feat: give ExApp containers an FRP token instead of the shared key

[oleksandr-nc]

ExApp containers that connect to HaRP through FRP get HaRP's shared key as HP_SHARED_KEY, although they only need it to log in to the FRP server. The same key also authenticates HaRP's control API (/exapps/app_api/...).

When HaRP creates an ExApp container, it now replaces that key with a token derived from it (HMAC-SHA256(key, "harp-frp-exapp-v1")), and the FRP login accepts the key or the token. The control API still accepts only the key. Nothing changes for AppAPI, for ExApp images (they only pass HP_SHARED_KEY to frpc or check that it is set), for HaRP's own FRP client, for remote Docker engines or for an frps.toml of your own.

Visible changes for administrators:

• ExApp containers created by earlier releases keep the key until their next update, and they keep working.
• After a rollback of HaRP to an earlier release, ExApps deployed by this one cannot connect, and their login attempts soon get their address banned. The README explains how to recover.

On the dev stack, an existing ExApp that holds the key reconnected; a newly registered test-deploy got the token, connected through FRP, kept working after disable and enable, and got 401 from the control API with it; after a rollback to main it stayed at 503 until HaRP was upgraded again.

[coderabbitai]

📝 Walkthrough

HaRP derives an ExApp FRP token from HP_SHARED_KEY with HMAC-SHA256. It substitutes the token into matching ExApp container environment entries and accepts the token for FRP login alongside the shared key. The README documents key usage, upgrade and rollback behavior, and recovery options.

Priority: ➖ Normal

Merge Risk: 🟡 Moderate · up to ca34e

Kubernetes ExApps can still receive a credential that grants control API access. Apply the token substitution to Kubernetes deployments before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 30.77% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 3 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely identifies the main change: ExApp containers receive an FRP token instead of the shared key.
Description check		The description directly explains the token derivation, authentication behavior, compatibility effects, rollback risk, recovery guidance, and validation performed.

Full details: Docstring Coverage

Explanation

Docstring coverage is 30.77% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 3 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 38f6af31-4c6f-4096-afa2-fb269da8ef9d

📥 Commits

Reviewing files that changed from the base of the PR and between a60e3ae and ca34ee8.

📒 Files selected for processing: 4

• README.md
• haproxy_agent.py
• tests/unit/payloads.py
• tests/unit/test_requests.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.