ced4568
eae8e48d43
Adds platform/lab-router/ — a narrow service that runs on the Lab Host, authenticates the Gateway via mTLS, and resolves an opaque routing token to a local container purely from Docker label state (no Postgres access, no callback to the Provisioner). Replaces the Gateway's env.internal_ip assumption (only valid when Gateway and Lab share a Docker daemon) with a data-driven direct/router decision per lab_host (lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one place (platform/gateway/src/lab-endpoint.js's labTarget()) that every proxy/fetch call site in server.js now goes through. Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh) with a second mTLS leaf pair (router-server/gateway-client) for this new data-plane connection, deployed by the docker-tls Ansible role into a separate directory from the control-plane pair. Firewall (rn-lab-host-01.rules) replaces the old speculative wide port-range allowance with one narrow rule: platform_ip -> the Router's port only. dev-local stays routing_mode: direct — zero behavior change for local dev, confirmed by the full existing regression suite passing unmodified.
92 lines
4.2 KiB
YAML
92 lines
4.2 KiB
YAML
# Production compose for rn-lab-host-01. Deployed by infra/ansible/roles/lab-host/ to
|
|
# /opt/rootnode/lab-host/docker-compose.yml, run as a systemd unit
|
|
# (rootnode-lab-host.service.j2). Runs the shared egress proxy every student Lab's outbound
|
|
# traffic passes through (platform/egress-proxy/, unchanged since Phase 1) and, as of Phase
|
|
# 4.1, the Lab Host Router (platform/lab-router/) that gives the Gateway on rn-platform-01 a
|
|
# way to reach a running Lab without ever touching a Docker-internal address — see
|
|
# docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1-3. Student Lab containers themselves are NOT
|
|
# part of this compose file — they're created/destroyed individually by the Provisioner over
|
|
# the remote Docker TLS endpoint (dockerd itself, not compose), same mechanism as dev, just
|
|
# remote; the Router finds them by label, purely from local Docker state (see its own README).
|
|
|
|
networks:
|
|
rn-egress:
|
|
driver: bridge
|
|
|
|
services:
|
|
egress-proxy:
|
|
image: "{{ registry }}/rootnode/egress-proxy:{{ image_tag }}"
|
|
restart: unless-stopped
|
|
ports:
|
|
- "3128:3128" # reachable from every per-Lab Docker network on this host — restricted
|
|
# to those networks by the Provisioner's per-environment DOCKER-USER
|
|
# chains, not by a published-port firewall rule (there is no sensible
|
|
# single source IP to restrict this to; the egress proxy's OWN allowlist
|
|
# is the actual control, see platform/egress-proxy/allowlist.txt)
|
|
networks: [rn-egress]
|
|
|
|
lab-router:
|
|
image: "{{ registry }}/rootnode/lab-router:{{ image_tag }}"
|
|
restart: unless-stopped
|
|
# Needs the host's own routing table to reach whichever per-Lab bridge network
|
|
# (rootnode-lab-net-<id>) the Provisioner created for a given container — those networks
|
|
# aren't known ahead of time and aren't attachable one-by-one, the same reason egress-proxy
|
|
# would need this too if it initiated connections outward instead of just accepting them.
|
|
# Restricted to platform_ip on port {{ lab_router_port | default('8443') }} at the host
|
|
# firewall (infra/firewall/rn-lab-host-01.rules) — this is the ONLY thing that makes host
|
|
# networking here safe, same defense-in-depth pattern as the Docker TLS port.
|
|
network_mode: host
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- /etc/rootnode/lab-router-tls:/tls:ro
|
|
environment:
|
|
LAB_ROUTER_PORT: "{{ lab_router_port | default('8443') }}"
|
|
LAB_ROUTER_TLS_CA: /tls/ca.pem
|
|
LAB_ROUTER_TLS_CERT: /tls/router-server-cert.pem
|
|
LAB_ROUTER_TLS_KEY: /tls/router-server-key.pem
|
|
|
|
node-exporter:
|
|
image: prom/node-exporter:latest
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
pid: host
|
|
volumes:
|
|
- /proc:/host/proc:ro
|
|
- /sys:/host/sys:ro
|
|
- /:/rootfs:ro
|
|
command:
|
|
- "--path.procfs=/host/proc"
|
|
- "--path.sysfs=/host/sys"
|
|
- "--path.rootfs=/rootfs"
|
|
- "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
|
|
|
|
cadvisor:
|
|
image: gcr.io/cadvisor/cadvisor:latest
|
|
restart: unless-stopped
|
|
privileged: true
|
|
devices:
|
|
- /dev/kmsg
|
|
volumes:
|
|
- /:/rootfs:ro
|
|
- /var/run:/var/run:ro
|
|
- /sys:/sys:ro
|
|
- /var/lib/docker/:/var/lib/docker:ro
|
|
ports:
|
|
- "8080:8080" # scraped remotely by Prometheus on rn-platform-01 — restricted to that
|
|
# one source IP by the host firewall (rn-lab-host-01.rules), not by
|
|
# binding to localhost, since Prometheus isn't local on this host.
|
|
|
|
promtail:
|
|
image: grafana/promtail:latest
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /opt/rootnode/lab-host/promtail-config.yml:/etc/promtail/config.yml:ro
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- /var/log/journal:/var/log/journal:ro
|
|
- /etc/machine-id:/etc/machine-id:ro
|
|
command: ["-config.file=/etc/promtail/config.yml"]
|
|
# host networking so promtail can reach Loki on rn-platform-01 over the network — this
|
|
# traffic is OUTBOUND from rn-lab-host-01 (log push, client-initiated), which the host
|
|
# firewall's default-ACCEPT OUTPUT chain already allows; nothing new needed there.
|
|
network_mode: host
|