dohertj2/lmxopcua
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

docker-dev rig hygiene: stale LDAP credentials, opc-plc alarm mismatch, central-2 serve path #619

New Issue
Closed
opened 2026-10-08 02:31:15 -04:00 by dohertj2 · 3 comments
dohertj2 commented 2026-10-08 02:31:15 -04:00
Owner
Copy Link
Copy Source

The compose file binds cn=serviceaccount / serviceaccount123 and tells operators to sign in as alice/bob; the password was rotated (SEC-36) and those users don't exist in the shared GLAuth. DisableLogin=true masks it, so real-login gates fail.
Sources: docker-dev/docker-compose.yml:107-109,194-195; ../scadaproj/infra/glauth/config.toml:71-80; CLAUDE.md Authentication section; archreview/plans/STATUS.md:525-529; docs/plans/2026-08-17-perf-followups-r3.md (FetchAndCache).

  • Bind password via env/secret; documented users → multi-role/admin; fix CLAUDE.md
  • Align opc-plc --alm alarms with authored SourceNode refs so a native-alarm transition leg can run on the rig
  • Exercise central-2:4055 FetchAndCache serving (stop central-1's listener) in a live gate

Filed 2026-10-08 by the pending/deferred-work sweep after the #562–#591 issue sweep.

The compose file binds `cn=serviceaccount` / `serviceaccount123` and tells operators to sign in as `alice`/`bob`; the password was rotated (SEC-36) and those users don't exist in the shared GLAuth. `DisableLogin=true` masks it, so real-login gates fail. Sources: docker-dev/docker-compose.yml:107-109,194-195; ../scadaproj/infra/glauth/config.toml:71-80; CLAUDE.md Authentication section; archreview/plans/STATUS.md:525-529; docs/plans/2026-08-17-perf-followups-r3.md (FetchAndCache). - [ ] Bind password via env/secret; documented users → `multi-role`/`admin`; fix CLAUDE.md - [ ] Align opc-plc `--alm` alarms with authored `SourceNode` refs so a native-alarm transition leg can run on the rig - [ ] Exercise `central-2:4055` FetchAndCache serving (stop central-1's listener) in a live gate _Filed 2026-10-08 by the pending/deferred-work sweep after the #562–#591 issue sweep._
dohertj2 commented 2026-10-08 09:24:37 -04:00
Author
Owner
Copy Link
Copy Source

Partial on master; left open.

  • Item 3, central-2 FetchAndCache serving: live gate PASSED 2026-10-08 on the docker-dev rig. With central-1 stopped and set to MaintenanceMode, the four site nodes fetched and verified the artifact from central-2:4055 after central-1 went Unavailable, applied, and acked to central-2; deployment 8391c0a9 sealed. Rig restored afterwards (baseline revision 21238c01 redeployed).
  • [~] Item 1: the documented sign-in users now point at existing GLAuth users (admin/multi-role + password; the compose comment notes alice/bob no longer exist) and CLAUDE.md/docs were corrected (docs pass 42700eb2, #619 compose comment). Not done: the serviceaccount123 bind password is still a literal in docker-dev/docker-compose.yml (Security__Ldap__ServiceAccountPassword, 3 places); moving it to an env/secret is still to do. It is a committed-dev-secret exception today, so it is low risk.
  • Item 2, align opc-plc --alm alarms with authored SourceNode refs so a native-alarm transition leg can run on the rig: not done.

Progress 2026-10-08 by the hardware-available issue sweep (master d898262c); left open for the remaining items.

Partial on master; left open. - [x] Item 3, central-2 FetchAndCache serving: **live gate PASSED 2026-10-08** on the docker-dev rig. With central-1 stopped and set to MaintenanceMode, the four site nodes fetched and verified the artifact from central-2:4055 after central-1 went Unavailable, applied, and acked to central-2; deployment 8391c0a9 sealed. Rig restored afterwards (baseline revision 21238c01 redeployed). - [~] Item 1: the documented sign-in users now point at existing GLAuth users (`admin`/`multi-role` + `password`; the compose comment notes alice/bob no longer exist) and CLAUDE.md/docs were corrected (docs pass 42700eb2, #619 compose comment). **Not done:** the `serviceaccount123` bind password is still a literal in docker-dev/docker-compose.yml (`Security__Ldap__ServiceAccountPassword`, 3 places); moving it to an env/secret is still to do. It is a committed-dev-secret exception today, so it is low risk. - [ ] Item 2, align opc-plc `--alm` alarms with authored SourceNode refs so a native-alarm transition leg can run on the rig: not done. *Progress 2026-10-08 by the hardware-available issue sweep (master d898262c); left open for the remaining items.*
dohertj2 commented 2026-10-08 18:52:14 -04:00
Author
Owner
Copy Link
Copy Source

Landed on master: LDAP bind password via ${OTOPCUA_LDAP_BIND_PASSWORD:-serviceaccount123} + docker-dev README (bdf13d29); opc-plc alarm alignment (e56926dc, d9349149, 8f5b265d, seed fix fdee129f, merge 3bf874ae) - live-gated: opc-plc SouthMotor Gold alarm arrives Active sev 700->900 via ConditionRefresh. The gate also found/fixed an OpcUaClient ConditionId routing defect. Remaining (left open): exercising central-2:4055 FetchAndCache serving (stop central-1's listener) in a live gate; the documented-users/CLAUDE.md auth item was not verified in this batch.

Landed on master: LDAP bind password via ${OTOPCUA_LDAP_BIND_PASSWORD:-serviceaccount123} + docker-dev README (bdf13d29); opc-plc alarm alignment (e56926dc, d9349149, 8f5b265d, seed fix fdee129f, merge 3bf874ae) - live-gated: opc-plc SouthMotor Gold alarm arrives Active sev 700->900 via ConditionRefresh. The gate also found/fixed an OpcUaClient ConditionId routing defect. Remaining (left open): exercising central-2:4055 FetchAndCache serving (stop central-1's listener) in a live gate; the documented-users/CLAUDE.md auth item was not verified in this batch.
dohertj2 commented 2026-10-08 20:50:25 -04:00
Author
Owner
Copy Link
Copy Source

Closing: the remaining items are done. The central-2:4055 FetchAndCache serve-path gate already PASSED (see the earlier comment — the later 'remains' comment was stale), and the docker-dev compose/docs already state the old alice/bob users no longer exist; the opc-plc alarm mismatch was fixed in the #640–#646 batch (3bf874ae/fdee129f), and the seed's TargetNamespaceKind workaround is now gone with #648.

Closing: the remaining items are done. The central-2:4055 FetchAndCache serve-path gate already PASSED (see the earlier comment — the later 'remains' comment was stale), and the docker-dev compose/docs already state the old alice/bob users no longer exist; the opc-plc alarm mismatch was fixed in the #640–#646 batch (`3bf874ae`/`fdee129f`), and the seed's TargetNamespaceKind workaround is now gone with #648.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 cross-driver
queue management
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#619
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?