3.5 KiB
Spectator monitor
A separate loopback service serves a public, read-only projection of the realm.
It never forwards viewer paths, methods, cookies, authorization headers or query
parameters to the administrative application. It uses a fixed local GET to
http://127.0.0.1:8787/api/state, caches the sanitized result for ten seconds, and
marks delayed observations. Visitors refresh every fifteen seconds.
Published fields: online bot names, class, race, level, faction, zone, guild; observed bot parties; guild goals and progress; confirmed social activity. Only autonomous bot-to-bot reply transcripts are public. Human conversations, whispers, memories, account/character IDs, tokens, configuration and PC telemetry are excluded. All text is rendered with textContent, never HTML interpolation. The HTTP service allows explicit public assets and read-only projections described below. Mutation methods return 405; administrative command paths return 404.
Install and publish
Run as the realm owner from the repository:
python3 scripts/test-spectator.py
python3 deploy/playable/install-spectator.py
The user service restarts automatically and listens only on 127.0.0.1:8790.
User lingering, already used by runtime recovery, is required for boot startup.
Keep the existing private Tailscale Serve dashboard on HTTPS 443. Publish only
the spectator service on a separate HTTPS port:
sudo tailscale funnel --bg --https=8443 http://127.0.0.1:8790
If Tailscale presents a Funnel enablement link, the tailnet owner must complete
that authorization. Verify tailscale funnel status lists only port 8443 as
public and port 443 remains tailnet-only. Share the printed HTTPS URL including
:8443. Visitors do not need Tailscale. This is a public link, without a password.
The host PC, Ubuntu VM and Tailscale must remain running.
Do not publish port 8787 or 8788, or change the administrative listener into a Funnel. Hiding controls in the browser would not protect their APIs.
To turn public access off without disturbing the private dashboard:
sudo tailscale funnel --https=8443 off
To stop the local spectator service:
systemctl --user disable --now azerothai-spectator
After changing spectator source or assets, restart its service:
systemctl --user restart azerothai-spectator
Shared dashboard (visitor edition)
The public root now serves the application's /visitor route, which uses the
same React dashboard and CSS as the administrator. Navigation, filters, profiles,
recipe details and the world monitor remain usable. Editing forms and GM inputs
are disabled; the action dispatcher also refuses writes in visitor mode.
The public server independently rejects every mutation method, including server
actions, and never proxies a viewer-selected backend route or request headers.
/api/state is an explicit public projection shaped for the shared UI. Bot memory
views contain confirmed shared social history, not private player conversations
or operator-injected memories. The event stream is a polling view of that public
history. /api/health, /api/world-monitor and /api/operations return selected
read-only indicators. Native account identifiers, raw command queues, credentials,
endpoint URLs and private maintenance logs are omitted. Built JavaScript/CSS/font
assets are served from dist/client with traversal and source-map requests denied.
Build with pnpm build before restarting azerothai-runtime and
azerothai-spectator. The existing Funnel address and private admin address stay
separate. No cache actions are added.