From 82ad98e1a9e8cd4754a472c129c49816fa8e591b Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Thu, 20 Aug 2026 10:24:49 -0400
Subject: [PATCH] chore(docker-dev): parameterise Security__Auth__DisableLogin
 on the central pair

Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}" on central-1
and central-2 - byte-identical default behaviour, verified via `docker
compose config` both unset (resolves "true") and with
OTOPCUA_DISABLE_LOGIN=false (resolves "false").

DisableLogin's always-succeeding handler, registered under the cookie scheme
name, masks the AdminUI cookie FallbackPolicy entirely - which is exactly how
03/S14 (the FallbackPolicy blocking every mesh gRPC call on a login-enabled
admin node) survived seven phases of prior live gates that all ran with the
default. The production-faithful mode is now a one-variable flip instead of
an edit-and-remember-to-revert; header comment names the flip and the LDAP
users it needs (archreview 03/S14, R3-01 T8).
---
 docker-dev/docker-compose.yml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/docker-dev/docker-compose.yml b/docker-dev/docker-compose.yml
index 97abc07c..73aec571 100644
--- a/docker-dev/docker-compose.yml
+++ b/docker-dev/docker-compose.yml
@@ -90,6 +90,21 @@
 # prior dark-switch shape). The ClusterNode.GrpcPort column (seeded by
 # docker-dev/seed/seed-clusters.sql) points central's dial supervisor at each node's :4056.
 #
+# Production-faithful auth (R3-01, archreview 03/S14): central-1/central-2's
+# Security__Auth__DisableLogin defaults to "true" here (byte-identical to the previous hardcoded
+# value) but is now `${OTOPCUA_DISABLE_LOGIN:-true}` — a one-variable flip to the REAL cookie
+# login flow instead of an edit-and-remember-to-revert. DisableLogin registers an always-succeeding
+# handler UNDER the cookie scheme name, so every live gate run with the default masks the AdminUI
+# cookie FallbackPolicy entirely — which is exactly how 03/S14 (the FallbackPolicy blocking every
+# mesh gRPC call on a login-enabled admin node) survived seven phases of prior live gates. To drive
+# this rig production-faithfully:
+#   OTOPCUA_DISABLE_LOGIN=false docker compose -f docker-dev/docker-compose.yml up -d central-1 central-2
+# Sign in as `alice` / `password` (or `bob`) against the shared GLAuth (10.100.0.35:3893,
+# dc=zb,dc=local) — the same LDAP users every other node in this file already authenticates OPC UA
+# sessions against. Restore the default with `docker compose ... up -d central-1 central-2` (no env
+# var). See docs/security.md "Mesh gRPC ingress is AllowAnonymous by design" for what this actually
+# exercises.
+#
 # Usage:
 #   docker compose -f docker-dev/docker-compose.yml up -d --build
 #   open http://localhost:9200             # central Blazor admin UI
@@ -382,7 +397,7 @@ services:
       Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local"
       Security__Ldap__ServiceAccountPassword: "serviceaccount123"
       Security__DeployApiKey: "docker-dev-deploy-key"
-      Security__Auth__DisableLogin: "true"
+      Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}"
       # Map the shared-GLAuth data-plane groups (ReadOnly/WriteOperate/...) to data-plane role
       # strings the OPC UA session ACL gates read. The DB LdapGroupRoleMapping is AdminRole-typed
       # (AdminUI roles); this free-form GroupToRole baseline is the path for data-plane roles.
@@ -508,7 +523,7 @@ services:
       Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local"
       Security__Ldap__ServiceAccountPassword: "serviceaccount123"
       Security__DeployApiKey: "docker-dev-deploy-key"
-      Security__Auth__DisableLogin: "true"
+      Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}"
       # Data-plane group→role baseline (see central-1).
       Security__Ldap__GroupToRole__ReadOnly: "ReadOnly"
       Security__Ldap__GroupToRole__WriteOperate: "WriteOperate"