From c6769ee95e35feba12abda617124909bf02a408b Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Sat, 15 Aug 2026 06:13:12 -0400 Subject: [PATCH] =?UTF-8?q?chore(docker):=20raise=20MaxUnlockAttemptsPerIp?= =?UTF-8?q?PerHour=20to=20500=20on=20the=20rig=20=E2=80=94=20production=20?= =?UTF-8?q?default=20of=2010=20throttles=20repeated=20Playwright=20transpo?= =?UTF-8?q?rt=20runs=20from=20one=20host=20IP?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docker/central-node-a/appsettings.Central.json | 16 +++++++++++----- docker/central-node-b/appsettings.Central.json | 16 +++++++++++----- 2 files changed, 22 insertions(+), 10 deletions(-) diff --git a/docker/central-node-a/appsettings.Central.json b/docker/central-node-a/appsettings.Central.json index dba51f1f..dea71fc3 100644 --- a/docker/central-node-a/appsettings.Central.json +++ b/docker/central-node-a/appsettings.Central.json @@ -25,13 +25,15 @@ } }, "Database": { - "_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)." + "_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) \u2014 this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)." }, "Security": { "Ldap": { "Server": "host.docker.internal", "Port": 3893, - "FallbackServers": [ "host.docker.internal:3894" ], + "FallbackServers": [ + "host.docker.internal:3894" + ], "_comment_FallbackServers": "Redundant local GLAuth pair (scadaproj/infra/glauth-redundant): zb-ldap-primary :3893 + zb-ldap-backup :3894 on the Docker host. Replaces the shared 10.100.0.35 GLAuth, whose serviceaccount password was rotated (SEC-36) away from the rig's dev bind creds. Also live-exercises Auth 0.2.x FallbackServers sticky failover.", "Transport": "None", "AllowInsecure": true, @@ -50,7 +52,9 @@ "ForwardedHeaders": { "_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.", "Enabled": true, - "KnownNetworks": [ "172.16.0.0/12" ] + "KnownNetworks": [ + "172.16.0.0/12" + ] } }, "Communication": { @@ -89,10 +93,12 @@ "DefaultMaxSeriesPoints": 200 }, "Transport": { - "SourceEnvironment": "docker-cluster" + "SourceEnvironment": "docker-cluster", + "MaxUnlockAttemptsPerIpPerHour": 500, + "_comment_MaxUnlockAttemptsPerIpPerHour": "Test-rig override (row-44 throttle landed 2026-08-15): the production default of 10/hour/IP throttles the Playwright transport suite after ~2 back-to-back runs (all tests unlock from one host IP). 500 keeps the throttle path live while making repeated suite runs practical." }, "Logging": { "MinimumLevel": "Information" } } -} +} \ No newline at end of file diff --git a/docker/central-node-b/appsettings.Central.json b/docker/central-node-b/appsettings.Central.json index 93f31879..322be39f 100644 --- a/docker/central-node-b/appsettings.Central.json +++ b/docker/central-node-b/appsettings.Central.json @@ -25,13 +25,15 @@ } }, "Database": { - "_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)." + "_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) \u2014 this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)." }, "Security": { "Ldap": { "Server": "host.docker.internal", "Port": 3893, - "FallbackServers": [ "host.docker.internal:3894" ], + "FallbackServers": [ + "host.docker.internal:3894" + ], "_comment_FallbackServers": "Redundant local GLAuth pair (scadaproj/infra/glauth-redundant): zb-ldap-primary :3893 + zb-ldap-backup :3894 on the Docker host. Replaces the shared 10.100.0.35 GLAuth, whose serviceaccount password was rotated (SEC-36) away from the rig's dev bind creds. Also live-exercises Auth 0.2.x FallbackServers sticky failover.", "Transport": "None", "AllowInsecure": true, @@ -50,7 +52,9 @@ "ForwardedHeaders": { "_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.", "Enabled": true, - "KnownNetworks": [ "172.16.0.0/12" ] + "KnownNetworks": [ + "172.16.0.0/12" + ] } }, "Communication": { @@ -89,10 +93,12 @@ "DefaultMaxSeriesPoints": 200 }, "Transport": { - "SourceEnvironment": "docker-cluster" + "SourceEnvironment": "docker-cluster", + "MaxUnlockAttemptsPerIpPerHour": 500, + "_comment_MaxUnlockAttemptsPerIpPerHour": "Test-rig override (row-44 throttle landed 2026-08-15): the production default of 10/hour/IP throttles the Playwright transport suite after ~2 back-to-back runs (all tests unlock from one host IP). 500 keeps the throttle path live while making repeated suite runs practical." }, "Logging": { "MinimumLevel": "Information" } } -} +} \ No newline at end of file