ced4568
eae8e48d43
Adds platform/lab-router/ — a narrow service that runs on the Lab Host, authenticates the Gateway via mTLS, and resolves an opaque routing token to a local container purely from Docker label state (no Postgres access, no callback to the Provisioner). Replaces the Gateway's env.internal_ip assumption (only valid when Gateway and Lab share a Docker daemon) with a data-driven direct/router decision per lab_host (lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one place (platform/gateway/src/lab-endpoint.js's labTarget()) that every proxy/fetch call site in server.js now goes through. Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh) with a second mTLS leaf pair (router-server/gateway-client) for this new data-plane connection, deployed by the docker-tls Ansible role into a separate directory from the control-plane pair. Firewall (rn-lab-host-01.rules) replaces the old speculative wide port-range allowance with one narrow rule: platform_ip -> the Router's port only. dev-local stays routing_mode: direct — zero behavior change for local dev, confirmed by the full existing regression suite passing unmodified.
38 lines
2.0 KiB
YAML
38 lines
2.0 KiB
YAML
# lab_hosts seed — applied to the DB at Provisioner startup (config.js applyLabHostsSeed), not
|
|
# managed via a runtime API (no host-management endpoints yet — see
|
|
# docs/PHASE1_PLATFORM_FOUNDATION.md §4, "don't overbuild scheduling yet").
|
|
#
|
|
# `endpoint`/`tls_*_path` — the Provisioner's CONTROL-plane connection to this host's Docker
|
|
# daemon (create/start/stop/remove containers). Unchanged since Phase 1.
|
|
#
|
|
# `routing_mode`/`router_endpoint` — Phase 4.1 addition, the Gateway's DATA-plane path to a
|
|
# running Lab on this host. See docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1 and
|
|
# docs/PRODUCTION_NETWORK_SECURITY.md.
|
|
# direct — Gateway reaches env.internal_ip:internal_port itself. Only correct when Gateway
|
|
# and this lab_host's Docker daemon are on the same network namespace (dev,
|
|
# single-host). This is the default and requires no router_endpoint.
|
|
# router — Gateway reaches this lab_host's Lab Host Router (platform/lab-router) instead,
|
|
# over mTLS, and never touches a Docker-internal address. Required once this
|
|
# lab_host is a genuinely separate VM from the Gateway.
|
|
|
|
lab_hosts:
|
|
- lab_host_id: dev-local
|
|
display_name: "Local development Docker socket"
|
|
endpoint: "unix:///var/run/docker.sock"
|
|
enabled: true
|
|
routing_mode: direct
|
|
|
|
# Production example (not active — shown for reference; uncomment and fill in once a real
|
|
# Lab Host VM exists). CONTROL plane: Provisioner -> dockerd, mTLS, port 2376. DATA plane:
|
|
# Gateway -> Lab Host Router, mTLS, router's own port (infra default 8443) — see
|
|
# infra/docker/lab-host/docker-compose.production.yml and infra/ansible/roles/lab-router.
|
|
# - lab_host_id: labhost-01
|
|
# display_name: "RootNode Lab Host VM 01"
|
|
# endpoint: "tcp://10.20.30.5:2376"
|
|
# tls_ca_path: /etc/rootnode/tls/labhost-01/ca.pem
|
|
# tls_cert_path: /etc/rootnode/tls/labhost-01/cert.pem
|
|
# tls_key_path: /etc/rootnode/tls/labhost-01/key.pem
|
|
# enabled: true
|
|
# routing_mode: router
|
|
# router_endpoint: "https://10.20.30.5:8443"
|