didericis-claude
c40d359b3d
tracker-policy-pr / check-pr (pull_request) Successful in 13s
test / integration-docker (pull_request) Successful in 20s
test / integration-firecracker (pull_request) Successful in 3m25s
test / unit (pull_request) Failing after 13m4s
test / coverage (pull_request) Has been skipped
test / publish-infra (pull_request) Has been skipped
lint / lint (push) Has been cancelled
Implements the interim secret-provider design (PRD prd-new-secret-provider): each agent receives a random ENV_VAR_SECRET injected into its container env at launch. The host uses this key to encrypt each egress auth token value (HMAC-SHA256 CTR mode, stdlib-only) and store it in a new bottled_agent_secrets table (one row per env var, key column plaintext for auditing). The key never touches the DB. On infra container restart the in-memory token map is lost. launch_consolidated now calls _reprovision_running_bottles after ensure_running: for each registered bottle still alive on the gateway network it execs `printenv ENV_VAR_SECRET` into the agent container and posts the result to the new POST /bottles/<id>/reprovision_gateway control-plane endpoint, which decrypts the stored rows and restores _tokens — no manual intervention needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
90 lines
3.7 KiB
Python
90 lines
3.7 KiB
Python
"""Agent-only compose for the consolidated docker backend (PRD 0070).
|
|
|
|
The per-bottle model rendered a compose project with the agent *and* a
|
|
gateway on two per-bottle networks. In the consolidated model the
|
|
per-bottle companion containers are gone — one shared gateway serves every bottle — so this renders
|
|
just the agent, attached to the **external shared gateway network** with the
|
|
pinned source IP the orchestrator allocated, and pointed at the gateway's
|
|
address for egress (and, around the proxy, for git-http / supervise).
|
|
|
|
Pure: it takes the launch-time `LaunchContext` values (gateway address,
|
|
source IP, network) and the prepared plan, and returns a compose dict — no
|
|
docker, so it's testable in isolation.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from ...egress import egress_agent_env_entries
|
|
from ...orchestrator.secret_store import ENV_VAR_SECRET_NAME
|
|
from ..util import AGENT_CA_BUNDLE, AGENT_CA_PATH
|
|
from .bottle_plan import DockerBottlePlan
|
|
from .egress import EGRESS_PORT
|
|
|
|
|
|
def consolidated_agent_compose(
|
|
plan: DockerBottlePlan,
|
|
*,
|
|
gateway_ip: str,
|
|
source_ip: str,
|
|
network: str,
|
|
) -> dict[str, Any]:
|
|
"""A compose spec with only the agent service, on the external gateway
|
|
network at `source_ip`, proxying egress through `gateway_ip`."""
|
|
# Deliver the identity token as egress proxy credentials — the gateway
|
|
# reads Proxy-Authorization, validates the (source_ip, token) pair, and
|
|
# strips it before upstream. git-http/supervise get it via their own
|
|
# headers (git config extraHeader / MCP header).
|
|
token = getattr(plan, "identity_token", "")
|
|
cred = f"bottle:{token}@" if token else ""
|
|
proxy_url = f"http://{cred}{gateway_ip}:{EGRESS_PORT}"
|
|
# git-http + supervise live on the gateway too and must NOT go through the
|
|
# egress proxy — the agent reaches them directly by the gateway address.
|
|
no_proxy = f"localhost,127.0.0.1,{gateway_ip}"
|
|
env: list[str] = [
|
|
f"HTTPS_PROXY={proxy_url}",
|
|
f"HTTP_PROXY={proxy_url}",
|
|
f"https_proxy={proxy_url}",
|
|
f"http_proxy={proxy_url}",
|
|
f"NO_PROXY={no_proxy}",
|
|
f"no_proxy={no_proxy}",
|
|
f"NODE_EXTRA_CA_CERTS={AGENT_CA_PATH}",
|
|
f"SSL_CERT_FILE={AGENT_CA_BUNDLE}",
|
|
f"REQUESTS_CA_BUNDLE={AGENT_CA_BUNDLE}",
|
|
]
|
|
for name, value in sorted(plan.agent_provision.guest_env.items()):
|
|
env.append(f"{name}={value}")
|
|
# Forwarded vars: bare name → inherits from the compose-up process env so
|
|
# the secret value never lands on argv or in the compose file.
|
|
for name in sorted(plan.forwarded_env.keys()):
|
|
env.append(name)
|
|
# ENV_VAR_SECRET: bare name so the value comes from the compose subprocess
|
|
# env (set in launch.py) and is never written to the compose file on disk.
|
|
if getattr(plan, "env_var_secret", ""):
|
|
env.append(ENV_VAR_SECRET_NAME)
|
|
env.extend(egress_agent_env_entries(plan.egress_plan))
|
|
|
|
service: dict[str, Any] = {
|
|
"image": plan.image,
|
|
"container_name": plan.container_name,
|
|
"command": ["sleep", "infinity"],
|
|
# Pinned address on the shared gateway network — the orchestrator
|
|
# registered this IP, and the gateway attributes the bottle by it.
|
|
"networks": {network: {"ipv4_address": source_ip}},
|
|
"environment": env,
|
|
}
|
|
if plan.use_runsc:
|
|
service["runtime"] = "runsc"
|
|
|
|
return {
|
|
"name": f"bot-bottle-{plan.slug}",
|
|
"services": {"agent": service},
|
|
# The gateway network is created + owned by the orchestrator; compose
|
|
# attaches to it (external) and must not create or destroy it.
|
|
"networks": {network: {"external": True}},
|
|
}
|
|
|
|
|
|
__all__ = ["consolidated_agent_compose"]
|