ayurishchevandClaude Sonnet 5.5
debf2afed2
control-api: every route now carries a mandatory access level (admin / agent / open) in a route table. All /api/v1/admin/* require the admin token; the write calls of validator-agent and prober (self-check, events, results, complete) require a separate static agent token; register, heartbeat and fetching the assignment stay open. Tokens come from env vars, are compared in constant time and never logged. An empty token leaves that level open with a startup warning (backward compatible). validator-agent / prober: apiclient sends the agent token only to control-api. admin-dashboard: login/password (from env) with a stateless HMAC session cookie, Origin-based CSRF check, per-IP brute-force throttle, HX-Redirect for htmx polls, logout in the sidebar; the dashboard calls control-api with the admin token. Login page layout fixed after review. Also: env plumbing in docker-compose/rxprod-compose/systemd/config examples, e2e script with token assertions, tests, docs (API, SETUP, USAGE, DASHBOARD, README), plan and review under docs/changes/, bin/ rebuilt with new SHA256SUMS. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
74 lines
2.0 KiB
YAML
74 lines
2.0 KiB
YAML
# Ready-to-copy control-api config for `docker compose` dev use — mock
|
|
# OpenStack mode (no credentials needed) with minimal seed data matching
|
|
# deploy/docker/.env.example's PROBER_SITE_ID / VALIDATOR_AGENT_VALIDATOR_ID
|
|
# defaults, so `docker compose up` works out of the box after:
|
|
#
|
|
# cp control-api.docker.example.yaml control-api.docker.yaml
|
|
#
|
|
# For a real deployment, start from configs/control-api.example.yaml
|
|
# instead (full schema reference, openstack.mode: real).
|
|
|
|
server:
|
|
listen_addr: ":8080"
|
|
|
|
database:
|
|
path: "/var/lib/cloud-ip-validator/control-api.db"
|
|
|
|
openstack:
|
|
mode: "mock"
|
|
|
|
# Статические bearer-токены читаются из переменных окружения контейнера с
|
|
# этими именами (задаются в .env, см. deploy/docker/.env.example). Пусто =
|
|
# соответствующий уровень API открыт (с предупреждением в логе).
|
|
auth:
|
|
admin_token_env: "CONTROL_API_ADMIN_TOKEN" # защищает /api/v1/admin/*
|
|
agent_token_env: "CONTROL_API_AGENT_TOKEN" # защищает запись результатов агентами/пробером
|
|
|
|
orchestrator:
|
|
poll_interval_seconds: 5
|
|
self_check_timeout_seconds: 60
|
|
max_self_check_retries: 3
|
|
checking_window_seconds: 120
|
|
max_retries: 3
|
|
lease_ttl_seconds: 180
|
|
heartbeat_timeout_seconds: 30
|
|
fip_settle_seconds: 0
|
|
fip_scan_interval_seconds: 0
|
|
|
|
aggregation:
|
|
missing_counts_as_fail: true
|
|
|
|
validators:
|
|
- validator_id: "validator_01"
|
|
os_port_id: "mock-port-1"
|
|
|
|
sites:
|
|
- site_id: "site-1"
|
|
index: 1
|
|
|
|
check_types:
|
|
- name: "https"
|
|
enabled: true
|
|
targets: ["default-targets"]
|
|
- name: "icmp"
|
|
enabled: true
|
|
targets: ["default-targets"]
|
|
- name: "ssh"
|
|
enabled: false
|
|
targets: []
|
|
|
|
targets:
|
|
default-targets:
|
|
- "https://hub.docker.com"
|
|
- "https://github.com"
|
|
- "https://packages.ubuntu.com"
|
|
|
|
inbound_checks:
|
|
ports: [22, 80, 443, 8080]
|
|
icmp: true
|
|
|
|
ip_addresses:
|
|
- "203.0.113.10"
|
|
- "203.0.113.11"
|
|
- "203.0.113.12"
|