From 7233e2ba08d0265f6eefd89678671f08caec1b4e Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Wed, 8 Jul 2026 23:43:02 -0400
Subject: [PATCH] fix(docker-dev): replace retired Wonderware ServerHistorian
 keys with the gateway shape (disabled by default)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The historian-gateway cutover made ServerHistorianOptions read Endpoint/ApiKey/UseTls,
but docker-dev compose still set Enabled=true with the retired Wonderware Host/Port/
SharedSecret keys → HistorianGatewayClientAdapter.Create built a Uri from an empty
Endpoint → unhandled UriFormatException crashed the Host at every bring-up, leaving
docker-dev unbootable against current code.

central-1 + central-2 now use the gateway-shape keys, DISABLED by default (the rig has no
historian gateway): Enabled=${OTOPCUA_HISTORIAN_ENABLED:-false}, Endpoint/ApiKey via env,
UseTls + AllowUntrustedServerCertificate. To enable, set OTOPCUA_HISTORIAN_ENABLED=true +
OTOPCUA_HISTORIAN_ENDPOINT + export ServerHistorian__ApiKey (never committed). Verified:
compose config valid, central-1 boots clean (no UriFormatException; OPC UA + AdminUI serving).

Found during the arch-review #10 live-gate rig session; branched off master (independent
of the archreview work).
---
 docker-dev/docker-compose.yml | 36 +++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/docker-dev/docker-compose.yml b/docker-dev/docker-compose.yml
index b2b6914d..b637f413 100644
--- a/docker-dev/docker-compose.yml
+++ b/docker-dev/docker-compose.yml
@@ -168,12 +168,18 @@ services:
       Security__Ldap__GroupToRole__WriteTune: "WriteTune"
       Security__Ldap__GroupToRole__WriteConfigure: "WriteConfigure"
       Security__Ldap__GroupToRole__AlarmAck: "AlarmAck"
-      # A2 live-verify: server-side HistoryRead against the Wonderware sidecar on the WW Historian VM.
-      # SharedSecret injected via env at `docker compose up` (never committed). Port = the sidecar's TCP listen port.
-      ServerHistorian__Enabled: "true"
-      ServerHistorian__Host: "10.100.0.48"
-      ServerHistorian__Port: "32569"
-      ServerHistorian__SharedSecret: "${OTOPCUA_HISTORIAN_SECRET:-}"
+      # Server-side HistoryRead via the ZB.MOM.WW.HistorianGateway sidecar. DISABLED by default: the
+      # docker-dev rig has no historian gateway to point at, and the historian-gateway cutover retired the
+      # old Wonderware Host/Port/SharedSecret keys — the code now reads ServerHistorian__Endpoint and builds
+      # a Uri from it, so Enabled=true with an empty Endpoint crashes the Host at startup
+      # (HistorianGatewayClientAdapter.Create -> UriFormatException "The URI is empty").
+      # To enable: OTOPCUA_HISTORIAN_ENABLED=true + OTOPCUA_HISTORIAN_ENDPOINT=https://<host>:5222, and
+      # export ServerHistorian__ApiKey=histgw_<id>_<secret> at `docker compose up` (never commit the key).
+      ServerHistorian__Enabled: "${OTOPCUA_HISTORIAN_ENABLED:-false}"
+      ServerHistorian__Endpoint: "${OTOPCUA_HISTORIAN_ENDPOINT:-}"
+      ServerHistorian__ApiKey: "${ServerHistorian__ApiKey:-}"
+      ServerHistorian__UseTls: "true"
+      ServerHistorian__AllowUntrustedServerCertificate: "true"
       # Pin EF Core + ASP.NET Core to Warning so the per-poll Deployment SELECT /
       # "Executed DbCommand" Information|Debug lines stop flooding the Serilog
       # pipeline and starving the Akka cluster heartbeat thread. The host logs via
@@ -221,12 +227,18 @@ services:
       Security__Ldap__GroupToRole__WriteTune: "WriteTune"
       Security__Ldap__GroupToRole__WriteConfigure: "WriteConfigure"
       Security__Ldap__GroupToRole__AlarmAck: "AlarmAck"
-      # A2 live-verify: server-side HistoryRead against the Wonderware sidecar on the WW Historian VM.
-      # SharedSecret injected via env at `docker compose up` (never committed). Port = the sidecar's TCP listen port.
-      ServerHistorian__Enabled: "true"
-      ServerHistorian__Host: "10.100.0.48"
-      ServerHistorian__Port: "32569"
-      ServerHistorian__SharedSecret: "${OTOPCUA_HISTORIAN_SECRET:-}"
+      # Server-side HistoryRead via the ZB.MOM.WW.HistorianGateway sidecar. DISABLED by default: the
+      # docker-dev rig has no historian gateway to point at, and the historian-gateway cutover retired the
+      # old Wonderware Host/Port/SharedSecret keys — the code now reads ServerHistorian__Endpoint and builds
+      # a Uri from it, so Enabled=true with an empty Endpoint crashes the Host at startup
+      # (HistorianGatewayClientAdapter.Create -> UriFormatException "The URI is empty").
+      # To enable: OTOPCUA_HISTORIAN_ENABLED=true + OTOPCUA_HISTORIAN_ENDPOINT=https://<host>:5222, and
+      # export ServerHistorian__ApiKey=histgw_<id>_<secret> at `docker compose up` (never commit the key).
+      ServerHistorian__Enabled: "${OTOPCUA_HISTORIAN_ENABLED:-false}"
+      ServerHistorian__Endpoint: "${OTOPCUA_HISTORIAN_ENDPOINT:-}"
+      ServerHistorian__ApiKey: "${ServerHistorian__ApiKey:-}"
+      ServerHistorian__UseTls: "true"
+      ServerHistorian__AllowUntrustedServerCertificate: "true"
       # Quiet EF/AspNetCore SQL flood — see central-1 (Serilog override). mem_limit/
       # mem_reservation are inherited from the *otopcua-host anchor.
       Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"