ced4568
eae8e48d43
Adds platform/lab-router/ — a narrow service that runs on the Lab Host, authenticates the Gateway via mTLS, and resolves an opaque routing token to a local container purely from Docker label state (no Postgres access, no callback to the Provisioner). Replaces the Gateway's env.internal_ip assumption (only valid when Gateway and Lab share a Docker daemon) with a data-driven direct/router decision per lab_host (lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one place (platform/gateway/src/lab-endpoint.js's labTarget()) that every proxy/fetch call site in server.js now goes through. Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh) with a second mTLS leaf pair (router-server/gateway-client) for this new data-plane connection, deployed by the docker-tls Ansible role into a separate directory from the control-plane pair. Firewall (rn-lab-host-01.rules) replaces the old speculative wide port-range allowance with one narrow rule: platform_ip -> the Router's port only. dev-local stays routing_mode: direct — zero behavior change for local dev, confirmed by the full existing regression suite passing unmodified.
Staging environment
Same shape as production (docs/PRODUCTION_DEPLOYMENT.md applies to both — pass -e env=staging
to the Ansible playbooks), lower stakes: separate database name/port, staging-tagged images, and
COOKIE_SECURE only if staging actually sits behind HTTPS. See docs/CI_CD section in
docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md §18 for how a Gitea Actions build lands here
automatically before a human promotes it to production.
Staging is designed to run either in the homelab (a couple of low-resource VMs/containers) or,
once the dedicated server exists, as a resource-constrained slice of it — see
docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md §23 for the sizing note. It does not require a
second dedicated server.
Staging acceptance = the same four things a person actually needs before promoting a build:
app deploys, migrations run clean, one or two disposable Labs boot through the Gateway, and an
assessment can be started and completed. See infra/scripts/staging-smoke-test.sh.