ayurishchevandClaude Sonnet 5.5
debf2afed2
control-api: every route now carries a mandatory access level (admin / agent / open) in a route table. All /api/v1/admin/* require the admin token; the write calls of validator-agent and prober (self-check, events, results, complete) require a separate static agent token; register, heartbeat and fetching the assignment stay open. Tokens come from env vars, are compared in constant time and never logged. An empty token leaves that level open with a startup warning (backward compatible). validator-agent / prober: apiclient sends the agent token only to control-api. admin-dashboard: login/password (from env) with a stateless HMAC session cookie, Origin-based CSRF check, per-IP brute-force throttle, HX-Redirect for htmx polls, logout in the sidebar; the dashboard calls control-api with the admin token. Login page layout fixed after review. Also: env plumbing in docker-compose/rxprod-compose/systemd/config examples, e2e script with token assertions, tests, docs (API, SETUP, USAGE, DASHBOARD, README), plan and review under docs/changes/, bin/ rebuilt with new SHA256SUMS. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
74 lines
2.3 KiB
YAML
74 lines
2.3 KiB
YAML
name: cloud-ip-validator
|
|
|
|
networks:
|
|
backend:
|
|
name: cloud-ip-validator
|
|
|
|
volumes:
|
|
control-api-db:
|
|
name: cloud-ip-validator-db
|
|
|
|
services:
|
|
control-api:
|
|
image: civ-capi
|
|
platform: linux/amd64
|
|
restart: unless-stopped
|
|
networks: [backend]
|
|
ports:
|
|
- "8081:8081"
|
|
volumes:
|
|
- /opt/lvraid/claude/cloud_ip_validator/rxprod-compose/control-api.yaml:/etc/cloud-ip-validator/control-api.yaml:ro
|
|
- /opt/lvraid/claude/cloud_ip_validator/rxprod-compose/capi-db:/var/lib/cloud-ip-validator
|
|
environment:
|
|
OS_AUTH_URL: "${OS_AUTH_URL}"
|
|
OS_PROJECT_ID: "${OS_PROJECT_ID}"
|
|
OS_REGION_NAME: "${OS_REGION_NAME}"
|
|
OS_INTERFACE: "${OS_INTERFACE:-}"
|
|
OS_TOKEN: "${OS_TOKEN:-}"
|
|
OS_USERNAME: "${OS_USERNAME:-}"
|
|
OS_USER_DOMAIN_NAME: "${OS_USER_DOMAIN_NAME:-}"
|
|
OS_PASSWORD: "${OS_PASSWORD:-}"
|
|
# Static bearer tokens (set in .env; empty = that API level is open).
|
|
# Generate with: openssl rand -hex 32
|
|
CONTROL_API_ADMIN_TOKEN: "${CONTROL_API_ADMIN_TOKEN:-}"
|
|
CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:8081/healthz"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
start_period: 5s
|
|
|
|
admin-dashboard:
|
|
image: civ-adash
|
|
platform: linux/amd64
|
|
restart: unless-stopped
|
|
networks: [backend]
|
|
ports:
|
|
- "8091:8090"
|
|
environment:
|
|
ADMIN_DASHBOARD_CONTROL_API_URL: http://control-api:8081
|
|
# Admin token of control-api + the dashboard login (empty username/
|
|
# password = login disabled).
|
|
ADMIN_DASHBOARD_CONTROL_API_TOKEN: "${ADMIN_DASHBOARD_CONTROL_API_TOKEN:-}"
|
|
ADMIN_DASHBOARD_USERNAME: "${ADMIN_DASHBOARD_USERNAME:-}"
|
|
ADMIN_DASHBOARD_PASSWORD: "${ADMIN_DASHBOARD_PASSWORD:-}"
|
|
ADMIN_DASHBOARD_SESSION_SECRET: "${ADMIN_DASHBOARD_SESSION_SECRET:-}"
|
|
depends_on:
|
|
control-api:
|
|
condition: service_healthy
|
|
|
|
prober:
|
|
image: civ-prober
|
|
platform: linux/amd64
|
|
restart: unless-stopped
|
|
networks: [backend]
|
|
cap_add: [NET_RAW]
|
|
environment:
|
|
PROBER_SITE_ID: "${PROBER_SITE_ID}"
|
|
PROBER_CONTROL_API_URL: http://control-api:8081
|
|
CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
|
|
depends_on:
|
|
control-api:
|
|
condition: service_healthy
|