OUI_XFAB documentation

Security and Deployment

Approved Topology

Browser -> IIS HTTPS / reverse proxy -> OUI static files
                                     -> 127.0.0.1:8008 EAPWebManager
                                     -> 127.0.0.1:8010 OUI access service

The access service is loopback-only. Browsers never connect to port 8010 directly. IIS requires ARR proxying and URL Rewrite; the workstation identity rule overwrites HTTP_X_REAL_IP from {REMOTE_ADDR} and HTTP_X_FORWARDED_PROTO from the direct HTTPS state. HTTP requests to that route receive 403.

The nginx reference configuration uses the same local backend boundary with explicit IPv4 127.0.0.1 forwarding. Do not add an unreviewed proxy before IIS or widen the access-service binding.

Environment Rules

Only src/config/appConfig.ts reads import.meta.env. Development and staging use local/loopback defaults. Production uses the approved direct backend and derives secure same-origin proxy routes when the page is served over HTTPS. Never commit credentials, private endpoints, tickets, or workstation-only paths.

Access Service

The browser-facing access-service route is workstation identity and ticket lookup. The retired administrator HTTP family is not proxied or consumed by the browser. The service stores ticket hashes rather than plaintext tickets and remains separately supervised by the operator.

Required operator checks include /healthz, /readyz, PTR resolution, one successful BindWorkstation redemption, HTTPS rejection over HTTP, the existing port 8008 WebSocket path, and remote failure to reach port 8010.

Release Placement

IIS archives flatten index.html, assets/, and web.config at the archive root and include the runnable oui-access-service/ directory.
Linux/nginx archives flatten index.html, assets/, and nginx.conf at the archive root.
Staging uses immutable release directories and an atomic /var/www/oui symlink switch. Failed post-deploy checks restore the previous symlink.
Production publication is performed only by the protected GitHub release workflow.

Operational Safety

Preserve the access-service Data Protection and SQL key material. Keep mutable secrets and key rings in restricted operator-managed storage, not in deployment artifacts. Do not restart EAPWebManager as part of a static UI deployment.