ced4568
eae8e48d43
Adds platform/lab-router/ — a narrow service that runs on the Lab Host, authenticates the Gateway via mTLS, and resolves an opaque routing token to a local container purely from Docker label state (no Postgres access, no callback to the Provisioner). Replaces the Gateway's env.internal_ip assumption (only valid when Gateway and Lab share a Docker daemon) with a data-driven direct/router decision per lab_host (lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one place (platform/gateway/src/lab-endpoint.js's labTarget()) that every proxy/fetch call site in server.js now goes through. Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh) with a second mTLS leaf pair (router-server/gateway-client) for this new data-plane connection, deployed by the docker-tls Ansible role into a separate directory from the control-plane pair. Firewall (rn-lab-host-01.rules) replaces the old speculative wide port-range allowance with one narrow rule: platform_ip -> the Router's port only. dev-local stays routing_mode: direct — zero behavior change for local dev, confirmed by the full existing regression suite passing unmodified.
28 lines
1.6 KiB
YAML
28 lines
1.6 KiB
YAML
# Production lab_hosts seed — points at the real rn-lab-host-01 VM instead of Phase 1's dev
|
|
# Unix socket. Same mechanism the Provisioner has had since Phase 1
|
|
# (platform/provisioner/config/lab-hosts.seed.yaml), just pointed at real remote endpoints.
|
|
#
|
|
# Phase 4.1 correction: routing_mode/router_endpoint is REQUIRED here — Phase 4's original
|
|
# claim that "no application code changes required" was true for the Provisioner's CONTROL
|
|
# plane (Docker mTLS) but false for the Gateway's DATA plane, which used to assume
|
|
# env.internal_ip was directly reachable. It is not, across two real VMs. See
|
|
# docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1 and docs/PRODUCTION_NETWORK_SECURITY.md.
|
|
#
|
|
# {{ lab_host_ip }} is an Ansible template variable — see infra/ansible/group_vars/production.yml.
|
|
# Rendered by the `platform` role; the raw file here keeps the placeholder for readability.
|
|
|
|
lab_hosts:
|
|
- lab_host_id: labhost-01
|
|
display_name: "RootNode Lab Host VM 01 (production)"
|
|
# CONTROL plane: Provisioner -> dockerd, mTLS, port 2376.
|
|
endpoint: "tcp://{{ lab_host_ip }}:2376"
|
|
tls_ca_path: /etc/rootnode/docker-tls/ca.pem
|
|
tls_cert_path: /etc/rootnode/docker-tls/provisioner-client-cert.pem
|
|
tls_key_path: /etc/rootnode/docker-tls/provisioner-client-key.pem
|
|
enabled: true
|
|
# DATA plane: Gateway -> Lab Host Router, mTLS, router's own port (8443 by default —
|
|
# infra/docker/lab-host/docker-compose.production.yml). Gateway never touches a
|
|
# Docker-internal address once routing_mode is 'router'.
|
|
routing_mode: router
|
|
router_endpoint: "https://{{ lab_host_ip }}:8443"
|