From c3c1f6e8709c8368563a324ff65fa2e6abcc0c10 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Fri, 13 Nov 2026 00:00:03 -0500 Subject: [PATCH] chore(docker): windev MxGateway API key no longer in the seed scripts docker/seed-sites.sh and docker-env2/seed-sites.sh hard-coded the windev gateway API key. They now read MXGW_APIKEY from the environment, or from a private file (default ~/.config/scadabridge/windev-mxgw-apikey, override MXGW_APIKEY_FILE). With no key the MxGateway connection step is skipped and the rest of the seed runs. READMEs note where to put it. The key remains in git history (2 commits), so it should be rotated on the windev gateway. Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi --- docker-env2/README.md | 4 ++++ docker-env2/seed-sites.sh | 14 ++++++++++++-- docker/README.md | 4 ++++ docker/seed-sites.sh | 14 +++++++++++++- 4 files changed, 33 insertions(+), 3 deletions(-) diff --git a/docker-env2/README.md b/docker-env2/README.md index ba2a4d4d..0caf27b0 100644 --- a/docker-env2/README.md +++ b/docker-env2/README.md @@ -83,6 +83,10 @@ bash docker-env2/seed-sites.sh bash docker-env2/seed-data-path.sh ``` +> The MxGateway data connections need the windev gateway API key, which is not in the repo. Put it in +> `~/.config/scadabridge/windev-mxgw-apikey` (mode 600), point `MXGW_APIKEY_FILE` at another file, or export +> `MXGW_APIKEY`. Without a key the script skips the MxGateway connection step and seeds everything else. + Site-x's LocalDb is **replicated** (node-a dials node-b on 8083, same dev key on both), like the rig's site-a. Without it a site failover brings up an active node with no deployed instances, connections or S&F buffer. diff --git a/docker-env2/seed-sites.sh b/docker-env2/seed-sites.sh index 4c408fbb..628418b2 100755 --- a/docker-env2/seed-sites.sh +++ b/docker-env2/seed-sites.sh @@ -46,12 +46,22 @@ echo "Creating MxGateway data connection (shared gateway) on site-x..." # created on the env2 site. Config is the typed MxGatewayEndpointConfig JSON # (camelCase keys), matching MxGatewayEndpointConfigSerializer. MXGW_ENDPOINT="http://10.100.0.48:5120" -MXGW_APIKEY="mxgw_scadabridgeshared_O193yRm28zftUAcL-HPkTjAuE-vPz86MUtNLFWpcbOY" +# The windev gateway API key is NOT kept in the repo. Supply it via the +# MXGW_APIKEY env var, or a private file (default +# ~/.config/scadabridge/windev-mxgw-apikey, override with MXGW_APIKEY_FILE). +# Without a key the MxGateway data connection step is skipped. +MXGW_APIKEY_FILE="${MXGW_APIKEY_FILE:-$HOME/.config/scadabridge/windev-mxgw-apikey}" +if [ -z "${MXGW_APIKEY:-}" ] && [ -r "$MXGW_APIKEY_FILE" ]; then + MXGW_APIKEY=$(tr -d '\r\n' < "$MXGW_APIKEY_FILE") +fi +MXGW_APIKEY="${MXGW_APIKEY:-}" MXGW_CONFIG="{\"endpoint\":\"${MXGW_ENDPOINT}\",\"apiKey\":\"${MXGW_APIKEY}\",\"clientName\":\"\",\"writeUserId\":0,\"useTls\":false,\"caFile\":\"\",\"serverName\":\"\",\"readTimeoutMs\":5000}" SITE_X_ID=$($CLI $URL $AUTH --format json site list \ | python3 -c "import sys,json; print(next((s['id'] for s in json.load(sys.stdin) if s.get('siteIdentifier')=='site-x'), ''))" 2>/dev/null) -if [ -n "$SITE_X_ID" ]; then +if [ -z "$MXGW_APIKEY" ]; then + echo " (no MXGW_APIKEY / $MXGW_APIKEY_FILE — skipping MxGateway connection)" +elif [ -n "$SITE_X_ID" ]; then CONN_NAME="ScadaBridge Site X" echo " site-x (id=$SITE_X_ID): creating '$CONN_NAME'..." $CLI $URL $AUTH data-connection create \ diff --git a/docker/README.md b/docker/README.md index 04c6e9ac..8dfa7ebc 100644 --- a/docker/README.md +++ b/docker/README.md @@ -182,6 +182,10 @@ docker/seed-sites.sh docker/seed-live-probe.sh ``` +> The MxGateway data connections need the windev gateway API key, which is not in the repo. Put it in +> `~/.config/scadabridge/windev-mxgw-apikey` (mode 600), point `MXGW_APIKEY_FILE` at another file, or export +> `MXGW_APIKEY`. Without a key the script skips the MxGateway connection step and seeds everything else. + ### Live-data probe instance `seed-live-probe.sh` creates the minimum working set the rig needs for any live probe diff --git a/docker/seed-sites.sh b/docker/seed-sites.sh index 2d2bc8eb..457ed92e 100755 --- a/docker/seed-sites.sh +++ b/docker/seed-sites.sh @@ -73,9 +73,20 @@ echo "Creating MxGateway data connections (shared gateway) on each site..." # Config is the typed MxGatewayEndpointConfig JSON (camelCase keys), matching # MxGatewayEndpointConfigSerializer. MXGW_ENDPOINT="http://10.100.0.48:5120" -MXGW_APIKEY="mxgw_scadabridgeshared_O193yRm28zftUAcL-HPkTjAuE-vPz86MUtNLFWpcbOY" +# The windev gateway API key is NOT kept in the repo. Supply it via the +# MXGW_APIKEY env var, or a private file (default +# ~/.config/scadabridge/windev-mxgw-apikey, override with MXGW_APIKEY_FILE). +# Without a key the MxGateway data connection step is skipped. +MXGW_APIKEY_FILE="${MXGW_APIKEY_FILE:-$HOME/.config/scadabridge/windev-mxgw-apikey}" +if [ -z "${MXGW_APIKEY:-}" ] && [ -r "$MXGW_APIKEY_FILE" ]; then + MXGW_APIKEY=$(tr -d '\r\n' < "$MXGW_APIKEY_FILE") +fi +MXGW_APIKEY="${MXGW_APIKEY:-}" MXGW_CONFIG="{\"endpoint\":\"${MXGW_ENDPOINT}\",\"apiKey\":\"${MXGW_APIKEY}\",\"clientName\":\"\",\"writeUserId\":0,\"useTls\":false,\"caFile\":\"\",\"serverName\":\"\",\"readTimeoutMs\":5000}" +if [ -z "$MXGW_APIKEY" ]; then + echo " (no MXGW_APIKEY / $MXGW_APIKEY_FILE — skipping MxGateway connections)" +else for ident in site-a site-b site-c; do SITE_ID=$($CLI $URL $AUTH --format json site list \ | python3 -c "import sys,json; print(next((s['id'] for s in json.load(sys.stdin) if s.get('siteIdentifier')=='$ident'), ''))" 2>/dev/null) @@ -94,6 +105,7 @@ for ident in site-a site-b site-c; do --primary-config "$MXGW_CONFIG" \ || echo " ('$CONN_NAME' may already exist on $ident)" done +fi echo "" echo "Seeding LDAP group mappings (Designer + Deployer)..."