From 0be20ab4fb43e6aadf7fd37ca241f98a8274b252 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Thu, 23 Jul 2026 13:22:18 -0400 Subject: [PATCH] chore(mesh-phase4): rig site nodes run with no ConfigDb string (FetchAndCache mandatory) The four driver-only site nodes lose their ConfigDb connection string and hardcode ConfigSource:Mode=FetchAndCache (Direct is now rejected by the validator for a driver-only node). Central-1/2 keep ConfigDb + Direct + ConfigServe. Proves the Phase-4 cut on the rig for the live gate. Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW --- docker-dev/docker-compose.yml | 38 ++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/docker-dev/docker-compose.yml b/docker-dev/docker-compose.yml index 18ac240d..9db7aac3 100644 --- a/docker-dev/docker-compose.yml +++ b/docker-dev/docker-compose.yml @@ -359,16 +359,18 @@ services: migrator: { condition: service_completed_successfully } environment: OTOPCUA_ROLES: "driver" - ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;" + # Per-cluster mesh Phase 4: driver-only site nodes hold NO ConfigDb connection string. Their + # config comes from central via ConfigSource:Mode=FetchAndCache (gRPC fetch → LocalDb cache), their + # scripted-alarm condition state lives in LocalDb, and central persists their deploy acks. Direct + # mode is invalid here — ConfigSourceOptionsValidator fails start for a driver-only node set Direct. Cluster__Hostname: "0.0.0.0" Cluster__Port: "4053" Cluster__PublicHostname: "site-a-1" - # Per-cluster mesh Phase 3 dark switch. Default Direct (reads central SQL). Flip the site nodes to - # FetchAndCache with `OTOPCUA_CONFIG_MODE=FetchAndCache docker compose up`: they then fetch the - # deployed artifact from central over gRPC (endpoints below) and read ONLY the LocalDb cache — no - # central SQL config read. Central stays Direct, so this env var moves ONLY the four site nodes. + # FetchAndCache is MANDATORY for driver-only nodes (validator-enforced): they fetch the deployed + # artifact from central over gRPC (endpoints below) and read ONLY the LocalDb cache — no central + # SQL config read (they have no connection string). Central stays Direct + keeps ConfigServe. # ConfigSource:ApiKey must equal central's ConfigServe:ApiKey (the interceptor is fail-closed). - ConfigSource__Mode: "${OTOPCUA_CONFIG_MODE:-Direct}" + ConfigSource__Mode: "FetchAndCache" ConfigSource__CentralFetchEndpoints__0: "http://central-1:4055" ConfigSource__CentralFetchEndpoints__1: "http://central-2:4055" ConfigSource__ApiKey: "configserve-docker-dev-key" @@ -450,13 +452,13 @@ services: migrator: { condition: service_completed_successfully } environment: OTOPCUA_ROLES: "driver" - ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;" + # Per-cluster mesh Phase 4: no ConfigDb string on driver-only site nodes (see site-a-1). Cluster__Hostname: "0.0.0.0" Cluster__Port: "4053" Cluster__PublicHostname: "site-a-2" - # Per-cluster mesh Phase 3 dark switch (see site-a-1). Default Direct; OTOPCUA_CONFIG_MODE=FetchAndCache - # flips it to fetch the artifact from central over gRPC and read only the LocalDb cache. - ConfigSource__Mode: "${OTOPCUA_CONFIG_MODE:-Direct}" + # Per-cluster mesh Phase 4: FetchAndCache mandatory for driver-only nodes (see site-a-1) — no + # ConfigDb string; fetch the artifact from central over gRPC and read only the LocalDb cache. + ConfigSource__Mode: "FetchAndCache" ConfigSource__CentralFetchEndpoints__0: "http://central-1:4055" ConfigSource__CentralFetchEndpoints__1: "http://central-2:4055" ConfigSource__ApiKey: "configserve-docker-dev-key" @@ -527,13 +529,13 @@ services: migrator: { condition: service_completed_successfully } environment: OTOPCUA_ROLES: "driver" - ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;" + # Per-cluster mesh Phase 4: no ConfigDb string on driver-only site nodes (see site-a-1). Cluster__Hostname: "0.0.0.0" Cluster__Port: "4053" Cluster__PublicHostname: "site-b-1" - # Per-cluster mesh Phase 3 dark switch (see site-a-1). Default Direct; OTOPCUA_CONFIG_MODE=FetchAndCache - # flips it to fetch the artifact from central over gRPC and read only the LocalDb cache. - ConfigSource__Mode: "${OTOPCUA_CONFIG_MODE:-Direct}" + # Per-cluster mesh Phase 4: FetchAndCache mandatory for driver-only nodes (see site-a-1) — no + # ConfigDb string; fetch the artifact from central over gRPC and read only the LocalDb cache. + ConfigSource__Mode: "FetchAndCache" ConfigSource__CentralFetchEndpoints__0: "http://central-1:4055" ConfigSource__CentralFetchEndpoints__1: "http://central-2:4055" ConfigSource__ApiKey: "configserve-docker-dev-key" @@ -587,13 +589,13 @@ services: migrator: { condition: service_completed_successfully } environment: OTOPCUA_ROLES: "driver" - ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;" + # Per-cluster mesh Phase 4: no ConfigDb string on driver-only site nodes (see site-a-1). Cluster__Hostname: "0.0.0.0" Cluster__Port: "4053" Cluster__PublicHostname: "site-b-2" - # Per-cluster mesh Phase 3 dark switch (see site-a-1). Default Direct; OTOPCUA_CONFIG_MODE=FetchAndCache - # flips it to fetch the artifact from central over gRPC and read only the LocalDb cache. - ConfigSource__Mode: "${OTOPCUA_CONFIG_MODE:-Direct}" + # Per-cluster mesh Phase 4: FetchAndCache mandatory for driver-only nodes (see site-a-1) — no + # ConfigDb string; fetch the artifact from central over gRPC and read only the LocalDb cache. + ConfigSource__Mode: "FetchAndCache" ConfigSource__CentralFetchEndpoints__0: "http://central-1:4055" ConfigSource__CentralFetchEndpoints__1: "http://central-2:4055" ConfigSource__ApiKey: "configserve-docker-dev-key"