ced4568
eae8e48d43
Adds platform/lab-router/ — a narrow service that runs on the Lab Host, authenticates the Gateway via mTLS, and resolves an opaque routing token to a local container purely from Docker label state (no Postgres access, no callback to the Provisioner). Replaces the Gateway's env.internal_ip assumption (only valid when Gateway and Lab share a Docker daemon) with a data-driven direct/router decision per lab_host (lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one place (platform/gateway/src/lab-endpoint.js's labTarget()) that every proxy/fetch call site in server.js now goes through. Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh) with a second mTLS leaf pair (router-server/gateway-client) for this new data-plane connection, deployed by the docker-tls Ansible role into a separate directory from the control-plane pair. Firewall (rn-lab-host-01.rules) replaces the old speculative wide port-range allowance with one narrow rule: platform_ip -> the Router's port only. dev-local stays routing_mode: direct — zero behavior change for local dev, confirmed by the full existing regression suite passing unmodified.
14 lines
754 B
Bash
14 lines
754 B
Bash
# Rendered by Ansible — see platform.env.j2 for the pattern.
|
|
PLATFORM_API_URL=http://api:4300
|
|
PROVISIONER_URL=http://provisioner:4100
|
|
PROVISIONER_SHARED_SECRET={{ vault_provisioner_shared_secret }}
|
|
GATEWAY_PORT=4200
|
|
# Phase 4.1 — mTLS client identity for the Lab Host Router (data plane). Only used when a
|
|
# lab_host's routing_mode is 'router' (see platform/gateway/src/lab-endpoint.js); harmless if
|
|
# every configured lab_host is still 'direct'. Paths are inside the container — mounted from
|
|
# /etc/rootnode/lab-router-tls on the host by the `docker-tls` role, same pattern as the
|
|
# Provisioner's Docker TLS client cert.
|
|
LAB_ROUTER_TLS_CA=/tls/ca.pem
|
|
LAB_ROUTER_TLS_CERT=/tls/gateway-client-cert.pem
|
|
LAB_ROUTER_TLS_KEY=/tls/gateway-client-key.pem
|