ced4568
eae8e48d43
Adds platform/lab-router/ — a narrow service that runs on the Lab Host, authenticates the Gateway via mTLS, and resolves an opaque routing token to a local container purely from Docker label state (no Postgres access, no callback to the Provisioner). Replaces the Gateway's env.internal_ip assumption (only valid when Gateway and Lab share a Docker daemon) with a data-driven direct/router decision per lab_host (lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one place (platform/gateway/src/lab-endpoint.js's labTarget()) that every proxy/fetch call site in server.js now goes through. Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh) with a second mTLS leaf pair (router-server/gateway-client) for this new data-plane connection, deployed by the docker-tls Ansible role into a separate directory from the control-plane pair. Firewall (rn-lab-host-01.rules) replaces the old speculative wide port-range allowance with one narrow rule: platform_ip -> the Router's port only. dev-local stays routing_mode: direct — zero behavior change for local dev, confirmed by the full existing regression suite passing unmodified.
33 lines
1.6 KiB
SQL
33 lines
1.6 KiB
SQL
-- lab_hosts routing mode — Phase 4.1, docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1.
|
|
--
|
|
-- Removes the Gateway's dependency on env.internal_ip being reachable directly, which only
|
|
-- holds when Gateway and the Lab container share a Docker daemon (true in dev, false once
|
|
-- Labs run on a genuinely separate rn-lab-host-01 VM). A lab_host is either:
|
|
-- 'direct' — Gateway reaches env.internal_ip:internal_port itself. Correct when Gateway and
|
|
-- this lab_host's Docker daemon share a network namespace (dev, single-host).
|
|
-- 'router' — Gateway reaches this lab_host's Lab Host Router (router_endpoint) over mTLS
|
|
-- instead, carrying the environment's routing_token in a header; the Router
|
|
-- resolves that token to a local container on ITS OWN host and reverse-proxies.
|
|
-- Correct once this lab_host is a genuinely separate VM.
|
|
--
|
|
-- Existing 'dev-local' row keeps routing_mode='direct' (the default) — no behavior change for
|
|
-- current dev/single-host setups. All existing lab_hosts rows and every environments row are
|
|
-- untouched; this only adds columns.
|
|
|
|
ALTER TABLE lab_hosts ADD COLUMN IF NOT EXISTS routing_mode TEXT NOT NULL DEFAULT 'direct';
|
|
ALTER TABLE lab_hosts ADD COLUMN IF NOT EXISTS router_endpoint TEXT;
|
|
|
|
DO $$ BEGIN
|
|
ALTER TABLE lab_hosts ADD CONSTRAINT lab_hosts_routing_mode_check
|
|
CHECK (routing_mode IN ('direct', 'router'));
|
|
EXCEPTION
|
|
WHEN duplicate_object THEN NULL;
|
|
END $$;
|
|
|
|
DO $$ BEGIN
|
|
ALTER TABLE lab_hosts ADD CONSTRAINT lab_hosts_router_endpoint_required_check
|
|
CHECK (routing_mode = 'direct' OR router_endpoint IS NOT NULL);
|
|
EXCEPTION
|
|
WHEN duplicate_object THEN NULL;
|
|
END $$;
|