dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

chore(docker): raise MaxUnlockAttemptsPerIpPerHour to 500 on the rig — production default of 10 throttles repeated Playwright transport runs from one host IP

Browse Source
This commit is contained in:
Joseph Doherty
2026-08-15 06:13:12 -04:00
parent e59fa5ba4c
commit c6769ee95e
2 changed files with 22 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/central-node-a/appsettings.Central.json
+11 -5
View File
@@ -25,13 +25,15 @@
}
},
"Database": {
"_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
"_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) \u2014 this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
},
"Security": {
"Ldap": {
"Server": "host.docker.internal",
"Port": 3893,
"FallbackServers": [ "host.docker.internal:3894" ],
"FallbackServers": [
"host.docker.internal:3894"
],
"_comment_FallbackServers": "Redundant local GLAuth pair (scadaproj/infra/glauth-redundant): zb-ldap-primary :3893 + zb-ldap-backup :3894 on the Docker host. Replaces the shared 10.100.0.35 GLAuth, whose serviceaccount password was rotated (SEC-36) away from the rig's dev bind creds. Also live-exercises Auth 0.2.x FallbackServers sticky failover.",
"Transport": "None",
"AllowInsecure": true,
@@ -50,7 +52,9 @@
"ForwardedHeaders": {
"_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.",
"Enabled": true,
"KnownNetworks": [ "172.16.0.0/12" ]
"KnownNetworks": [
"172.16.0.0/12"
]
}
},
"Communication": {
@@ -89,10 +93,12 @@
"DefaultMaxSeriesPoints": 200
},
"Transport": {
"SourceEnvironment": "docker-cluster"
"SourceEnvironment": "docker-cluster",
"MaxUnlockAttemptsPerIpPerHour": 500,
"_comment_MaxUnlockAttemptsPerIpPerHour": "Test-rig override (row-44 throttle landed 2026-08-15): the production default of 10/hour/IP throttles the Playwright transport suite after ~2 back-to-back runs (all tests unlock from one host IP). 500 keeps the throttle path live while making repeated suite runs practical."
},
"Logging": {
"MinimumLevel": "Information"
}
}
}
}
docker/central-node-b/appsettings.Central.json
+11 -5
View File
@@ -25,13 +25,15 @@
}
},
"Database": {
"_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
"_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) \u2014 this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
},
"Security": {
"Ldap": {
"Server": "host.docker.internal",
"Port": 3893,
"FallbackServers": [ "host.docker.internal:3894" ],
"FallbackServers": [
"host.docker.internal:3894"
],
"_comment_FallbackServers": "Redundant local GLAuth pair (scadaproj/infra/glauth-redundant): zb-ldap-primary :3893 + zb-ldap-backup :3894 on the Docker host. Replaces the shared 10.100.0.35 GLAuth, whose serviceaccount password was rotated (SEC-36) away from the rig's dev bind creds. Also live-exercises Auth 0.2.x FallbackServers sticky failover.",
"Transport": "None",
"AllowInsecure": true,
@@ -50,7 +52,9 @@
"ForwardedHeaders": {
"_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.",
"Enabled": true,
"KnownNetworks": [ "172.16.0.0/12" ]
"KnownNetworks": [
"172.16.0.0/12"
]
}
},
"Communication": {
@@ -89,10 +93,12 @@
"DefaultMaxSeriesPoints": 200
},
"Transport": {
"SourceEnvironment": "docker-cluster"
"SourceEnvironment": "docker-cluster",
"MaxUnlockAttemptsPerIpPerHour": 500,
"_comment_MaxUnlockAttemptsPerIpPerHour": "Test-rig override (row-44 throttle landed 2026-08-15): the production default of 10/hour/IP throttles the Playwright transport suite after ~2 back-to-back runs (all tests unlock from one host IP). 500 keeps the throttle path live while making repeated suite runs practical."
},
"Logging": {
"MinimumLevel": "Information"
}
}
}
}