Audiobuzz
4c1db3f765
Management-plane ingress: a host-networked Traefik terminates the LE cert on :443
(Route 53 DNS-01, public-resolver propagation check) and forwards plaintext to
the manager running FLEET_MGR_ADMIN_BEHIND_PROXY=true on loopback :9500. Only the
admin plane rides Traefik — the agent gRPC/mTLS plane (:9600) stays direct (Traefik
can't terminate fleet-CA mTLS; hosts reach it via OPNsense L3 routing). This is the
k8s ingress-controller + cert-manager role in miniature.
- traefik/dynamic/fleet-manager.yml: file-provider router (Host rule -> manager),
passHostHeader so the WebAuthn RP origin matches.
- compose: traefik service (static config as CLI flags so ${ACME_EMAIL} interpolates)
+ traefik-acme volume; manager switched to behind-proxy defaults, RP_ORIGIN now
the port-less https origin.
- Retire the acme side-car (Traefik owns ACME now): remove the service + acme-state
volume; renew-loop.sh kept + relabelled as the self-TLS-mode cert helper.
- :443 only (admin UI is https-only) so it can't collide with a boot-LAN nginx :80.
174 lines
8.9 KiB
YAML
174 lines
8.9 KiB
YAML
# =============================================================================
|
|
# fleet-manager — server-side fleet control plane + admin SPA, plus its private
|
|
# InfluxDB metrics store. Runs on the MANAGEMENT host (never the boot LAN).
|
|
#
|
|
# cp .env.example .env # set RP origin, Influx token, cert/PKI paths
|
|
# ./server-pki.sh # issue the agent-plane server cert (fleet CA)
|
|
# ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager
|
|
# docker compose up -d influxdb
|
|
# docker compose run --rm fleet-manager register-admin <you> # passkey link
|
|
# docker compose up -d fleet-manager
|
|
#
|
|
# See DEPLOY.md for the full bring-up (PKI, Let's Encrypt DNS-01, register-admin).
|
|
#
|
|
# Trust model (two planes, see README.md):
|
|
# - admin : HTTPS + WebAuthn passkey, loopback 127.0.0.1:9500 (front with the
|
|
# mgmt reverse proxy that terminates the LE cert, or expose directly).
|
|
# - agent : gRPC + mTLS (fleet CA), on a routable mgmt interface so enrolled
|
|
# hosts can dial in (FLEET_MGR_AGENT_ADDR).
|
|
#
|
|
# fleet-manager uses HOST networking (like enrol-broker): it must reach the
|
|
# broker's admin plane on 127.0.0.1:9443 and bind the agent listener on a
|
|
# routable mgmt address. InfluxDB stays on a private bridge and is published
|
|
# ONLY to loopback (127.0.0.1:8086), so the host-networked manager reaches it
|
|
# while nothing else on any LAN can.
|
|
# =============================================================================
|
|
|
|
services:
|
|
# --- metrics store (private; only the manager reads/writes it) --------------
|
|
influxdb:
|
|
image: harbor.bitasylum.org/dockerhub/library/influxdb:2.7
|
|
restart: unless-stopped
|
|
# Publish to loopback only — the host-networked manager reaches it at
|
|
# 127.0.0.1:8086; it is never on the boot/mgmt LAN.
|
|
ports:
|
|
- "127.0.0.1:8086:8086"
|
|
environment:
|
|
DOCKER_INFLUXDB_INIT_MODE: setup
|
|
DOCKER_INFLUXDB_INIT_USERNAME: "${INFLUX_ADMIN_USER:-fleet-admin}"
|
|
DOCKER_INFLUXDB_INIT_PASSWORD: "${INFLUX_ADMIN_PASSWORD:?set INFLUX_ADMIN_PASSWORD in .env}"
|
|
DOCKER_INFLUXDB_INIT_ORG: "${FLEET_MGR_INFLUX_ORG:-fleet}"
|
|
DOCKER_INFLUXDB_INIT_BUCKET: "${FLEET_MGR_INFLUX_BUCKET:-fleet_health}"
|
|
DOCKER_INFLUXDB_INIT_RETENTION: "${INFLUX_RETENTION:-90d}"
|
|
# Deterministic operator token so the manager can be handed the SAME value
|
|
# in FLEET_MGR_INFLUX_TOKEN without a post-setup copy step. Treat as a
|
|
# secret (it lives in .env, which is gitignored).
|
|
DOCKER_INFLUXDB_INIT_ADMIN_TOKEN: "${FLEET_MGR_INFLUX_TOKEN:?set FLEET_MGR_INFLUX_TOKEN in .env}"
|
|
volumes:
|
|
- influx-data:/var/lib/influxdb2
|
|
- influx-config:/etc/influxdb2
|
|
networks:
|
|
- fleet-mgmt
|
|
healthcheck:
|
|
test: ["CMD", "influx", "ping"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# --- the control plane + embedded SPA --------------------------------------
|
|
# CI builds + pushes this image (.gitea/workflows/fleet-manager-image.yaml);
|
|
# `docker compose pull` fetches it. `build: .` stays so local dev can still
|
|
# `docker compose build fleet-manager`. Pin FLEET_MANAGER_VERSION in .env to a
|
|
# CI tag (e.g. main-<sha7>); defaults to :latest.
|
|
fleet-manager:
|
|
image: "git.bitasylum.org/audiobuzz/fleet-manager:${FLEET_MANAGER_VERSION:-latest}"
|
|
build: .
|
|
restart: unless-stopped
|
|
# Host networking: reach the broker on 127.0.0.1:9443 + InfluxDB on
|
|
# 127.0.0.1:8086, and bind the agent gRPC listener on a routable mgmt addr.
|
|
network_mode: host
|
|
depends_on:
|
|
influxdb:
|
|
condition: service_healthy
|
|
environment:
|
|
# admin plane — passkey auth behind the Traefik mgmt ingress: Traefik
|
|
# terminates the LE cert on :443 and forwards plaintext here on loopback,
|
|
# so the listener MUST stay private (127.0.0.1) — only Traefik reaches it.
|
|
FLEET_MGR_ADMIN_ADDR: "${FLEET_MGR_ADMIN_ADDR:-127.0.0.1:9500}"
|
|
FLEET_MGR_ADMIN_BEHIND_PROXY: "${FLEET_MGR_ADMIN_BEHIND_PROXY:-true}"
|
|
FLEET_MGR_ADMIN_INSECURE: "${FLEET_MGR_ADMIN_INSECURE:-false}"
|
|
# Only used for self-TLS mode (BEHIND_PROXY=false + a cert, no Traefik):
|
|
FLEET_MGR_ADMIN_CERT: "${FLEET_MGR_ADMIN_CERT:-/pki/admin/fullchain.pem}"
|
|
FLEET_MGR_ADMIN_KEY: "${FLEET_MGR_ADMIN_KEY:-/pki/admin/privkey.pem}"
|
|
# WebAuthn RP — MUST be the UI's real origin (origin-bound passkeys). Behind
|
|
# Traefik on :443 this is the PORT-LESS https origin.
|
|
FLEET_MGR_RP_ID: "${FLEET_MGR_RP_ID:?set FLEET_MGR_RP_ID in .env}"
|
|
FLEET_MGR_RP_ORIGIN: "${FLEET_MGR_RP_ORIGIN:?set FLEET_MGR_RP_ORIGIN in .env}"
|
|
FLEET_MGR_RP_NAME: "${FLEET_MGR_RP_NAME:-Fleet Command}"
|
|
FLEET_MGR_ENROLL_KEY_FILE: "/data/enroll.key"
|
|
FLEET_MGR_ADMIN_STORE: "/data/admins.json"
|
|
FLEET_MGR_SESSION_TTL_MIN: "${FLEET_MGR_SESSION_TTL_MIN:-720}"
|
|
|
|
# agent plane (gRPC + mTLS, fleet CA). Bind a routable mgmt addr so hosts
|
|
# can dial in; verify host TPM certs against the fleet root.
|
|
FLEET_MGR_AGENT_ADDR: "${FLEET_MGR_AGENT_ADDR:-:9600}"
|
|
FLEET_MGR_AGENT_CERT: "/pki/agent/server.crt"
|
|
FLEET_MGR_AGENT_KEY: "/pki/agent/server.key"
|
|
FLEET_MGR_AGENT_CLIENT_CA: "/pki/agent/fleet-ca.crt"
|
|
|
|
# authorise pillar — drive the enrol-broker admin plane over mTLS.
|
|
FLEET_MGR_BROKER_URL: "${FLEET_MGR_BROKER_URL:-https://127.0.0.1:9443}"
|
|
FLEET_MGR_BROKER_CLIENT_CERT: "/pki/broker/clients/fleet-manager.crt"
|
|
FLEET_MGR_BROKER_CLIENT_KEY: "/pki/broker/clients/fleet-manager.key"
|
|
FLEET_MGR_BROKER_CA: "/pki/broker/admin-ca.crt"
|
|
|
|
# metrics — the manager is the ONLY reader/writer; token stays server-side.
|
|
FLEET_MGR_INFLUX_URL: "http://127.0.0.1:8086"
|
|
FLEET_MGR_INFLUX_TOKEN: "${FLEET_MGR_INFLUX_TOKEN:?set FLEET_MGR_INFLUX_TOKEN in .env}"
|
|
FLEET_MGR_INFLUX_ORG: "${FLEET_MGR_INFLUX_ORG:-fleet}"
|
|
FLEET_MGR_INFLUX_BUCKET: "${FLEET_MGR_INFLUX_BUCKET:-fleet_health}"
|
|
|
|
FLEET_MGR_INVENTORY: "/data/inventory.json"
|
|
HOSTNQN_BASE: "${HOSTNQN_BASE:-nqn.2026-06.org.example.fleet:host-}"
|
|
volumes:
|
|
# Durable state (inventory + admin passkeys + enrol key). Back this up.
|
|
- fleet-data:/data
|
|
# PKI, read-only: admin LE cert, agent-plane fleet-CA server cert, and the
|
|
# broker admin-client cert. See DEPLOY.md / server-pki.sh for what lands here.
|
|
# The admin LE cert under ./pki/admin/ is produced by the `acme` side-car.
|
|
- ./pki:/pki:ro
|
|
|
|
# --- management-plane ingress (Traefik) — admin UI on :443 ------------------
|
|
# Terminates the Let's Encrypt cert (Route 53 DNS-01) on :443 and forwards
|
|
# plaintext to the manager (behind-proxy mode, loopback :9500). Host networking
|
|
# so it binds :443 on the mgmt interface and reaches the host-networked manager
|
|
# on 127.0.0.1:9500. Needs outbound reach to Let's Encrypt + the AWS Route 53
|
|
# API. ONLY the admin plane rides Traefik — the agent gRPC/mTLS plane (:9600) is
|
|
# direct (Traefik can't terminate fleet-CA client-cert mTLS; hosts reach it via
|
|
# OPNsense L3 routing). This is the k8s ingress-controller + cert-manager role
|
|
# in miniature — the router/ACME model maps to Traefik Ingress + cert-manager.
|
|
#
|
|
# NOTE: only :443 (the admin UI is https-only; passkeys require it) so it can't
|
|
# collide with a boot-LAN nginx :80 on a single-host lab. Route 53 DNS-01 needs
|
|
# no :80. Set the Host() rule in traefik/dynamic/fleet-manager.yml to your UI host.
|
|
traefik:
|
|
image: traefik:v3.1 # mirror via harbor if no dockerhub egress
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
command:
|
|
- "--global.checknewversion=false"
|
|
- "--global.sendanonymoususage=false"
|
|
- "--entrypoints.websecure.address=:443"
|
|
- "--providers.file.directory=/etc/traefik/dynamic"
|
|
- "--providers.file.watch=true"
|
|
- "--certificatesresolvers.le.acme.email=${ACME_EMAIL:?set ACME_EMAIL in .env}"
|
|
- "--certificatesresolvers.le.acme.storage=/acme/acme.json"
|
|
- "--certificatesresolvers.le.acme.dnschallenge.provider=route53"
|
|
# Public resolvers for the propagation check (split-horizon DNS won't serve
|
|
# the public _acme-challenge). First dry-run vs LE staging: also add
|
|
# --certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
|
|
- "--certificatesresolvers.le.acme.dnschallenge.resolvers=8.8.8.8:53,1.1.1.1:53"
|
|
- "--log.level=INFO"
|
|
environment:
|
|
# Route 53 DNS-01 creds (or attach an instance role + omit). IAM policy in
|
|
# DEPLOY.md §2c; AWS_HOSTED_ZONE_ID optional (pins the zone).
|
|
AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID:-}"
|
|
AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY:-}"
|
|
AWS_REGION: "${AWS_REGION:-us-east-1}"
|
|
AWS_HOSTED_ZONE_ID: "${AWS_HOSTED_ZONE_ID:-}"
|
|
volumes:
|
|
- ./traefik/dynamic:/etc/traefik/dynamic:ro
|
|
- traefik-acme:/acme # acme.json (ACME account + issued certs) — PERSIST
|
|
depends_on:
|
|
- fleet-manager
|
|
|
|
volumes:
|
|
influx-data:
|
|
influx-config:
|
|
fleet-data:
|
|
traefik-acme:
|
|
|
|
networks:
|
|
fleet-mgmt:
|
|
driver: bridge
|