ayurishchevandClaude Sonnet 5.5
debf2afed2
control-api: every route now carries a mandatory access level (admin / agent / open) in a route table. All /api/v1/admin/* require the admin token; the write calls of validator-agent and prober (self-check, events, results, complete) require a separate static agent token; register, heartbeat and fetching the assignment stay open. Tokens come from env vars, are compared in constant time and never logged. An empty token leaves that level open with a startup warning (backward compatible). validator-agent / prober: apiclient sends the agent token only to control-api. admin-dashboard: login/password (from env) with a stateless HMAC session cookie, Origin-based CSRF check, per-IP brute-force throttle, HX-Redirect for htmx polls, logout in the sidebar; the dashboard calls control-api with the admin token. Login page layout fixed after review. Also: env plumbing in docker-compose/rxprod-compose/systemd/config examples, e2e script with token assertions, tests, docs (API, SETUP, USAGE, DASHBOARD, README), plan and review under docs/changes/, bin/ rebuilt with new SHA256SUMS. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
110 lines
4.8 KiB
YAML
110 lines
4.8 KiB
YAML
name: cloud-ip-validator
|
|
|
|
# Base service definitions shared by every environment. Combine with
|
|
# docker-compose.override.yml (auto-loaded, dev) or docker-compose.prod.yml
|
|
# (prod) — see deploy/docker/RUN.txt for the exact invocations.
|
|
#
|
|
# Which services actually start is controlled per host via COMPOSE_PROFILES
|
|
# in the active .env file, matching the real deployment topology:
|
|
# control-plane control-api (one management host)
|
|
# dashboard admin-dashboard (optional, anywhere with network access
|
|
# to control-api)
|
|
# prober prober (one per external test site)
|
|
# validator validator-agent (one per validator VM in the cloud)
|
|
|
|
networks:
|
|
backend:
|
|
name: cloud-ip-validator
|
|
|
|
volumes:
|
|
control-api-db:
|
|
# Same volume name deploy/docker/RUN.txt's manual `docker run -v
|
|
# cloud-ip-validator-db:...` already uses, so a manual-Docker deployment
|
|
# can adopt compose without losing existing data.
|
|
name: cloud-ip-validator-db
|
|
|
|
services:
|
|
control-api:
|
|
build:
|
|
context: ../..
|
|
dockerfile: deploy/docker/control-api/Dockerfile
|
|
image: cloud-ip-validator-control-api
|
|
platform: linux/amd64
|
|
profiles: ["control-plane"]
|
|
networks: [backend]
|
|
volumes:
|
|
- control-api-db:/var/lib/cloud-ip-validator
|
|
environment:
|
|
# Static bearer tokens (empty = that API level stays open, with a
|
|
# warning in the log). Generate with `openssl rand -hex 32`.
|
|
CONTROL_API_ADMIN_TOKEN: "${CONTROL_API_ADMIN_TOKEN:-}"
|
|
CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:8080/healthz"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
start_period: 5s
|
|
|
|
admin-dashboard:
|
|
build:
|
|
context: ../..
|
|
dockerfile: deploy/docker/admin-dashboard/Dockerfile
|
|
image: cloud-ip-validator-admin-dashboard
|
|
platform: linux/amd64
|
|
profiles: ["dashboard"]
|
|
networks: [backend]
|
|
environment:
|
|
ADMIN_DASHBOARD_CONTROL_API_URL: "${ADMIN_DASHBOARD_CONTROL_API_URL:-http://control-api:8080}"
|
|
ADMIN_DASHBOARD_LISTEN_ADDR: "${ADMIN_DASHBOARD_LISTEN_ADDR:-:8090}"
|
|
ADMIN_DASHBOARD_CONTROL_API_TIMEOUT_SECONDS: "${ADMIN_DASHBOARD_CONTROL_API_TIMEOUT_SECONDS:-10}"
|
|
ADMIN_DASHBOARD_LAST_COMPLETED_COUNT: "${ADMIN_DASHBOARD_LAST_COMPLETED_COUNT:-20}"
|
|
ADMIN_DASHBOARD_POLL_INTERVAL_SECONDS: "${ADMIN_DASHBOARD_POLL_INTERVAL_SECONDS:-5}"
|
|
# Admin token of control-api, and the dashboard's own login. Empty
|
|
# username/password = login disabled (warning in the log).
|
|
ADMIN_DASHBOARD_CONTROL_API_TOKEN: "${ADMIN_DASHBOARD_CONTROL_API_TOKEN:-}"
|
|
ADMIN_DASHBOARD_USERNAME: "${ADMIN_DASHBOARD_USERNAME:-}"
|
|
ADMIN_DASHBOARD_PASSWORD: "${ADMIN_DASHBOARD_PASSWORD:-}"
|
|
ADMIN_DASHBOARD_SESSION_SECRET: "${ADMIN_DASHBOARD_SESSION_SECRET:-}"
|
|
|
|
prober:
|
|
build:
|
|
context: ../..
|
|
dockerfile: deploy/docker/prober/Dockerfile
|
|
image: cloud-ip-validator-prober
|
|
platform: linux/amd64
|
|
profiles: ["prober"]
|
|
networks: [backend]
|
|
cap_add: [NET_RAW]
|
|
environment:
|
|
PROBER_SITE_ID: "${PROBER_SITE_ID:-}"
|
|
PROBER_CONTROL_API_URL: "${PROBER_CONTROL_API_URL:-http://control-api:8080}"
|
|
PROBER_POLL_INTERVAL_SECONDS: "${PROBER_POLL_INTERVAL_SECONDS:-5}"
|
|
PROBER_TCP_TIMEOUT_SECONDS: "${PROBER_TCP_TIMEOUT_SECONDS:-5}"
|
|
PROBER_ICMP_TIMEOUT_SECONDS: "${PROBER_ICMP_TIMEOUT_SECONDS:-5}"
|
|
PROBER_ICMP_COUNT: "${PROBER_ICMP_COUNT:-3}"
|
|
# Agent token of control-api (same value as on control-api).
|
|
CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
|
|
|
|
validator-agent:
|
|
build:
|
|
context: ../..
|
|
dockerfile: deploy/docker/validator-agent/Dockerfile
|
|
image: cloud-ip-validator-validator-agent
|
|
platform: linux/amd64
|
|
profiles: ["validator"]
|
|
networks: [backend]
|
|
cap_add: [NET_RAW]
|
|
environment:
|
|
VALIDATOR_AGENT_VALIDATOR_ID: "${VALIDATOR_AGENT_VALIDATOR_ID:-}"
|
|
VALIDATOR_AGENT_CONTROL_API_URL: "${VALIDATOR_AGENT_CONTROL_API_URL:-http://control-api:8080}"
|
|
VALIDATOR_AGENT_POLL_INTERVAL_SECONDS: "${VALIDATOR_AGENT_POLL_INTERVAL_SECONDS:-5}"
|
|
VALIDATOR_AGENT_SELF_CHECK_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_SELF_CHECK_TIMEOUT_SECONDS:-10}"
|
|
VALIDATOR_AGENT_HTTPS_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_HTTPS_TIMEOUT_SECONDS:-10}"
|
|
VALIDATOR_AGENT_ICMP_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_ICMP_TIMEOUT_SECONDS:-5}"
|
|
VALIDATOR_AGENT_ICMP_COUNT: "${VALIDATOR_AGENT_ICMP_COUNT:-3}"
|
|
VALIDATOR_AGENT_SSH_ENABLED: "${VALIDATOR_AGENT_SSH_ENABLED:-false}"
|
|
VALIDATOR_AGENT_SSH_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_SSH_TIMEOUT_SECONDS:-5}"
|
|
# Agent token of control-api (same value as on control-api).
|
|
CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
|