Files

T

ced4568 eae8e48d43 feat(routing): Lab Host Router closes the Gateway-to-Lab cross-VM gap

Adds platform/lab-router/ — a narrow service that runs on the Lab Host,
authenticates the Gateway via mTLS, and resolves an opaque routing token to
a local container purely from Docker label state (no Postgres access, no
callback to the Provisioner). Replaces the Gateway's env.internal_ip
assumption (only valid when Gateway and Lab share a Docker daemon) with a
data-driven direct/router decision per lab_host
(lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one
place (platform/gateway/src/lab-endpoint.js's labTarget()) that every
proxy/fetch call site in server.js now goes through.

Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh)
with a second mTLS leaf pair (router-server/gateway-client) for this new
data-plane connection, deployed by the docker-tls Ansible role into a
separate directory from the control-plane pair. Firewall
(rn-lab-host-01.rules) replaces the old speculative wide port-range
allowance with one narrow rule: platform_ip -> the Router's port only.

dev-local stays routing_mode: direct — zero behavior change for local dev,
confirmed by the full existing regression suite passing unmodified.

2026-08-24 20:14:39 -05:00

lab-hosts.yaml

feat(routing): Lab Host Router closes the Gateway-to-Lab cross-VM gap

2026-08-24 20:14:39 -05:00

README.md

feat(ansible): idempotent role-based host config for both production VMs

2026-08-18 17:13:01 -05:00

resource-policy.yaml

feat(ansible): idempotent role-based host config for both production VMs

2026-08-18 17:13:01 -05:00

README.md

Production Provisioner config overlay

Deployed by the platform Ansible role to /etc/rootnode/provisioner-config/ on rn-platform-01 (PROVISIONER_CONFIG_DIR), replacing the dev-only files shipped in platform/provisioner/config/.

lab-hosts.yaml — points at the real rn-lab-host-01 VM over TLS instead of the dev Unix socket. TLS paths reference material generated by infra/scripts/docker-tls/ and deployed by the docker-tls Ansible role — never checked into this repo (see infra/docker/tls/.gitignore).
resource-policy.yaml — deliberately still the Phase 1 dev defaults, unchanged, with a loud comment explaining why. Per the explicit Phase 4 instruction: do not hard-code final per-Lab CPU/RAM numbers before the real host is benchmarked (docs/CAPACITY_PLANNING.md). Whoever runs the first production load test (infra/scripts/loadtest/) updates this file with real measured numbers, not this deployment.