Efremenko Arhip
3a1461315f
Let a signed-in user turn their own machine into a worker without the shared token. The coordinator already binds a JWT-authenticated registration to owner_id as untrusted; this adds the missing pieces. userservice: long-lived worker keys (scimesh_wk_live_*, hash-at-rest) with create/list/revoke and a public /worker-tokens/exchange that trades a key for a short-lived JWT carrying the owner current role/verified. python worker: SCIMESH_WORKER_KEY + SCIMESH_USERSERVICE_URL; a token provider exchanges the key and refreshes the JWT proactively and on 401, so a long-running worker survives token expiry. Static bearer token path is unchanged. coordinator UI: an "add your machine" page that mints a key and shows a ready-to-run command, proxying key management to the userservice; the dashboard gains an owner-scoped "my machines" section. docs: how to run a worker from your account, plus the untrusted/quorum/ verified trust model.
72 lines
2.6 KiB
YAML
72 lines
2.6 KiB
YAML
# Demo overlay: adds the userservice (its own Postgres + migrations) alongside
|
|
# the coordinator and wires the two together with a shared JWT secret, so the
|
|
# operator UI authenticates through userservice login/registration.
|
|
#
|
|
# Used only by scripts/demo-ui.sh, merged onto docker-compose.yml with a second
|
|
# -f. Not part of the plain `make up` stack.
|
|
|
|
services:
|
|
postgres-users:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-scimesh}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-scimesh}
|
|
POSTGRES_DB: scimesh_users
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-scimesh} -d scimesh_users"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
start_period: 5s
|
|
|
|
migrate-users:
|
|
image: migrate/migrate:v4.17.1
|
|
depends_on:
|
|
postgres-users:
|
|
condition: service_healthy
|
|
volumes:
|
|
- ../users/migrations:/migrations:ro
|
|
command:
|
|
- -path=/migrations
|
|
- -database=postgres://${POSTGRES_USER:-scimesh}:${POSTGRES_PASSWORD:-scimesh}@postgres-users:5432/scimesh_users?sslmode=disable
|
|
- up
|
|
restart: on-failure
|
|
|
|
userservice:
|
|
build:
|
|
context: ../users
|
|
depends_on:
|
|
postgres-users:
|
|
condition: service_healthy
|
|
migrate-users:
|
|
condition: service_completed_successfully
|
|
environment:
|
|
USERSERVICE_ADDR: ":8081"
|
|
DATABASE_URL: postgres://${POSTGRES_USER:-scimesh}:${POSTGRES_PASSWORD:-scimesh}@postgres-users:5432/scimesh_users?sslmode=disable
|
|
JWT_SECRET: ${JWT_SECRET}
|
|
# Seeds the first admin the very first time it boots (idempotent after).
|
|
BOOTSTRAP_ADMIN_EMAIL: ${BOOTSTRAP_ADMIN_EMAIL:-root@scimesh.local}
|
|
BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD}
|
|
LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
ports:
|
|
- "${USERSERVICE_PORT:-18081}:8081"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8081/health"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 3
|
|
start_period: 5s
|
|
restart: unless-stopped
|
|
|
|
# Turn the coordinator UI into session mode: the same shared secret verifies
|
|
# userservice tokens locally, and USERSERVICE_URL is where login/register proxy.
|
|
coordinator:
|
|
environment:
|
|
JWT_SECRET: ${JWT_SECRET}
|
|
USERSERVICE_URL: http://userservice:8081
|
|
# Browser/host-facing URLs for the "add your machine" command. A user's
|
|
# worker runs on the host, so it reaches the published ports on localhost,
|
|
# not the in-cluster service names.
|
|
PUBLIC_COORDINATOR_URL: http://localhost:${COORDINATOR_PORT:-8080}
|
|
PUBLIC_USERSERVICE_URL: http://localhost:${USERSERVICE_PORT:-8081}
|