ced4568
eae8e48d43
Adds platform/lab-router/ — a narrow service that runs on the Lab Host, authenticates the Gateway via mTLS, and resolves an opaque routing token to a local container purely from Docker label state (no Postgres access, no callback to the Provisioner). Replaces the Gateway's env.internal_ip assumption (only valid when Gateway and Lab share a Docker daemon) with a data-driven direct/router decision per lab_host (lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one place (platform/gateway/src/lab-endpoint.js's labTarget()) that every proxy/fetch call site in server.js now goes through. Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh) with a second mTLS leaf pair (router-server/gateway-client) for this new data-plane connection, deployed by the docker-tls Ansible role into a separate directory from the control-plane pair. Firewall (rn-lab-host-01.rules) replaces the old speculative wide port-range allowance with one narrow rule: platform_ip -> the Router's port only. dev-local stays routing_mode: direct — zero behavior change for local dev, confirmed by the full existing regression suite passing unmodified.
23 lines
786 B
YAML
23 lines
786 B
YAML
---
|
|
- name: restart docker with tls
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
state: restarted
|
|
daemon_reload: true
|
|
|
|
# Phase 4.1 — these restart the whole per-host compose wrapper unit (no per-container systemd
|
|
# units exist in this project's convention, see the `platform`/`lab-host` roles), which is
|
|
# heavier than a surgical single-container restart but consistent with how every other
|
|
# config-changed-so-restart-the-stack case is already handled here.
|
|
- name: restart lab-router
|
|
ansible.builtin.systemd:
|
|
name: rootnode-lab-host.service
|
|
state: restarted
|
|
when: inventory_hostname in groups['lab_host']
|
|
|
|
- name: restart gateway
|
|
ansible.builtin.systemd:
|
|
name: rootnode-platform.service
|
|
state: restarted
|
|
when: inventory_hostname in groups['platform']
|