refactor: fully self-hostable against e2b-dev/infra - #518
Conversation
…Hog, Vercel, GTM)
…nagement, keys, account, support, feature flags, team metrics, byoc/connections, standalone terminal
- e2b_api_key httpOnly cookie (or E2B_API_KEY env) is the only credential;
validated once on the / key form, enforced lazily via UNAUTHORIZED -> sign-out
- all upstream calls now use X-API-Key; repositories keep their shape
- SDK calls use native { apiKey } instead of bearer-header injection
- routes move from /dashboard/[teamSlug]/* to /sandboxes and /templates
- proxy shrinks to a ~30-line presence gate with returnTo
- sandbox record fallback short-circuits (endpoint unavailable in OSS)
- delete ory tree, auth pages/routes, teams/user routers and modules
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryLow Risk Overview
CI: Reviewed by Cursor Bugbot for commit f5a10bc. Bugbot is set up for automated code reviews on this repo. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3690216. Configure here.
tvi
left a comment
tvi
left a comment
There was a problem hiding this comment.
Really excited about this direction. Decoupling the dashboard from identity is a key milestone on the path toward native OAuth support. It gives us the flexibility to support standard OAuth flows without coupling the UI to any particular identity provider or authentication stack.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3690216085
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
ben-fornefeld
changed the title
2 participants
This PR refocuses the dashboard on one goal: managing a self-hosted e2b-dev/infra deployment with the least possible setup. It also lays the groundwork for native OAuth support in the open-source stack: with the dashboard reduced to a stateless API-key client, identity can be added in front of it (or natively in infra) without reworking the dashboard again.
Until now, running this dashboard yourself meant standing up a whole constellation of services the open-source infra doesn't ship: an Ory Kratos + Hydra identity stack, a billing API backed by Stripe, LaunchDarkly, PostHog, Plain, and an events service. None of these exist in a self-hosted infra deployment — so out of the box, the dashboard simply couldn't be self-hosted without significant extra infrastructure that had nothing to do with managing sandboxes.
This PR strips the dashboard down to exactly what e2b-dev/infra supports, and replaces user-account auth with the credential every E2B deployment already has: a team API key.
What this looks like now
Setup is one env var:
Visit
/, paste a team API key (e2b_...), done. The key is validated against infra-api and stored in an httpOnlye2b_api_keycookie; every upstream call happens server-side viaX-API-Key. The key never reaches client JavaScript.For single-user deployments, set
E2B_API_KEYin the environment and the dashboard is pre-authenticated — no login step at all.Authentication is deliberately out of scope. The dashboard itself carries no user model. If you need SSO / user-level access control in front of it, put any standard OAuth proxy (oauth2-proxy, Authelia, Cloudflare Access, ...) in front of the deployment — the dashboard composes cleanly with that, instead of forcing a specific identity stack on you.
What's included
/sandboxes,/templates/...(the team is implied by the API key)/?tab=sandboxes|templatesdeep linksWhat's removed (and why)
Everything that depends on services the open-source infra doesn't provide:
/Net effect: −48k lines, 20 fewer runtime dependencies, and an env surface that went from ~25 required/conditional variables to one.
Where possible, code structure (repositories, tRPC routers, the envd data plane for the terminal/filesystem) was kept intact rather than rewritten, so the codebase stays familiar and easy to contribute to.
Notable implementation details
returnTo. Key validity is enforced lazily — any upstream 401 clears the cookie and returns to the key form.GET /sandboxes/{id}/record(killed-sandbox archival records) isn't available on self-hosted deployments; the fallback path short-circuits to 404 while keeping the code shape.SameSite=LaxhttpOnly cookie + server-action origin checks; thee2b_api_keycookie is in the logger redaction list.Merge dependency
dashboard-api (from e2b-dev/infra) needs
X-API-Keyauth on its read endpoints (GET /templates*,GET /builds*) — tracked separately and landing before this merges. infra-api already accepts API key auth on every endpoint the dashboard uses. Until then, template/build detail views return 401 against a live deployment; sandboxes work fully.Testing