ced4568
eae8e48d43
Adds platform/lab-router/ — a narrow service that runs on the Lab Host, authenticates the Gateway via mTLS, and resolves an opaque routing token to a local container purely from Docker label state (no Postgres access, no callback to the Provisioner). Replaces the Gateway's env.internal_ip assumption (only valid when Gateway and Lab share a Docker daemon) with a data-driven direct/router decision per lab_host (lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one place (platform/gateway/src/lab-endpoint.js's labTarget()) that every proxy/fetch call site in server.js now goes through. Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh) with a second mTLS leaf pair (router-server/gateway-client) for this new data-plane connection, deployed by the docker-tls Ansible role into a separate directory from the control-plane pair. Firewall (rn-lab-host-01.rules) replaces the old speculative wide port-range allowance with one narrow rule: platform_ip -> the Router's port only. dev-local stays routing_mode: direct — zero behavior change for local dev, confirmed by the full existing regression suite passing unmodified.
53 lines
2.6 KiB
Bash
Executable File
53 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Local test (Phase 4 §29): renders infra/docker/platform/docker-compose.production.yml's
|
|
# Jinja2 placeholders with disposable dummy values and confirms `docker compose config`
|
|
# accepts the result — catches YAML/schema errors before Ansible ever touches a real host.
|
|
# This does NOT prove the real production values work (env_file paths under /etc/rootnode/
|
|
# won't exist locally, which docker compose only warns about, not a fatal error), and does NOT
|
|
# validate anything hardware/network-dependent.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/../docker/platform"
|
|
|
|
TMPDIR="$(mktemp -d)"
|
|
trap 'rm -rf "$TMPDIR"' EXIT
|
|
|
|
for f in platform.env provisioner.env gateway.env postgres.env; do touch "$TMPDIR/$f"; done
|
|
|
|
sed \
|
|
-e 's/{{ rootnode_data_root }}/\/tmp\/rootnode-test-data/g' \
|
|
-e 's/{{ registry }}/registry.example.com/g' \
|
|
-e 's/{{ image_tag }}/test/g' \
|
|
-e 's/{{ postgres_exporter_user }}/exporter/g' \
|
|
-e 's/{{ postgres_exporter_password }}/dummy/g' \
|
|
-e "s#/etc/rootnode/platform.env#$TMPDIR/platform.env#" \
|
|
-e "s#/etc/rootnode/provisioner.env#$TMPDIR/provisioner.env#" \
|
|
-e "s#/etc/rootnode/gateway.env#$TMPDIR/gateway.env#" \
|
|
-e "s#/etc/rootnode/postgres.env#$TMPDIR/postgres.env#" \
|
|
docker-compose.production.yml > "$TMPDIR/docker-compose.yml"
|
|
|
|
echo "--- docker compose config ---"
|
|
docker compose -f "$TMPDIR/docker-compose.yml" config --quiet
|
|
echo "OK: production compose file is well-formed YAML and passes docker compose's own schema validation"
|
|
|
|
echo
|
|
echo "--- Caddyfile syntax (real caddy validate) ---"
|
|
sed -e 's/{{ academy_domain }}/academy.example.com/g' -e 's/{{ management_cidr }}/203.0.113.0\/24/g' \
|
|
Caddyfile.j2 > "$TMPDIR/Caddyfile"
|
|
chmod a+r "$TMPDIR/Caddyfile"
|
|
docker run --rm -v "$TMPDIR:/etc/caddy:ro" caddy:2-alpine caddy validate --config /etc/caddy/Caddyfile 2>&1 | grep -q "Valid configuration" \
|
|
&& echo "OK: Caddyfile is valid" || { echo "FAIL: Caddyfile did not validate"; exit 1; }
|
|
|
|
# Phase 4.1: rn-lab-host-01's compose file (egress-proxy, lab-router, observability agents)
|
|
# was never covered here before — added when the lab-router service landed.
|
|
echo
|
|
echo "--- lab-host production compose ---"
|
|
LABHOST_TMPDIR="$(mktemp -d)"
|
|
sed \
|
|
-e 's/{{ registry }}/registry.example.com/g' \
|
|
-e 's/{{ image_tag }}/test/g' \
|
|
-e "s/{{ lab_router_port | default('8443') }}/8443/g" \
|
|
../lab-host/docker-compose.production.yml > "$LABHOST_TMPDIR/docker-compose.yml"
|
|
docker compose -f "$LABHOST_TMPDIR/docker-compose.yml" config --quiet
|
|
echo "OK: lab-host production compose file is well-formed YAML and passes docker compose's own schema validation"
|
|
rm -rf "$LABHOST_TMPDIR"
|