testing-preview

Testing the Preview Feature

What It Does

The preview proxy exposes a port running inside a guest Firecracker VM at a public URL. Two implementations exist:

1. Path-based (/v1/machines/{id}/web/{port}/{path...}) — works over SSH tunnel and without wildcard DNS
2. Subdomain-based (<id>--<port>.<PreviewBase>) — requires Caddy on-demand TLS + wildcard DNS

Prerequisites

• nehemiahd must be running with NEHEMIAH_NET=1 (enables guest networking via tap/bridge/DHCP)
• A test VM must be created with net: true (ensures DHCP lease is assigned)
• An HTTP server must be running inside the guest on a known port

How to Set Up a Test VM

# Build and run nehemiahd (with auth to test the auth bypass)
cd nehemiahd && go build -o /tmp/nehemiahd .
sudo NEHEMIAH_NET=1 NEHEMIAH_JAILER=0 NEHEMIAH_TOKEN=test-token /tmp/nehemiahd &

# Create a VM with networking
curl -s http://localhost:8080/v1/machines -X POST \
  -H "Authorization: Bearer test-token" \
  -d '{"template":"python","ttl_seconds":900,"net":true}'

# Start an HTTP server inside the guest (via WebSocket TTY)
python3 -c "
import websocket, time
ws = websocket.create_connection('ws://localhost:8080/v1/machines/MACHINE_ID/tty',
    header=['Authorization: Bearer test-token'])
time.sleep(0.5)
ws.send(b'cd / && python3 -m http.server 8000 --bind 0.0.0.0 &\n')
time.sleep(2)
ws.close()
"

Key Test Cases

The server above is started from / (cd /), so http.server serves the guest's root filesystem — that makes the sub-path test below resolve.

1. Preview without auth: curl http://localhost:8080/v1/machines/{id}/web/8000/ should return content (the / directory listing; no auth header needed)
2. Other routes still require auth: curl http://localhost:8080/v1/machines/{id} should return 401
3. Sub-path routing: curl http://localhost:8080/v1/machines/{id}/web/8000/etc/ should show the guest's /etc directory listing (proves sub-paths are proxied through)
4. Via Vite proxy: curl http://localhost:5173/boring/v1/machines/{id}/web/8000/ should work