fix(deploy): isolate local vector compose secrets
This commit is contained in:
@@ -47,3 +47,13 @@ the in-process validated `DatabaseConfig` used to establish PostgreSQL connectio
|
||||
serialized by doctor/Compose/inspect paths. Docker Desktop file-backed secrets may appear as bind
|
||||
mounts; the safe runtime exception is therefore based on the read-only service mount location
|
||||
`/run/secrets`, while source files remain owner-only on the host.
|
||||
|
||||
## External-profile regression follow-up
|
||||
|
||||
Local pgvector is now an explicit `deploy/compose.local-vector.yaml` overlay. The base Compose and
|
||||
production external override contain no direct vector password declarations, mounts, or `_FILE`
|
||||
variables, so external deployments do not resolve or require local password files. A real lifecycle
|
||||
gate unsets all local secret-file variables, renders external config, builds and starts core, waits
|
||||
for health, and inspects the live container for absence of local direct-vector secret paths. The
|
||||
local overlay retains its live inspect assertion (paths present, values absent), rotation, restart
|
||||
persistence, and transactional backup/restore drill.
|
||||
|
||||
@@ -47,8 +47,9 @@ later with `docker compose --project-name "$SMOKE_PROJECT" --profile external do
|
||||
|
||||
## Optional local pgvector and recovery
|
||||
|
||||
Start the persistent local vector profile with `docker compose --profile local-vector up
|
||||
--build --wait`. Its `vector_data` volume is independent of application state. Reader, writer,
|
||||
Start the persistent local vector profile with `docker compose -f compose.yaml -f
|
||||
deploy/compose.local-vector.yaml --profile local-vector up --build --wait`. Its `vector_data`
|
||||
volume is independent of application state. Reader, writer,
|
||||
migrator, and bootstrap credentials remain separate; password files must be mode `0600` and
|
||||
must not be passed as URL arguments.
|
||||
|
||||
|
||||
+2
-102
@@ -6,7 +6,7 @@ x-smoke-labels: &smoke-labels
|
||||
services:
|
||||
core:
|
||||
image: thothii-core:local
|
||||
profiles: [external, local-vector]
|
||||
profiles: [external]
|
||||
build:
|
||||
context: .
|
||||
dockerfile: docker/core.Dockerfile
|
||||
@@ -16,22 +16,9 @@ services:
|
||||
THOTH_PUBLIC_EXPOSURE: "${THOTH_PUBLIC_EXPOSURE:-false}"
|
||||
THT_DATA_ROOT: /data
|
||||
SETTINGS_FILE: /data/settings/settings.json
|
||||
THT_VECTOR_DATABASE: "${THT_VECTOR_DATABASE:-thoth}"
|
||||
THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
|
||||
THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
|
||||
THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
|
||||
THT_VECTOR_READER_PASSWORD_FILE: /run/secrets/vector_reader_password
|
||||
THT_VECTOR_WRITER_PASSWORD_FILE: /run/secrets/vector_writer_password
|
||||
secrets:
|
||||
- vector_reader_password
|
||||
- vector_writer_password
|
||||
volumes:
|
||||
- thoth_data:/data
|
||||
- ./deploy/workspaces:/app/harness/workspaces:ro
|
||||
depends_on:
|
||||
vector-migrate:
|
||||
condition: service_completed_successfully
|
||||
required: false
|
||||
healthcheck:
|
||||
test: [CMD, curl, --fail, --silent, http://127.0.0.1:8787/health]
|
||||
interval: 5s
|
||||
@@ -41,7 +28,7 @@ services:
|
||||
restart: unless-stopped
|
||||
|
||||
frontend:
|
||||
profiles: [external, local-vector]
|
||||
profiles: [external]
|
||||
build:
|
||||
context: .
|
||||
dockerfile: docker/frontend.Dockerfile
|
||||
@@ -61,97 +48,10 @@ services:
|
||||
start_period: 5s
|
||||
restart: unless-stopped
|
||||
|
||||
vector-db:
|
||||
image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
|
||||
profiles: [local-vector]
|
||||
labels: *smoke-labels
|
||||
environment:
|
||||
POSTGRES_DB: "${THT_VECTOR_DATABASE:-thoth}"
|
||||
POSTGRES_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
|
||||
POSTGRES_PASSWORD_FILE: /run/secrets/vector_bootstrap_password
|
||||
THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
|
||||
THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
|
||||
THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
|
||||
secrets:
|
||||
- vector_bootstrap_password
|
||||
- vector_migrator_password
|
||||
- vector_reader_password
|
||||
- vector_writer_password
|
||||
volumes:
|
||||
- vector_data:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: [CMD-SHELL, "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 20
|
||||
start_period: 10s
|
||||
restart: unless-stopped
|
||||
|
||||
vector-reconcile:
|
||||
image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
|
||||
profiles: [local-vector]
|
||||
labels: *smoke-labels
|
||||
environment:
|
||||
PGHOST: vector-db
|
||||
PGPORT: 5432
|
||||
PGDATABASE: "${THT_VECTOR_DATABASE:-thoth}"
|
||||
PGUSER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
|
||||
THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
|
||||
THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
|
||||
THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
|
||||
THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
|
||||
entrypoint: [/opt/thoth/reconcile-roles.sh]
|
||||
secrets:
|
||||
- vector_bootstrap_password
|
||||
- vector_migrator_password
|
||||
- vector_reader_password
|
||||
- vector_writer_password
|
||||
volumes:
|
||||
- ./deploy/vector/reconcile-roles.sh:/opt/thoth/reconcile-roles.sh:ro
|
||||
- ./deploy/vector/secret-policy.sh:/opt/thoth/secret-policy.sh:ro
|
||||
depends_on:
|
||||
vector-db:
|
||||
condition: service_healthy
|
||||
restart: "no"
|
||||
|
||||
vector-migrate:
|
||||
image: thothii-core:local
|
||||
profiles: [local-vector]
|
||||
build:
|
||||
context: .
|
||||
dockerfile: docker/core.Dockerfile
|
||||
labels: *smoke-labels
|
||||
entrypoint: [sh, -ec]
|
||||
command:
|
||||
- |
|
||||
password=$$(cat /run/secrets/vector_migrator_password)
|
||||
encoded=$$(python -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$$password")
|
||||
exec /opt/venv/bin/tht vector migrate \
|
||||
--database-url "postgresql+psycopg2://${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}:$$encoded@vector-db:5432/${THT_VECTOR_DATABASE:-thoth}" \
|
||||
--json
|
||||
secrets:
|
||||
- vector_migrator_password
|
||||
depends_on:
|
||||
vector-reconcile:
|
||||
condition: service_completed_successfully
|
||||
restart: "no"
|
||||
|
||||
volumes:
|
||||
thoth_data:
|
||||
labels: *smoke-labels
|
||||
vector_data:
|
||||
labels: *smoke-labels
|
||||
|
||||
networks:
|
||||
default:
|
||||
labels: *smoke-labels
|
||||
|
||||
secrets:
|
||||
vector_bootstrap_password:
|
||||
file: ${THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE:-deploy/secrets/vector_bootstrap_password}
|
||||
vector_migrator_password:
|
||||
file: ${THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE:-deploy/secrets/vector_migrator_password}
|
||||
vector_reader_password:
|
||||
file: ${THT_VECTOR_READER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_reader_password}
|
||||
vector_writer_password:
|
||||
file: ${THT_VECTOR_WRITER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_writer_password}
|
||||
|
||||
@@ -0,0 +1,92 @@
|
||||
services:
|
||||
core:
|
||||
profiles: [local-vector]
|
||||
environment:
|
||||
THT_VECTOR_DATABASE: "${THT_VECTOR_DATABASE:-thoth}"
|
||||
THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
|
||||
THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
|
||||
THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
|
||||
THT_VECTOR_READER_PASSWORD_FILE: /run/secrets/vector_reader_password
|
||||
THT_VECTOR_WRITER_PASSWORD_FILE: /run/secrets/vector_writer_password
|
||||
secrets: [vector_reader_password, vector_writer_password]
|
||||
depends_on:
|
||||
vector-migrate:
|
||||
condition: service_completed_successfully
|
||||
|
||||
frontend:
|
||||
profiles: [local-vector]
|
||||
|
||||
vector-db:
|
||||
image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
|
||||
profiles: [local-vector]
|
||||
labels: {io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"}
|
||||
environment:
|
||||
POSTGRES_DB: "${THT_VECTOR_DATABASE:-thoth}"
|
||||
POSTGRES_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
|
||||
POSTGRES_PASSWORD_FILE: /run/secrets/vector_bootstrap_password
|
||||
THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
|
||||
THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
|
||||
THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
|
||||
secrets: [vector_bootstrap_password, vector_migrator_password, vector_reader_password, vector_writer_password]
|
||||
volumes: [vector_data:/var/lib/postgresql/data]
|
||||
healthcheck:
|
||||
test: [CMD-SHELL, "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 20
|
||||
start_period: 10s
|
||||
restart: unless-stopped
|
||||
|
||||
vector-reconcile:
|
||||
image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
|
||||
profiles: [local-vector]
|
||||
labels: {io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"}
|
||||
environment:
|
||||
PGHOST: vector-db
|
||||
PGPORT: 5432
|
||||
PGDATABASE: "${THT_VECTOR_DATABASE:-thoth}"
|
||||
PGUSER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
|
||||
THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
|
||||
THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
|
||||
THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
|
||||
THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
|
||||
entrypoint: [/opt/thoth/reconcile-roles.sh]
|
||||
secrets: [vector_bootstrap_password, vector_migrator_password, vector_reader_password, vector_writer_password]
|
||||
volumes:
|
||||
- ./deploy/vector/reconcile-roles.sh:/opt/thoth/reconcile-roles.sh:ro
|
||||
- ./deploy/vector/secret-policy.sh:/opt/thoth/secret-policy.sh:ro
|
||||
depends_on:
|
||||
vector-db: {condition: service_healthy}
|
||||
restart: "no"
|
||||
|
||||
vector-migrate:
|
||||
image: thothii-core:local
|
||||
profiles: [local-vector]
|
||||
labels: {io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"}
|
||||
build:
|
||||
context: .
|
||||
dockerfile: docker/core.Dockerfile
|
||||
entrypoint: [sh, -ec]
|
||||
command:
|
||||
- |
|
||||
password=$$(cat /run/secrets/vector_migrator_password)
|
||||
encoded=$$(python -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$$password")
|
||||
exec /opt/venv/bin/tht vector migrate --database-url "postgresql+psycopg2://${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}:$$encoded@vector-db:5432/${THT_VECTOR_DATABASE:-thoth}" --json
|
||||
secrets: [vector_migrator_password]
|
||||
depends_on:
|
||||
vector-reconcile: {condition: service_completed_successfully}
|
||||
restart: "no"
|
||||
|
||||
volumes:
|
||||
vector_data:
|
||||
labels: {io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"}
|
||||
|
||||
secrets:
|
||||
vector_bootstrap_password:
|
||||
file: ${THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE:-deploy/secrets/vector_bootstrap_password}
|
||||
vector_migrator_password:
|
||||
file: ${THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE:-deploy/secrets/vector_migrator_password}
|
||||
vector_reader_password:
|
||||
file: ${THT_VECTOR_READER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_reader_password}
|
||||
vector_writer_password:
|
||||
file: ${THT_VECTOR_WRITER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_writer_password}
|
||||
@@ -36,7 +36,8 @@ export THT_VECTOR_BOOTSTRAP_USER=thoth_bootstrap_smoke
|
||||
export THOTH_SMOKE_OWNER="$smoke_owner"
|
||||
|
||||
compose() {
|
||||
docker compose --project-name "$smoke_project" --profile local-vector "$@"
|
||||
docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
|
||||
--project-name "$smoke_project" --profile local-vector "$@"
|
||||
}
|
||||
|
||||
resource_ids() {
|
||||
|
||||
@@ -23,7 +23,8 @@ THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE="$tmp/bootstrap" \
|
||||
THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE="$tmp/migrator" \
|
||||
THT_VECTOR_READER_PASSWORD_SECRET_FILE="$tmp/local_reader" \
|
||||
THT_VECTOR_WRITER_PASSWORD_SECRET_FILE="$tmp/local_writer" \
|
||||
docker compose --profile local-vector config >"$tmp/local-vector.yaml"
|
||||
docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
|
||||
--profile local-vector config >"$tmp/local-vector.yaml"
|
||||
grep -q 'THT_VECTOR_READER_PASSWORD_FILE: /run/secrets/vector_reader_password' "$tmp/local-vector.yaml"
|
||||
grep -q 'THT_VECTOR_WRITER_PASSWORD_FILE: /run/secrets/vector_writer_password' "$tmp/local-vector.yaml"
|
||||
if grep -q 'contract-local_' "$tmp/local-vector.yaml"; then
|
||||
@@ -48,6 +49,10 @@ grep -q 'AUTH_MODE: upstream' "$tmp/production.yaml"
|
||||
grep -q 'THOTH_PUBLIC_EXPOSURE: "true"' "$tmp/production.yaml"
|
||||
grep -q 'target: thoth_ca.pem' "$tmp/production.yaml"
|
||||
grep -q 'THT_DWH_API_KEY_FILE: /run/secrets/dwh_api_key' "$tmp/production.yaml"
|
||||
if grep -q 'THT_VECTOR_READER_PASSWORD_FILE\|THT_VECTOR_WRITER_PASSWORD_FILE\|target: vector_reader_password\|target: vector_writer_password' "$tmp/production.yaml"; then
|
||||
echo "production external config contains local direct vector secrets" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if awk '/^FROM / && $2 !~ /@sha256:/ { found=1 } END { exit !found }' \
|
||||
docker/core.Dockerfile docker/frontend.Dockerfile; then
|
||||
|
||||
Executable
+23
@@ -0,0 +1,23 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
project="thothii-external-lifecycle-$$"
|
||||
cleanup() { docker compose --project-name "$project" --profile external down --volumes >/dev/null 2>&1 || true; }
|
||||
trap cleanup EXIT HUP INT TERM
|
||||
|
||||
unset THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE
|
||||
unset THT_VECTOR_READER_PASSWORD_SECRET_FILE THT_VECTOR_WRITER_PASSWORD_SECRET_FILE
|
||||
rendered=$(docker compose --project-name "$project" --profile external config)
|
||||
if printf '%s' "$rendered" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|vector_.*password'; then
|
||||
echo "external config contains local vector secret references" >&2
|
||||
exit 1
|
||||
fi
|
||||
docker compose --project-name "$project" --profile external up --build --wait core
|
||||
core=$(docker compose --project-name "$project" --profile external ps -q core)
|
||||
inspect=$(docker inspect "$core")
|
||||
if printf '%s' "$inspect" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|/run/secrets/vector_.*password'; then
|
||||
echo "external core inspect contains local vector secret references" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "external core lifecycle without local vector secrets passed."
|
||||
@@ -29,7 +29,8 @@ trap 'rm -f "$replacement"' EXIT HUP INT TERM
|
||||
cp "$new_secret" "$replacement"
|
||||
chmod 0600 "$replacement"
|
||||
|
||||
docker compose --project-name "$project" --profile local-vector run --rm --no-deps \
|
||||
docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
|
||||
--project-name "$project" --profile local-vector run --rm --no-deps \
|
||||
--user 0:0 \
|
||||
--entrypoint /opt/venv/bin/python \
|
||||
--volume "$old_secret:/run/secrets/bootstrap-old:ro" \
|
||||
@@ -42,4 +43,4 @@ mv -f "$replacement" "$old_secret"
|
||||
trap - EXIT HUP INT TERM
|
||||
|
||||
echo "Deployment bootstrap secret atomically replaced only after verified database login."
|
||||
echo "Re-run: docker compose --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"
|
||||
echo "Re-run: docker compose -f compose.yaml -f deploy/compose.local-vector.yaml --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"
|
||||
|
||||
Reference in New Issue
Block a user