ayurishchevandClaude Sonnet 5.5
debf2afed2
control-api: every route now carries a mandatory access level (admin / agent / open) in a route table. All /api/v1/admin/* require the admin token; the write calls of validator-agent and prober (self-check, events, results, complete) require a separate static agent token; register, heartbeat and fetching the assignment stay open. Tokens come from env vars, are compared in constant time and never logged. An empty token leaves that level open with a startup warning (backward compatible). validator-agent / prober: apiclient sends the agent token only to control-api. admin-dashboard: login/password (from env) with a stateless HMAC session cookie, Origin-based CSRF check, per-IP brute-force throttle, HX-Redirect for htmx polls, logout in the sidebar; the dashboard calls control-api with the admin token. Login page layout fixed after review. Also: env plumbing in docker-compose/rxprod-compose/systemd/config examples, e2e script with token assertions, tests, docs (API, SETUP, USAGE, DASHBOARD, README), plan and review under docs/changes/, bin/ rebuilt with new SHA256SUMS. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
33 lines
1.4 KiB
Bash
33 lines
1.4 KiB
Bash
# Copy to .env and edit if needed — defaults below work out of the box
|
|
# with control-api/control-api.docker.example.yaml (openstack.mode: mock,
|
|
# no OpenStack credentials needed).
|
|
#
|
|
# cp .env.example .env
|
|
# cp control-api/control-api.docker.example.yaml control-api/control-api.docker.yaml
|
|
# docker compose up -d --build
|
|
|
|
COMPOSE_PROFILES=control-plane,dashboard,prober,validator
|
|
|
|
# --- prober (must match a site_id in the mounted control-api config) ---
|
|
PROBER_SITE_ID=site-1
|
|
|
|
# --- validator-agent (must match a validator_id in the mounted control-api config) ---
|
|
VALIDATOR_AGENT_VALIDATOR_ID=validator_01
|
|
|
|
# --- authentication (empty = that level stays open; services log a warning) ---
|
|
# Generate each secret with: openssl rand -hex 32
|
|
# control-api admin token (protects /api/v1/admin/*) and the dashboard's copy of it:
|
|
CONTROL_API_ADMIN_TOKEN=
|
|
ADMIN_DASHBOARD_CONTROL_API_TOKEN=
|
|
# control-api agent token (protects result/event writes); the same value goes
|
|
# to prober and validator-agent:
|
|
CONTROL_API_AGENT_TOKEN=
|
|
# Dashboard login (both must be set to enable it) and cookie-signing key:
|
|
ADMIN_DASHBOARD_USERNAME=
|
|
ADMIN_DASHBOARD_PASSWORD=
|
|
ADMIN_DASHBOARD_SESSION_SECRET=
|
|
|
|
# ADMIN_DASHBOARD_CONTROL_API_URL / PROBER_CONTROL_API_URL /
|
|
# VALIDATOR_AGENT_CONTROL_API_URL default to http://control-api:8080 in
|
|
# docker-compose.yml (same Docker network) — only set here to override.
|