ced4568
4bc202e5f3
- integration-routes.js: POST /api/integrations/enrollments — separate from student/instructor session auth entirely (no cookie read), pre-shared-secret header auth matching the existing Gateway<->Provisioner trust-boundary pattern. Idempotent via a DB unique constraint on the caller's own event_id (not app-level check-then-insert) — proven safe under real concurrent duplicate requests. Student resolution is create-or-match by email OR login_identifier (minor/no-email support), reusing Phase 5A's exact credential-issuing path. A small, provider-neutral status vocabulary (paid/active/confirmed/pending/awaiting_payment) — never a raw payment-provider object model. - docker-compose.dev.yml: INTEGRATION_SHARED_SECRET, optional in dev (fails closed if unset).
98 lines
4.2 KiB
YAML
98 lines
4.2 KiB
YAML
# Phase 2B full-stack local dev/test — Postgres + egress-proxy + Provisioner + the lightweight
|
|
# Platform API + the Gateway, all on one machine (the documented Phase 1/2A/2B dev exception;
|
|
# production is the two-VM Proxmox split, see docs/LAB_ARCHITECTURE.md §1).
|
|
#
|
|
# `api` (platform/api) replaces Phase 2A's "identity" service — that was a full, --privileged
|
|
# Lab image booting an unused k3s cluster just to serve roster/curriculum/progress APIs. This
|
|
# is a plain Node process: no k3s, no --privileged, no terminal runtime. It owns
|
|
# students/cohorts/enrollments/curriculum/progress/scenario_attempts in Postgres and is the
|
|
# only service that talks to the Provisioner (student launch/reset AND instructor/admin
|
|
# actions) — see docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md.
|
|
#
|
|
# gateway, provisioner, and api's egress-adjacent needs aside, `api` does NOT need
|
|
# network_mode: host — it never touches Docker networking or firewall rules itself, it only
|
|
# calls the Provisioner's HTTP API and Postgres. gateway and provisioner keep network_mode:
|
|
# host because they need to reach ephemeral per-student Lab containers by internal IP /
|
|
# manage firewall rules on the host network namespace.
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
POSTGRES_DB: rootnode_platform
|
|
ports:
|
|
- "5433:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
egress-proxy:
|
|
build: ./egress-proxy
|
|
network_mode: host
|
|
|
|
provisioner:
|
|
build: ./provisioner
|
|
network_mode: host
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
environment:
|
|
PLATFORM_DB_URL: postgres://postgres:postgres@localhost:5433/rootnode_platform
|
|
PROVISIONER_SHARED_SECRET: ${PROVISIONER_SHARED_SECRET:?set a real secret, do not use a default}
|
|
PROVISIONER_PORT: "4100"
|
|
LAB_IMAGE_REF: ${LAB_IMAGE_REF:-rootnode-academy:test}
|
|
EGRESS_PROXY_PORT: "3128"
|
|
DNS_RESOLVER: "127.0.0.11"
|
|
NO_PROXY_CIDRS: "10.42.0.0/16,10.43.0.0/16"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
|
|
api:
|
|
build:
|
|
context: ..
|
|
dockerfile: platform/api/Dockerfile
|
|
network_mode: host # needs to reach the Provisioner at localhost:4100 (host-networked);
|
|
# port 4300 is directly the host's port under host networking, no
|
|
# `ports:` mapping needed (and compose rejects one with this mode).
|
|
environment:
|
|
# localhost:5433, not the "postgres" compose hostname — network_mode: host means this
|
|
# container is on the host's network namespace, not the compose bridge network, so
|
|
# compose's internal DNS doesn't resolve here (same reason Provisioner uses localhost too).
|
|
PLATFORM_DB_URL: postgres://postgres:postgres@localhost:5433/rootnode_platform
|
|
PROVISIONER_URL: "http://localhost:4100"
|
|
PROVISIONER_SHARED_SECRET: ${PROVISIONER_SHARED_SECRET:?set a real secret, do not use a default}
|
|
# Phase 5B — the website/commerce integration boundary's shared secret (see
|
|
# docs/WEBSITE_ENROLLMENT_INTEGRATION.md). Optional in dev: unset means
|
|
# POST /api/integrations/enrollments refuses every request (fails closed), which is fine
|
|
# for anyone not exercising that boundary locally.
|
|
INTEGRATION_SHARED_SECRET: ${INTEGRATION_SHARED_SECRET:-}
|
|
PLATFORM_API_PORT: "4300"
|
|
# No ADMIN_PASSWORD anymore (Phase 3A) — instructor accounts live in Postgres, created via
|
|
# `npm run bootstrap-owner` for the first owner and the admin portal after that.
|
|
# COOKIE_SECURE: "1" # set once served over real HTTPS
|
|
# TRUST_PROXY: "1" # set once fronted by a trusted reverse proxy
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
provisioner:
|
|
condition: service_started
|
|
|
|
gateway:
|
|
build: ./gateway
|
|
network_mode: host
|
|
environment:
|
|
GATEWAY_PORT: "4200"
|
|
PROVISIONER_URL: "http://localhost:4100"
|
|
PROVISIONER_SHARED_SECRET: ${PROVISIONER_SHARED_SECRET:?set a real secret, do not use a default}
|
|
PLATFORM_API_URL: "http://localhost:4300"
|
|
depends_on:
|
|
- provisioner
|
|
- api
|