dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

chore(docker): both rigs' centrals on the shared SQL Server inbound key store; delete sync-inbound-api-keys.sh (superseded); verify-delmia-notifier.sh preflight is now the proof that both nodes see a key minted on one — drill green with no file copy, takeover 28 s

Browse Source 
Claude-Session: https://claude.ai/code/session_013L3XdmVii9i5sY4FChU8pB
This commit is contained in:
Joseph Doherty
2026-09-02 23:31:21 -04:00
parent d6fd8c400c
commit a83cc8613d
5 changed files with 36 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-env2/docker-compose.yml
+12
View File
@@ -31,6 +31,12 @@ services:
# pepper per the "different per environment" guidance; real deployments inject a
# true secret out-of-band, never from source control. Both Central nodes share it.
ScadaBridge__InboundApi__ApiKeyPepper: "dev-only-insecure-pepper-env2-cluster-0001"
# Shared inbound API key store (design 2026-09-02, register row 108): both centrals read and
# write ONE zbauth schema in the configuration database, so a key minted on either node
# survives a central failover and a revoke is cluster-wide. The SqlServer connection string
# is deliberately NOT set: it defaults to ScadaBridge__Database__ConfigurationDb below.
# Each node's legacy per-node SQLite file is imported once at boot and renamed *.imported.
ScadaBridge__InboundApi__ApiKeyStore__Provider: "SqlServer"
# DEV-ONLY local-cluster secrets — NOT real secrets. Relocated out of the mounted
# appsettings.Central.json (mirrors docker/docker-compose.yml's G-4 T5 secrets
# cleanup) so that app-config file carries no plaintext credentials. Env overrides
@@ -88,6 +94,12 @@ services:
# pepper per the "different per environment" guidance; real deployments inject a
# true secret out-of-band, never from source control. Both Central nodes share it.
ScadaBridge__InboundApi__ApiKeyPepper: "dev-only-insecure-pepper-env2-cluster-0001"
# Shared inbound API key store (design 2026-09-02, register row 108): both centrals read and
# write ONE zbauth schema in the configuration database, so a key minted on either node
# survives a central failover and a revoke is cluster-wide. The SqlServer connection string
# is deliberately NOT set: it defaults to ScadaBridge__Database__ConfigurationDb below.
# Each node's legacy per-node SQLite file is imported once at boot and renamed *.imported.
ScadaBridge__InboundApi__ApiKeyStore__Provider: "SqlServer"
# DEV-ONLY local-cluster secrets — NOT real secrets. Relocated out of the mounted
# appsettings.Central.json (mirrors docker/docker-compose.yml's G-4 T5 secrets
# cleanup) so that app-config file carries no plaintext credentials. Env overrides