max / makenotwork

Enable pom's WAM ticket sink now that WAM enforces auth Failure alerts become tickets rather than email. Held until today because the deployed WAM predated its own require_auth middleware, so sending a token would have meant nothing.

Author: Max Johnson <me@maxj.phd> · 2026-08-15 21:42 UTC

Signed with PGP, not checked

Commit: 3e8e89471ad31b8a1e6144ef6a19a6b3ee344714

Parent: f44d18c

1 file changed, +9 insertions, -6 deletions

M pom/deploy/pom-hetzner.toml +9 -6

			@@ -201,9 +201,12 @@
201	201		# is 404, POST http://127.0.0.1:3000/api/internal/alerts is 401 without a token.
202	202		mnw_url = "http://127.0.0.1:3000"
203	203
204		-	# WAM ticket sink: failure alerts become tickets instead of email. WAM listens on
205		-	# this host, and its token loads from POM_WAM_TOKEN, which must match the WAM
206		-	# node's token. Leave wam_url unset until the deployed WAM actually requires
207		-	# auth: the binary at /opt/wam/wam is an April build that predates the
208		-	# require_auth middleware, so it accepts unauthenticated writes.
209		-	# wam_url = "http://127.0.0.1:7890"
	204	+	# WAM ticket sink: failure alerts become tickets instead of email, and
	205	+	# recoveries stay on email. WAM runs on this host; its token loads from
	206	+	# POM_WAM_TOKEN and must match the value in /etc/wam/env on the WAM node.
	207	+	#
	208	+	# Enabled 2026-08-15, once WAM actually enforced auth. Until that day the
	209	+	# deployed binary was an April build predating its own require_auth middleware,
	210	+	# so a token-sending client would have been talking to a server that ignored
	211	+	# tokens. Both nodes now answer an unauthenticated /tickets with 401.
	212	+	wam_url = "http://127.0.0.1:7890"