feat(maestro): maestro-web standalone binary + reverse-proxy (NAP-241)

New crate crates/maestro-web/: axum server that

* embeds the web/dist SPA bundle via include_dir! (graceful placeholder when
  pnpm build hasn't run yet — keeps fresh checkouts compiling)
* reverse-proxies /api/* HTTP to a co-located daemon (default
  http://127.0.0.1:7070) via reqwest, stripping hop-by-hop headers
* reverse-proxies /api/attach/:id and /api/events WebSockets via
  tokio_tungstenite::connect_async + a tokio task pumping both directions
* reads bind_addr / daemon_url / dev_proxy_target from the new [web]
  config section; env-var overrides MAESTRO_WEB_BIND_ADDR / _DAEMON_URL /
  _DEV_PROXY_TARGET

Integration tests spin up a mock daemon + maestro-web pair on random ports
and verify HTTP forward, SPA fallback, WS echo, and 502 on unreachable
daemon.

Adds a top-level Justfile (`just web` = pnpm install + pnpm build + cargo
build), crates/maestro-web/README.md (config + trust model + dev workflow),
and a docs/INSTALL.md section on optional web UI install.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-05-26 18:23:14 +00:00
co-authored by Claude Opus 4.7
parent 98dbf3d06d
commit bc3237287f
11 changed files with 1032 additions and 0 deletions
+24
View File
@@ -48,6 +48,30 @@ The wizard:
Both binaries land in `~/.cargo/bin` — make sure that's on your `$PATH`.
## Adding the browser UI (optional)
`maestro-web` is a separate binary that serves the SPA bundle and reverse-
proxies API calls to a co-located `maestrod`. Install it where you want a
browser UI:
```sh
pnpm -C web install --frozen-lockfile
pnpm -C web build
cargo install --git https://git.naps.pt/naps62/maestro --locked maestro-web
```
…or, from a checkout, `just web` then `cargo install --path crates/maestro-web --locked`.
It defaults to binding `127.0.0.1:8080` and proxying to `http://127.0.0.1:7070`
(the daemon's default `bind_addr`). The `[web]` section of
`~/.config/maestro/config.toml` overrides both — see
`crates/maestro-web/README.md`. **Trust model:** anyone who can reach the bind
address can use it; pick `127.0.0.1` for local-only, a WireGuard/LAN address
for one-segment access, never a public IP without adding auth first.
Headless hosts (servers, dev VMs) install only `maestrod`. Hosts where you
want browser access install both.
## Flags
| Flag | Purpose |