Admin
addaabc0a8
The single canonical dev flag is DCNTRLIZED_DEV=true, injected by every docker-compose.debug/dev.yaml. Dev mode now selects endpoints and behaviors without downgrading control-plane security: - lib/env: IsDev()/GiteaURL(); registry BaseURL keys on DCNTRLIZED_DEV and DCNTRLIZED_GITEA_URL (renamed from GITEA_URL). - authmgmt: Scheme()/PeerTransport() (satellite edges) key on DCNTRLIZED_DEV — dev satellites keep a plaintext RN-facing listener, production mTLS. The auth-management edge (New()) stays mTLS in both, preferring DCNTRLIZED_AUTH_URL in dev. - Removed INSECURE_INTERNAL + propagateInsecureInternal from Maestro: the orchestrator no longer runs plaintext, and no longer injects the escape hatch into services it starts. - lib/devboot: at boot (dev only) Maestro provisions the identities its compose-managed peers bind-mount at /dcntrlized/pki (before infra boots) and approves the known fleet in the auth trust store. Unknown peers still record a pending authorization and are refused (mechanisms active). - Composes: prod docker-compose.yaml is clean (no DCNTRLIZED_DEV/GITEA_URL); the debug compose carries the dev flag + DCNTRLIZED_GITEA_URL only.
27 lines
732 B
YAML
27 lines
732 B
YAML
services:
|
|
maestro-engine:
|
|
image: maestro
|
|
container_name: maestro
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- "/var/run/docker.sock:/var/run/docker.sock"
|
|
- "${XDG_DATA_HOME:-${HOME}}/.dcntrlized:/data/.dcntrlized"
|
|
- "${HOME}:/host-home:ro"
|
|
networks:
|
|
- dcntrlized_net
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
environment:
|
|
- XDG_DATA_HOME=/data
|
|
- GITEA_REGISTRY_RO_TOKEN=${GITEA_REGISTRY_RO_TOKEN}
|
|
- GITEA_RW_PACKAGE_TOKEN=${GITEA_RW_PACKAGE_TOKEN}
|
|
- GITEA_ORG=${GITEA_ORG:-Dcntrlized}
|
|
- GITEA_USER=${GITEA_USER:-admin}
|
|
- GIT_TOKEN=${GIT_TOKEN}
|
|
- REGISTRY_USER=${REGISTRY_USER:-admin}
|
|
|
|
networks:
|
|
dcntrlized_net:
|
|
external: true |