mvsce: write the mvsMF console route into HTTPPRM0

README.md

@@ -288,7 +288,7 @@ image. The link `mvsce-builder/mvsce-target` is gone. Use
 | [MVS/CE](https://github.com/MVS-sysgen/sysgen) (`mainframed767/mvsce`) | 3.0.0 | base image |
 | [Hercules](https://github.com/SDL-Hercules-390/hyperion) (SDL-Hyperion, `develop`) | `a742398074` (4.10.0.11783) | `/home/hercules/herctest/herc4x`, replacing MVS/CE's |
 | [UFSD](https://github.com/mvslovers/ufsd) | 1.4.0 | `MVSLOVER.UFSD.LOADLIB` |
-| [HTTPD](https://github.com/mvslovers/httpd) | 4.3.0 | `HTTPD.LINKLIB` |
+| [HTTPD](https://github.com/mvslovers/httpd) | 4.5.1 | `HTTPD.LINKLIB` |
 | [mvsMF](https://github.com/mvslovers/mvsmf) | 1.3.0 | `HTTPD.LINKLIB` |
 | [FTPD](https://github.com/mvslovers/ftpd) | 1.2.0 | `MVSLOVER.FTPD.LOADLIB` |
 | [RAKF](https://github.com/MVS-sysgen/RAKF) | 2.0.0 (TK5 Update 6), replacing the older RAKF of the base image | `SYS1.LPALIB`, `SYS1.LINKLIB`, SMP4 FUNCTION `TRKF200` |

mvsce/Dockerfile

@@ -76,16 +76,17 @@ ARG MVSCE_VERSION
 ARG HERCULES_REF
 ARG HERCULES_REPO
 ARG UFSD_VERSION=1.4.0
-ARG HTTPD_VERSION=4.3.0
+ARG HTTPD_VERSION=4.5.1
 ARG MVSMF_VERSION=1.3.0
 ARG FTPD_VERSION=1.2.0
 ARG RAKF_VERSION=2.0.0
 # TK5INST.zip of the RAKF release: trkf200.xmi, the TK5 Update 6 install
 # deck. It has no IEZCTGPL (TK5 has that macro in SYS1.MACLIB, MVS/CE does
 # not); the one of the same tag is added from the repository.
-# The v2.0.0 asset was replaced upstream on 2026-10-22 (same tag, RDEFINE
-# now checks class and profile for duplicates); this is the new one.
-ARG RAKF_ZIP_SHA256=f38359ef3430ca305bbbaf11058811efbba1134a5db7a9d52112756c837f1c1c
+# The v2.0.0 asset was re-uploaded by the maintainer on 2026-10-24, four
+# minutes after commit a4d101e ("fix 80 column error"); the digest changed
+# with it. The previous pin (f38359ef...) no longer matches the release.
+ARG RAKF_ZIP_SHA256=34a3556ac762fb2a176a42eea337c13985a9979fcf2780c57e346c6b24c3ec6d
 ARG RAKF_IEZCTGPL_SHA256=9b4564f758063f2a9eecfe13eef02cef3d57ef06685637e1abe331e5dde9dae0
 
 USER root

mvsce/setup_mvsce.py

@@ -47,8 +47,10 @@
      domain 1's minimum MPL in SYS1.PARMLIB(IEAIPS00) from 1 to 10.
   8. Sets up RAKF for the two servers that switch identity at startup:
      the users FTPD and HTTPD, as ftpd's docs/FTPD_RAKF_SETUP.md and
-     httpd's docs/installation.md describe, and the FTPAUTH facility, which
-     only ADMIN may use. RAKF 2.0.0 takes the group of a started task from
+     httpd's docs/installation.md describe, the FTPAUTH facility, which
+     only ADMIN may use, and the MVSMF.CONSOLE facility (RDEFINE, READ for
+     IBMUSER only; HTTPPRM0 refuses routes whose profile is missing).
+     RAKF 2.0.0 takes the group of a started task from
      its USERS entry, and FACILITY SVC244 needs READ for that group, so both
      users are in STARTED (operations authority N), which gets READ on
      FACILITY SVC244 and nothing else; STCGROUP would hold ALTER on all data
@@ -129,15 +131,20 @@
     'RAKFPWUP', 'RAKFPROF', 'RAKFUSER', 'RAKFINIT',
 ]
 
-# The z/OSMF routes as mvsMF 1.1.0 documents them: the two endpoints that
-# resolve the caller themselves are public, everything else needs a login
-# and answers a bare 401 (no browser dialog) without one.
+# The z/OSMF routes as mvsMF documents them (docs/installation.md, "Register
+# the routes"). First match wins, so the specific routes precede /zosmf/*.
+# The two endpoints that resolve the caller themselves are public, everything
+# else needs a login and answers a bare 401 (no browser dialog) without one.
+# RES_NOPROFILE=DENY refuses a RES= route whose RAKF profile is missing; the
+# profile for the console route is defined in setup_rakf before HTTPD starts.
 HTTPPRM0 = """\
 # HTTPPRM0 - written by mvsce (mvslovers/mvs-docker)
 PORT=8080
 DOCROOT=/www
+RES_NOPROFILE=DENY
 MOD=MVSMF /zosmf/info                    AUTH=NONE
 MOD=MVSMF /zosmf/services/authenticate   AUTH=NONE
+MOD=MVSMF /zosmf/restconsoles/*          AUTH=TOKEN RES=FACILITY:MVSMF.CONSOLE
 MOD=MVSMF /zosmf/*                       AUTH=TOKEN
 """
 
@@ -810,7 +817,7 @@ def raise_dmn1_mpl(herc):
 
 
 def setup_rakf(herc):
-    """RAKF users for FTPD and HTTPD, and FTPAUTH.
+    """RAKF users for FTPD and HTTPD, FTPAUTH, and the mvsMF console profile.
 
     Both servers drop from STC (operations authority) to their own user
     at startup; without that user RAKF answers RAKF0004 and the server
@@ -924,6 +931,24 @@ def setup_rakf(herc):
                                            'RAKFADM')),
             ['REXX'])
 
+    jcl = f"""{jobcard('RDEFCON', 'MVSMF CONSOLE PROFILE', 'RAKFADM')}
+//RDEF     EXEC PGM=IKJEFT01,REGION=4096K
+//SYSPRINT DD  SYSOUT=*
+//SYSTERM  DD  SYSOUT=*
+//SYSTSPRT DD  SYSOUT=*
+//SYSTSIN  DD  *
+RDEFINE MVSMF.CONSOLE CLASS(FACILITY) UACC(NONE)
+/*
+//PERM     EXEC PGM=IKJEFT01,REGION=4096K
+//SYSPRINT DD  SYSOUT=*
+//SYSTERM  DD  SYSOUT=*
+//SYSTSPRT DD  SYSOUT=*
+//SYSTSIN  DD  *
+PERMIT MVSMF.CONSOLE CLASS(FACILITY) ID(IBMUSER) ACCESS(READ)
+/*
+"""
+    run_job(herc, 'RDEFCON', lambda: submit_ascii(jcl), ['RDEF', 'PERM'])
+
     since = len(read_log())
     console(herc, 'RAKFLOAD', 'S RAKFUSER', 'S RAKFPROF')
     for msg in ('RAKFUIDS4  USER TABLE UPDATED', 'RAKFPROF7  RAKF PROFILES UPDATED'):