchestration service on port 4003. This architecture exposed critical Docker orchestration capabilities (such as listing, starting, and stopping containers) to unauthorized network actors and bypassed authentication checks entirely.

To secure our infrastructure and prevent unauthorized container tampering, we have introduced a Unified API Gateway Proxy. This architecture centralizes authorization logic, hides internal management ports, and ensures that only authenticated administrators can trigger container orchestration commands.

---

What Was Changed

1. Next.js Routing & Session Middleware (my-portfolio/middleware.ts)

• Action: Created/updated the Next.js middleware to intercept and protect route access.
• Detail: Any unauthenticated requests targeting administrative zones (/admin and /dashboard) are immediately redirected to /login.

2. Server-Side API Gateway Proxy Router (my-portfolio/app/api/admin/[[...path]]/route.ts)

• Action: Implemented a server-side catch-all endpoint acting as the unified gateway proxy.
• Detail:
  • Performs strict server-side NextAuth session validation.
  • Forwards valid traffic directly to the backend admin-service.
  • Appends a shared X-Gateway-Secret header to the proxied requests to verify their origin.
  • Returns a 401 Unauthorized status for unverified sessions.

3. Ingress Secret Validation (my-portfolio/server/admin-service/index.js)

• Action: Added custom Express.js middleware to the dockerized admin-service.
• Detail:
  • Validates that all incoming orchestration commands carry the correct X-Gateway-Secret header matching the environment's GATEWAY_SECRET.
  • Rejects any requests attempting to bypass the gateway with a 403 Forbidden response.

4. Client-Side API Migration (my-portfolio/app/admin/page.tsx)

• Action: Refactored client-side metrics and action queries.
• Detail: Completely removed direct references to the backend orchestrator's port (4003). All administrative actions now utilize relative API routes (e.g., /api/admin/containers), preventing the internal port from being exposed to the browser.

---

Verification and Acceptance Criteria

• Route Protection: Unauthenticated access to /admin or /dashboard redirects to /login.
• Secure Connection: Browser network logs confirm zero direct requests to port 4003.
• Secret Verification: Out-of-band requests directly targeting the admin-service without the correct gateway header are rejected with 403 Forbidden.
• Full Functionality: Administrators can successfully query container metrics, as well as start or stop containers, via the proxied dashboard interface.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sparkpage	Ready	Preview, Comment	Jul 22, 2026 7:52am