dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(docker)+docs(docker-env2)+infra: close P8-7 + P8-10 — LDAP doc drift + env2 gRPC port/teardown parity

Browse Source 
P8-7: docker/README.md and docker-env2/README.md still listed the retired
scadabridge-ldap container. Verified against the running config
(central-node-*/appsettings.Central.json): both rigs actually bind to the
local redundant GLAuth pair (zb-ldap-primary :3893 + zb-ldap-backup :3894 on
host.docker.internal, source of truth scadaproj/infra/glauth-redundant), not
the shared 10.100.0.35 GLAuth the infra/docker-compose.yml retirement comment
claimed — that binding is itself stale, its serviceaccount password having
been rotated away by SEC-36. Corrected all three docs to name the actual
config each rig uses.

P8-10: docker-env2 mapped no host port for the central gRPC control plane
(docker/ maps 9013/9014->8083); added 9113/9114->8083 on both env2 centrals,
matching the free 91XX slots, plus the README port table. teardown.sh's
"preserved in node directories" data note predates the named-volume
migration; rewrote it honestly and added an explicit `docker volume rm`
recipe scoped to the env2 volume prefix, clearly labeled destructive,
mirroring docker/teardown.sh's existing pattern.

Gate: bash docker-env2/deploy.sh from this worktree — both centrals + both
site-x nodes recreated and came up with the new 9113/9114 ports open. The
simultaneous force-recreate split both pairs into independent 1-node
clusters (expected: BootstrapGuard is default-OFF on docker-env2, per
CLAUDE.md); a single restart of the b-side of each pair joined it to its
already-formed peer and both pairs converged (central: memberCount=2,
leader=central-a; site-x: node-b Welcome + singleton Younger). docker/ (the
primary rig) was not touched.
This commit is contained in:
Joseph Doherty
2026-08-19 16:17:49 -04:00
parent 428b8db024
commit 3bf1537ea0
5 changed files with 49 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/README.md
+11 -2
View File
@@ -71,11 +71,18 @@ Port block pattern: `90X1`/`90X2` (Akka), `90X3`/`90X4` (gRPC) where X = 0 (cent
| Service | Container Name | Host Port | Purpose |
|---------|---------------|-----------|---------|
| MS SQL 2022 | `scadabridge-mssql` | 1433 | Configuration and machine data databases |
| LDAP (GLAuth) | `scadabridge-ldap` | 3893 | Authentication with test users |
| SMTP (Mailpit) | `scadabridge-smtp` | 1025 / 8025 | Email capture (SMTP / web UI) |
| OPC UA | `scadabridge-opcua` | 50000 / 8080 | Simulated OPC UA server (protocol / web UI) |
| REST API | `scadabridge-restapi` | 5200 | External REST API for integration testing |
`infra/docker-compose.yml` no longer runs an LDAP container (its `ldap` service is commented
out, kept only for rollback). The central nodes bind to the local redundant GLAuth pair
instead — `zb-ldap-primary` on `host.docker.internal:3893` with `zb-ldap-backup` on
`host.docker.internal:3894` as `FallbackServers` (source of truth:
`scadaproj/infra/glauth-redundant`; see each central node's `appsettings.Central.json`). This
replaces the previously-used shared dev GLAuth at `10.100.0.35:3893` — its serviceaccount
password was rotated away (SEC-36) and is no longer valid for this rig.
All containers communicate over the shared `scadabridge-net` Docker bridge network using container names as hostnames.
## Directory Structure
@@ -152,7 +159,9 @@ If you add a site to the rig, add its key in both places or its streams will fai
Start infrastructure services first, then build and deploy the application:
```bash
# 1. Start test infrastructure (MS SQL, LDAP, SMTP, OPC UA)
# 1. Start test infrastructure (MS SQL, SMTP, OPC UA — LDAP is the local
# redundant GLAuth pair on the Docker host, not started here; see
# "Infrastructure Services" above)
cd infra && docker compose up -d && cd ..
# 2. Build and deploy all 8 ScadaBridge nodes