Joseph Doherty
b71fbae36e
The rig pointed at the shared 10.100.0.35 GLAuth whose serviceaccount password
was rotated (SEC-36), so central login had been failing ('Authentication service
is misconfigured') and a TEMP DisableLogin workaround was pending. Central nodes
now point at the local redundant pair (scadaproj/infra/glauth-redundant,
host.docker.internal:3893 + FallbackServers :3894), where the dev bind password
is correct — live-gated on the redeployed rig: login OK, primary-kill failover,
sticky preference (bind-count proven), walk-back on backup-kill.
AuthFlowTests factory bound as cn=admin for search-then-bind, but the current
directory grants the search capability only to serviceaccount (admin searches
return 50 Insufficient access) — stale since the GLAuth config evolved; the test
had been skipping on the closed port and failed once anything answered :3893.
Now binds as serviceaccount; AuthFlowTests 5/5 against the pair.
99 lines
4.3 KiB
JSON
99 lines
4.3 KiB
JSON
{
|
|
"ScadaBridge": {
|
|
"Node": {
|
|
"Role": "Central",
|
|
"NodeName": "central-b",
|
|
"NodeHostname": "scadabridge-central-b",
|
|
"RemotingPort": 8081
|
|
},
|
|
"Cluster": {
|
|
"SeedNodes": [
|
|
"akka.tcp://scadabridge@scadabridge-central-b:8081",
|
|
"akka.tcp://scadabridge@scadabridge-central-a:8081"
|
|
],
|
|
"SplitBrainResolverStrategy": "auto-down",
|
|
"StableAfter": "00:00:15",
|
|
"HeartbeatInterval": "00:00:02",
|
|
"FailureDetectionThreshold": "00:00:10",
|
|
"MinNrOfMembers": 1,
|
|
"_bootstrapGuard": "Gitea #33 guard ENABLED on the docker rig (2026-08-02): deploy.sh recreates all containers simultaneously, which twice split site pairs into two 1-node clusters on 2026-08-01. Lower host:port founds self-first; the higher node TCP-probes then joins peer-first.",
|
|
"BootstrapGuard": {
|
|
"Enabled": true,
|
|
"PartnerProbeSeconds": 25,
|
|
"PartnerProbeIntervalMs": 500,
|
|
"ProbeConnectTimeoutMs": 1000
|
|
}
|
|
},
|
|
"Database": {
|
|
"_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
|
|
},
|
|
"Security": {
|
|
"Ldap": {
|
|
"Server": "host.docker.internal",
|
|
"Port": 3893,
|
|
"FallbackServers": [ "host.docker.internal:3894" ],
|
|
"_comment_FallbackServers": "Redundant local GLAuth pair (scadaproj/infra/glauth-redundant): zb-ldap-primary :3893 + zb-ldap-backup :3894 on the Docker host. Replaces the shared 10.100.0.35 GLAuth, whose serviceaccount password was rotated (SEC-36) away from the rig's dev bind creds. Also live-exercises Auth 0.2.x FallbackServers sticky failover.",
|
|
"Transport": "None",
|
|
"AllowInsecure": true,
|
|
"SearchBase": "dc=zb,dc=local",
|
|
"ServiceAccountDn": "cn=serviceaccount,dc=zb,dc=local",
|
|
"_comment_ServiceAccountPassword": "Supplied as ScadaBridge__Security__Ldap__ServiceAccountPassword env override in docker-compose.yml (dev-only-insecure)."
|
|
},
|
|
"Auth": {
|
|
"DisableLogin": false,
|
|
"User": "multi-role"
|
|
},
|
|
"_comment_JwtSigningKey": "Supplied as ScadaBridge__Security__JwtSigningKey env override in docker-compose.yml (dev-only-insecure).",
|
|
"JwtExpiryMinutes": 15,
|
|
"IdleTimeoutMinutes": 30,
|
|
"RequireHttpsCookie": false,
|
|
"ForwardedHeaders": {
|
|
"_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.",
|
|
"Enabled": true,
|
|
"KnownNetworks": [ "172.16.0.0/12" ]
|
|
}
|
|
},
|
|
"Communication": {
|
|
"DeploymentTimeout": "00:02:00",
|
|
"LifecycleTimeout": "00:00:30",
|
|
"QueryTimeout": "00:00:30",
|
|
"TransportHeartbeatInterval": "00:00:05",
|
|
"TransportFailureThreshold": "00:00:15",
|
|
"CentralFetchBaseUrl": "http://scadabridge-traefik"
|
|
},
|
|
"ManagementService": {
|
|
"CommandTimeout": "00:00:30",
|
|
"LongRunningCommandTimeout": "00:05:00"
|
|
},
|
|
"HealthMonitoring": {
|
|
"ReportInterval": "00:00:30",
|
|
"OfflineTimeout": "00:01:00"
|
|
},
|
|
"InboundApi": {
|
|
"DefaultMethodTimeout": "00:00:30"
|
|
},
|
|
"Notification": {
|
|
"SmtpServer": "scadabridge-smtp",
|
|
"SmtpPort": 1025,
|
|
"AuthMode": "None",
|
|
"FromAddress": "scada-notifications@company.com"
|
|
},
|
|
"NotificationOutbox": {
|
|
"DispatchInterval": "00:00:05",
|
|
"DispatchBatchSize": 1000
|
|
},
|
|
"KpiHistory": {
|
|
"SampleInterval": "00:01:00",
|
|
"RetentionDays": 90,
|
|
"PurgeInterval": "1.00:00:00",
|
|
"DefaultMaxSeriesPoints": 200
|
|
},
|
|
"Transport": {
|
|
"SourceEnvironment": "docker-cluster"
|
|
},
|
|
"Logging": {
|
|
"MinimumLevel": "Information"
|
|
}
|
|
}
|
|
}
|