Joseph Doherty
b8f91bab2d
deploy.sh's simultaneous recreate split site pairs twice on 2026-08-01 with the guard off (mutual InitJoinNack, each node forming its own 1-node cluster; a per-pair coin flip compose depends_on does not prevent). Guard enabled on all 8 rig nodes: two consecutive simultaneous-start trials (full redeploy + full-topology compose restart) converged all four pairs deterministically — founder self-first on every lower address, peer-first join on every higher, zero splits. This closes the deferred issue-acceptance live gate; the switch stays default-off everywhere else.
97 lines
3.9 KiB
JSON
97 lines
3.9 KiB
JSON
{
|
|
"ScadaBridge": {
|
|
"Node": {
|
|
"Role": "Central",
|
|
"NodeName": "central-a",
|
|
"NodeHostname": "scadabridge-central-a",
|
|
"RemotingPort": 8081
|
|
},
|
|
"Cluster": {
|
|
"SeedNodes": [
|
|
"akka.tcp://scadabridge@scadabridge-central-a:8081",
|
|
"akka.tcp://scadabridge@scadabridge-central-b:8081"
|
|
],
|
|
"SplitBrainResolverStrategy": "auto-down",
|
|
"StableAfter": "00:00:15",
|
|
"HeartbeatInterval": "00:00:02",
|
|
"FailureDetectionThreshold": "00:00:10",
|
|
"MinNrOfMembers": 1,
|
|
"_bootstrapGuard": "Gitea #33 guard ENABLED on the docker rig (2026-08-02): deploy.sh recreates all containers simultaneously, which twice split site pairs into two 1-node clusters on 2026-08-01. Lower host:port founds self-first; the higher node TCP-probes then joins peer-first.",
|
|
"BootstrapGuard": {
|
|
"Enabled": true,
|
|
"PartnerProbeSeconds": 25,
|
|
"PartnerProbeIntervalMs": 500,
|
|
"ProbeConnectTimeoutMs": 1000
|
|
}
|
|
},
|
|
"Database": {
|
|
"_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
|
|
},
|
|
"Security": {
|
|
"Ldap": {
|
|
"Server": "10.100.0.35",
|
|
"Port": 3893,
|
|
"Transport": "None",
|
|
"AllowInsecure": true,
|
|
"SearchBase": "dc=zb,dc=local",
|
|
"ServiceAccountDn": "cn=serviceaccount,dc=zb,dc=local",
|
|
"_comment_ServiceAccountPassword": "Supplied as ScadaBridge__Security__Ldap__ServiceAccountPassword env override in docker-compose.yml (dev-only-insecure)."
|
|
},
|
|
"Auth": {
|
|
"DisableLogin": false,
|
|
"User": "multi-role"
|
|
},
|
|
"_comment_JwtSigningKey": "Supplied as ScadaBridge__Security__JwtSigningKey env override in docker-compose.yml (dev-only-insecure).",
|
|
"JwtExpiryMinutes": 15,
|
|
"IdleTimeoutMinutes": 30,
|
|
"RequireHttpsCookie": false,
|
|
"ForwardedHeaders": {
|
|
"_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.",
|
|
"Enabled": true,
|
|
"KnownNetworks": [ "172.16.0.0/12" ]
|
|
}
|
|
},
|
|
"Communication": {
|
|
"DeploymentTimeout": "00:02:00",
|
|
"LifecycleTimeout": "00:00:30",
|
|
"QueryTimeout": "00:00:30",
|
|
"TransportHeartbeatInterval": "00:00:05",
|
|
"TransportFailureThreshold": "00:00:15",
|
|
"CentralFetchBaseUrl": "http://scadabridge-traefik"
|
|
},
|
|
"ManagementService": {
|
|
"CommandTimeout": "00:00:30",
|
|
"LongRunningCommandTimeout": "00:05:00"
|
|
},
|
|
"HealthMonitoring": {
|
|
"ReportInterval": "00:00:30",
|
|
"OfflineTimeout": "00:01:00"
|
|
},
|
|
"InboundApi": {
|
|
"DefaultMethodTimeout": "00:00:30"
|
|
},
|
|
"Notification": {
|
|
"SmtpServer": "scadabridge-smtp",
|
|
"SmtpPort": 1025,
|
|
"AuthMode": "None",
|
|
"FromAddress": "scada-notifications@company.com"
|
|
},
|
|
"NotificationOutbox": {
|
|
"DispatchInterval": "00:00:05",
|
|
"DispatchBatchSize": 1000
|
|
},
|
|
"KpiHistory": {
|
|
"SampleInterval": "00:01:00",
|
|
"RetentionDays": 90,
|
|
"PurgeInterval": "1.00:00:00",
|
|
"DefaultMaxSeriesPoints": 200
|
|
},
|
|
"Transport": {
|
|
"SourceEnvironment": "docker-cluster"
|
|
},
|
|
"Logging": {
|
|
"MinimumLevel": "Information"
|
|
}
|
|
}
|
|
}
|