swf-remote

swf-remote is a Django/Apache web application that provides external, open-internet access to PanDA production monitoring services hosted behind Brookhaven National Laboratory's firewall. It serves the ePIC experiment at the Electron Ion Collider and is live at epic-devcloud.org. Architecture: The application proxies full rendered HTML pages from an internal service called swf-monitor through a persistent SSH tunnel managed by autossh and systemd. swf-remote holds no PanDA data locally; all data is fetched in real time from swf-monitor, which has direct access to the PanDA database. The proxy rewrites upstream URLs to local /prod/ paths and swaps in local authentication controls while preserving the original page body and styling. Pages: The hub links to monitoring views including activity overview (job/task counts by status, user, site), job lists with DataTables filtering, job detail records with files and errors, JEDI task lists, error summaries ranked by frequency, failed job diagnostics, operational state snapshots, system health, an MCP relay endpoint, and API token management. Authentication: Anonymous visitors see only a landing page, login path, and static assets. Accounts are created via local username/password or GitHub sign-in (eic org membership not required). Headless clients authenticate with per-user Bearer tokens. MCP relay: Forwards swf-monitor's MCP endpoint and its full tool set through the tunnel as the signed-in user, with the external tool set limited by a policy file. Stack: Django 5.2 with Python 3.11, PostgreSQL for Django internals only, Apache with mod_wsgi, httpx for upstream REST calls, and Let's Encrypt for HTTPS. Configuration uses SWF_REMOTE_ prefixed environment variables. Sister projects: swf-monitor (the internal Django service with PanDA DB access, REST API, MCP server), swf-testbed (streaming workflow testbed orchestration), and swf-common-lib (shared utilities).