Skip to content

solid-pod-sidecar.md

Latest commit

 

History

History
123 lines (99 loc) · 5 KB

solid-pod-sidecar.md

File metadata and controls

123 lines (99 loc) · 5 KB
Raw

Native pod tunnel — cloudflared overlay for the in-container pod

This page covers publishing the in-container solid-pod-rs-server (the pods = "local-solid-rs" adapter, supervised inside the agentbox container) to the public internet via a Cloudflare Zero Trust Tunnel at pods-native.dreamlab-ai.com.

For the pod server itself — features, WAC, did:nostr, provisioning API — see solid-pod.md. This page is only the tunnel leg.

History. An earlier revision of this page described a separate solid-pod-server Docker sidecar on port 8410 with its own Dockerfile.solid-pod. That architecture was deleted in commit ae7f4ec0 (2026-05-17): the server now runs inside the agentbox container under supervisord ([program:solid-pod], generated by flake.nix), listening on 0.0.0.0:8484. If a runbook tells you to point anything at solid-pod-server:8410, it is stale — the correct origin is agentbox:8484.

Overview

Internet
  │  HTTPS pods-native.dreamlab-ai.com
  ▼
Cloudflare Edge ──► cloudflared-pod (tunnel connector, compose overlay)
                          │  http://agentbox:8484   (visionclaw_network DNS)
                          ▼
                   agentbox container ── supervisord [program:solid-pod]
                          │  solid-pod-rs-server, JSS_HOST=0.0.0.0:8484
                          ▼
                   solid-data (named Docker volume, /var/lib/solid)

cloudflared-pod (defined in docker-compose.solid-pods.yml) joins the external visionclaw_network, where the agentbox container is reachable by its compose hostname agentbox. Port 8484 is host-published loopback-only (127.0.0.1:8484, R-003); container-to-container traffic over the shared network does not use the host publish, so nothing is exposed except through the tunnel.

Prerequisites

  • The agentbox stack running with [adapters].pods = "local-solid-rs" and [sovereign_mesh].enabled = true (the supervised solid-pod program is generated only when both hold)
  • visionclaw_network external network exists (created by the agentbox stack)
  • A Cloudflare account with the dreamlab-ai.com zone

Step 1 — Create the Cloudflare Tunnel

  1. Log in to the Cloudflare Zero Trust dashboard.
  2. Go to Networks → Tunnels → Create a tunnel.
  3. Select Cloudflared as the connector type.
  4. Name the tunnel (e.g. dreamlab-native-pods).
  5. Copy the tunnel token — you'll need it in Step 2.
  6. Add a Public Hostname route:
    • Subdomain: pods-native
    • Domain: dreamlab-ai.com
    • Service: http://agentbox:8484
  7. Save. Cloudflare auto-creates the DNS CNAME. The tunnel stays in a "degraded" state until cloudflared-pod connects.

Step 2 — Configure env vars

cp .env.solid-pods.example .env.solid-pods
# Edit .env.solid-pods and fill in:
#   CLOUDFLARE_TUNNEL_TOKEN  — token from Step 1

The pod server's own settings (SOLID_ADMIN_KEY, CORS origins, public base URL) are not read from .env.solid-pods — they reach the supervised process via the agentbox image env and the root .env (compose env_file passthrough):

  • SOLID_ADMIN_KEY — set in the root .env; must match the NATIVE_POD_ADMIN_KEY secret on the Cloudflare auth-worker (wrangler secret put NATIVE_POD_ADMIN_KEY).
  • SOLID_POD_PUBLIC_URL — optional root-.env override of the public base URL; defaults to [integrations.solid_pod_rs].base_url from agentbox.toml, baked at nix build time.
  • CORS ([integrations.solid_pod_rs].allowed_origins) is baked into the supervisor block at nix build time — changing it requires a rebuild.

Step 3 — Start the connector

# From the agentbox directory:
docker compose -f docker-compose.yml \
               -f docker-compose.solid-pods.yml \
               --env-file .env.solid-pods \
               up -d cloudflared-pod

There is nothing to build — the overlay runs the upstream cloudflare/cloudflared image, and the pod server is already part of the agentbox image.

Step 4 — Verify

# Origin health (from the host or any container on visionclaw_network)
docker exec agentbox curl -sf http://localhost:8484/.well-known/solid | jq

# Public endpoint (via Cloudflare Tunnel — wait ~30 s for tunnel to connect)
curl -s https://pods-native.dreamlab-ai.com/.well-known/solid | jq

# CORS as the forum sees it
curl -sI -H 'Origin: https://dreamlab-ai.com' \
  https://pods-native.dreamlab-ai.com/.well-known/solid | grep -i access-control

# Tunnel status
docker logs cloudflared-pod --tail 20

Further reading