ayurishchevandClaude Sonnet 5.5
abbee9a08a
control-api is hosted outside the cloud and validators reach it directly,
so it sees the floating IP as the connection's source address. New open
route GET /api/v1/agents/{id}/observed-ip returns that address (taken only
from the TCP peer; forwarding headers are ignored so a validator cannot
forge it).
The agent gets self_check.methods, a priority-ordered list of ip_echo
(unchanged) and control_api; the default stays [ip_echo]. The self-check
passes when any method confirms the address; the next method is tried on
no answer and on a mismatch. Each method has its own timeout so a hung
first method cannot starve the fallback, and control_api uses a new TCP
connection per call (a connection opened before the floating IP was
attached would keep reporting the old address).
Also: docker agent template/env, example config, docs, plan in
docs/changes, e2e script switch E2E_SELF_CHECK_METHODS, rebuilt
bin/control-api and bin/validator-agent.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
111 lines
4.9 KiB
YAML
111 lines
4.9 KiB
YAML
name: cloud-ip-validator
|
|
|
|
# Base service definitions shared by every environment. Combine with
|
|
# docker-compose.override.yml (auto-loaded, dev) or docker-compose.prod.yml
|
|
# (prod) — see deploy/docker/RUN.txt for the exact invocations.
|
|
#
|
|
# Which services actually start is controlled per host via COMPOSE_PROFILES
|
|
# in the active .env file, matching the real deployment topology:
|
|
# control-plane control-api (one management host)
|
|
# dashboard admin-dashboard (optional, anywhere with network access
|
|
# to control-api)
|
|
# prober prober (one per external test site)
|
|
# validator validator-agent (one per validator VM in the cloud)
|
|
|
|
networks:
|
|
backend:
|
|
name: cloud-ip-validator
|
|
|
|
volumes:
|
|
control-api-db:
|
|
# Same volume name deploy/docker/RUN.txt's manual `docker run -v
|
|
# cloud-ip-validator-db:...` already uses, so a manual-Docker deployment
|
|
# can adopt compose without losing existing data.
|
|
name: cloud-ip-validator-db
|
|
|
|
services:
|
|
control-api:
|
|
build:
|
|
context: ../..
|
|
dockerfile: deploy/docker/control-api/Dockerfile
|
|
image: cloud-ip-validator-control-api
|
|
platform: linux/amd64
|
|
profiles: ["control-plane"]
|
|
networks: [backend]
|
|
volumes:
|
|
- control-api-db:/var/lib/cloud-ip-validator
|
|
environment:
|
|
# Static bearer tokens (empty = that API level stays open, with a
|
|
# warning in the log). Generate with `openssl rand -hex 32`.
|
|
CONTROL_API_ADMIN_TOKEN: "${CONTROL_API_ADMIN_TOKEN:-}"
|
|
CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:8080/healthz"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
start_period: 5s
|
|
|
|
admin-dashboard:
|
|
build:
|
|
context: ../..
|
|
dockerfile: deploy/docker/admin-dashboard/Dockerfile
|
|
image: cloud-ip-validator-admin-dashboard
|
|
platform: linux/amd64
|
|
profiles: ["dashboard"]
|
|
networks: [backend]
|
|
environment:
|
|
ADMIN_DASHBOARD_CONTROL_API_URL: "${ADMIN_DASHBOARD_CONTROL_API_URL:-http://control-api:8080}"
|
|
ADMIN_DASHBOARD_LISTEN_ADDR: "${ADMIN_DASHBOARD_LISTEN_ADDR:-:8090}"
|
|
ADMIN_DASHBOARD_CONTROL_API_TIMEOUT_SECONDS: "${ADMIN_DASHBOARD_CONTROL_API_TIMEOUT_SECONDS:-10}"
|
|
ADMIN_DASHBOARD_LAST_COMPLETED_COUNT: "${ADMIN_DASHBOARD_LAST_COMPLETED_COUNT:-20}"
|
|
ADMIN_DASHBOARD_POLL_INTERVAL_SECONDS: "${ADMIN_DASHBOARD_POLL_INTERVAL_SECONDS:-5}"
|
|
# Admin token of control-api, and the dashboard's own login. Empty
|
|
# username/password = login disabled (warning in the log).
|
|
ADMIN_DASHBOARD_CONTROL_API_TOKEN: "${ADMIN_DASHBOARD_CONTROL_API_TOKEN:-}"
|
|
ADMIN_DASHBOARD_USERNAME: "${ADMIN_DASHBOARD_USERNAME:-}"
|
|
ADMIN_DASHBOARD_PASSWORD: "${ADMIN_DASHBOARD_PASSWORD:-}"
|
|
ADMIN_DASHBOARD_SESSION_SECRET: "${ADMIN_DASHBOARD_SESSION_SECRET:-}"
|
|
|
|
prober:
|
|
build:
|
|
context: ../..
|
|
dockerfile: deploy/docker/prober/Dockerfile
|
|
image: cloud-ip-validator-prober
|
|
platform: linux/amd64
|
|
profiles: ["prober"]
|
|
networks: [backend]
|
|
cap_add: [NET_RAW]
|
|
environment:
|
|
PROBER_SITE_ID: "${PROBER_SITE_ID:-}"
|
|
PROBER_CONTROL_API_URL: "${PROBER_CONTROL_API_URL:-http://control-api:8080}"
|
|
PROBER_POLL_INTERVAL_SECONDS: "${PROBER_POLL_INTERVAL_SECONDS:-5}"
|
|
PROBER_TCP_TIMEOUT_SECONDS: "${PROBER_TCP_TIMEOUT_SECONDS:-5}"
|
|
PROBER_ICMP_TIMEOUT_SECONDS: "${PROBER_ICMP_TIMEOUT_SECONDS:-5}"
|
|
PROBER_ICMP_COUNT: "${PROBER_ICMP_COUNT:-3}"
|
|
# Agent token of control-api (same value as on control-api).
|
|
CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
|
|
|
|
validator-agent:
|
|
build:
|
|
context: ../..
|
|
dockerfile: deploy/docker/validator-agent/Dockerfile
|
|
image: cloud-ip-validator-validator-agent
|
|
platform: linux/amd64
|
|
profiles: ["validator"]
|
|
networks: [backend]
|
|
cap_add: [NET_RAW]
|
|
environment:
|
|
VALIDATOR_AGENT_VALIDATOR_ID: "${VALIDATOR_AGENT_VALIDATOR_ID:-}"
|
|
VALIDATOR_AGENT_CONTROL_API_URL: "${VALIDATOR_AGENT_CONTROL_API_URL:-http://control-api:8080}"
|
|
VALIDATOR_AGENT_POLL_INTERVAL_SECONDS: "${VALIDATOR_AGENT_POLL_INTERVAL_SECONDS:-5}"
|
|
VALIDATOR_AGENT_SELF_CHECK_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_SELF_CHECK_TIMEOUT_SECONDS:-10}"
|
|
VALIDATOR_AGENT_SELF_CHECK_METHODS: "${VALIDATOR_AGENT_SELF_CHECK_METHODS:-[ip_echo]}"
|
|
VALIDATOR_AGENT_HTTPS_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_HTTPS_TIMEOUT_SECONDS:-10}"
|
|
VALIDATOR_AGENT_ICMP_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_ICMP_TIMEOUT_SECONDS:-5}"
|
|
VALIDATOR_AGENT_ICMP_COUNT: "${VALIDATOR_AGENT_ICMP_COUNT:-3}"
|
|
VALIDATOR_AGENT_SSH_ENABLED: "${VALIDATOR_AGENT_SSH_ENABLED:-false}"
|
|
VALIDATOR_AGENT_SSH_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_SSH_TIMEOUT_SECONDS:-5}"
|
|
# Agent token of control-api (same value as on control-api).
|
|
CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
|