Rewrite Lab Instance service links to reverse-proxy vhost

[italovalcy]

What

Two coupled halves of the same reverse-proxy feature.

1. Dashboard — rewrite Lab Instance service links to a reverse-proxy vhost.
On the Lab Instance view, each web service link currently points at a NodePort URL (node IP + node port). When a reverse proxy fronts the cluster, those same services are reachable at a per-service vhost. This change makes the page prefer that vhost when it is live.

A new optional setting PROXY_DOMAIN enables the behavior. On page load, a small JS routine probes each candidate vhost and, if it responds with a success/redirect, swaps the link's href to the proxy URL. On any failure it silently keeps the original NodePort link.

2. scripts/k8s_nginx_revproxy/ — the server-side counterpart.
A standalone daemon that actually makes those vhosts exist. It polls the Kubernetes API, matches NodePort services to their running+ready pods, and renders one nginx server{}/upstream{} per service, validating with nginx -t and reloading only on change (rolling back on bad config).

Shared naming scheme: {service.spec.ports.port}-{service.metadata.name}.{PROXY_DOMAIN}. The dashboard builds this hostname to link users to a service; the daemon publishes the same hostname. Only http/https services are proxied. The dashboard always links to the vhost over https:// (the nginx proxy terminates TLS and translates https->http to the NodePort backend); an http:// link would be blocked as mixed content on the https dashboard.

Changes

Dashboard

• apps/config.py — add PROXY_DOMAIN (env var, empty by default = feature disabled).
• apps/controllers/kubernetes.py — get_lab_resources now also returns services_proxy, a list index-aligned with services, each entry being the domain-free {scheme}://{port}-{service-name} prefix (the scheme marks web-service eligibility). The existing services tuple [port_name, url] is unchanged.
• apps/home/routes.py — view_lab_instance reads PROXY_DOMAIN and, for http(s) services, emits an always-https:// candidate URL https://{port}-{service-name}.{PROXY_DOMAIN} passed to the template.
• apps/templates/pages/lab_instance_view.html — service anchors gain a data-proxy-url attribute; a probeProxyLink routine fetches each candidate with redirect: 'manual' and a 5s AbortController timeout, swapping href on a 2xx/3xx response.
• CHANGELOG.md — entry under [UNRELEASED].

scripts/k8s_nginx_revproxy/

• k8s_nginx_revproxy.py — the daemon: multi-kubeconfig failover, per-request timeouts, optional SOCKS5 tunnel, per-service annotation overrides (hostname/scheme/port/enable), opt-in mode, and --dry-run/--once.
• README.md — what it does, the naming scheme, prerequisites (wildcard DNS + TLS, RBAC), full config reference, and how to run it manually or under systemd.
• NGINX_SETUP.md — tuned & hardened nginx install guide (Debian 12).
• k8s-nginx-revproxy.service — systemd unit template with sandboxing, plus a documented systemd-managed SSH tunnel setup for reaching the API.
• requirements.txt — Python deps (pinned).

Reviewer notes

• The dashboard links to the vhost over https:// and probes it cross-origin (the vhost is a different host than the dashboard). With redirect: 'manual', a 3xx is detected reliably (surfaces as an opaqueredirect, no CORS headers needed). A bare 2xx is only readable if the reverse proxy sends Access-Control-Allow-Origin; without it, fetch rejects and the link stays on the NodePort URL (safe fallback).
• The services tuple shape is unchanged, so the existing test_k8s_tape.py assertions still hold. Full suite: 627 passed.
• The daemon is standalone tooling under scripts/ (not imported by the app); python -m py_compile and --help verified.

🤖 Generated with Claude Code