docs: apply the closed Gitea decisions 3, 19, 20 and 38
- Issue 3 (Q4b): the registered-device cookie stays; no device certificate. - Issue 19 (Q22): upload limits stay; ClamAV stays off in both stacks, the workstations run Microsoft Defender. - Issue 20 (Q23): the storage alert stays at 85 percent; phase 9 mails it to PS-Admins. - Issue 38 (OPS2): the test stack stays under ~/packetstation/test on docker-1. test.env.example, the compose header, README, CLAUDE.md, DEPLOY.md and SECURITY.md give that path and the actual modes. The production layout is asked on issue 38. All four confirm the built defaults, so no code changed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Claude Opus 5.5
+10
-10
@@ -38,7 +38,7 @@ Both stacks run from the same image as separate compose projects.
|
||||
|
||||
## Secrets
|
||||
|
||||
Docker secrets, one file each, under `/etc/packetstation/<stack>/secrets/`. Owner `root:10001` (10001 is the image's non-root user), mode `0440`.
|
||||
Docker secrets, one file each, in the stack's `secrets/` folder ("Env files" says where each stack keeps it). Production: owner `root:10001` (10001 is the image's non-root user), mode `0440`. Test: owner `spencerm`, mode `0444`, reachable only through `/home/spencerm` and `packetstation/test`, both mode `0750`, so no other host user can read them.
|
||||
|
||||
| Secret | Used by |
|
||||
|---|---|
|
||||
@@ -59,7 +59,7 @@ The PESCO CA chain is mounted into the containers once and referenced by `LDAP_C
|
||||
|
||||
## Env files
|
||||
|
||||
One folder per stack under `/etc/packetstation/`: `/etc/packetstation/test/` and `/etc/packetstation/prod/`. Each holds `stack.env` (settings only, no secrets) and `secrets/`. The env file sets `PROJECT_NAME`, `SECRETS_DIR` and `APP_ALIAS`, which the compose files require. `.env.example` in the repo lists every setting.
|
||||
One folder per stack. The test stack: `/home/spencerm/packetstation/test/`, like the other compose stacks on docker-1 (decided 2026-10-18, Gitea issue 38). It holds `stack.env`, `secrets/`, `ca/pesco-ca.pem` and `backups/`, and its `stack.env` sets `ENV_FILE`, `SECRETS_DIR`, `CA_BUNDLE_FILE` and `BACKUP_DIR` to those paths. The compose files run from the checkout in `/home/spencerm/packetstation/repo/deploy`. The production stack: `/etc/packetstation/prod/` until issue 38 says otherwise. Each folder holds `stack.env` (settings only, no secrets) and `secrets/`. The env file sets `PROJECT_NAME`, `SECRETS_DIR` and `APP_ALIAS`, which the compose files require. `.env.example` in the repo lists every setting.
|
||||
|
||||
Key settings:
|
||||
|
||||
@@ -84,7 +84,7 @@ The feed's schedule and rules are not env settings. Intervals, shop hours, the w
|
||||
Test stack:
|
||||
|
||||
```bash
|
||||
docker compose -p packetstation-test --env-file /etc/packetstation/test/stack.env \
|
||||
docker compose -p packetstation-test --env-file ~/packetstation/test/stack.env \
|
||||
-f deploy/compose.yaml -f deploy/compose.proxy.yaml up -d
|
||||
```
|
||||
|
||||
@@ -94,13 +94,13 @@ Images come from `gt.pescoinc.biz` by tag. CI tags each tested image `:sha-<sha>
|
||||
|
||||
## Virus scan (ClamAV, phase 4)
|
||||
|
||||
ClamAV is optional and off by default. It closes requirement D5. Turn it on in the test stack first, check it, then the production stack.
|
||||
ClamAV is optional and off by default. It closes requirement D5. IT decided on 2026-10-18 (Gitea issue 19) to leave it off in both stacks: every workstation that uploads runs Microsoft Defender. The steps below stay for the day that changes. Turn it on in the test stack first, check it, then the production stack.
|
||||
|
||||
1. Set `CLAMAV_HOST=packetstation-clamav` in the stack's env file (`/etc/packetstation/test/stack.env`). Leave `CLAMAV_PORT` and `CLAMAV_TIMEOUT_SECONDS` at their defaults.
|
||||
1. Set `CLAMAV_HOST=packetstation-clamav` in the stack's env file (`~/packetstation/test/stack.env`). Leave `CLAMAV_PORT` and `CLAMAV_TIMEOUT_SECONDS` at their defaults.
|
||||
2. Start the stack with the profile:
|
||||
|
||||
```bash
|
||||
docker compose -p packetstation-test --env-file /etc/packetstation/test/stack.env \
|
||||
docker compose -p packetstation-test --env-file ~/packetstation/test/stack.env \
|
||||
-f deploy/compose.yaml -f deploy/compose.proxy.yaml --profile clamav up -d
|
||||
```
|
||||
|
||||
@@ -119,7 +119,7 @@ clamd holds the signatures in memory, about 1.2 GB with the full set and more wh
|
||||
|
||||
Every stored file and the housekeeping job check the assets volume. With `ASSETS_QUOTA_BYTES=0` (the default) the check reads the volume's own used and total bytes; with a byte budget it adds up the stored files' sizes against it. At `ASSETS_QUOTA_WARN_PCT` percent (85 by default) the app opens one `notification_events` alert of kind `assets_quota` and audits `storage.quota_warning`. When usage drops back under, the alert is resolved. A failed check is logged and never fails an upload.
|
||||
|
||||
The Admin page, Storage tab, shows the usage bar (used of total, percent, the threshold), the open quota alert with an Acknowledge button, the ClamAV line ("Not configured", or the host with reachable or not reachable) and every open alert. Phase 9 sends the alert by email. Until then, check the Storage tab.
|
||||
The Admin page, Storage tab, shows the usage bar (used of total, percent, the threshold), the open quota alert with an Acknowledge button, the ClamAV line ("Not configured", or the host with reachable or not reachable) and every open alert. Phase 9 sends the alert by email to PS-Admins (decided 2026-10-18, Gitea issue 20, which also kept the 85 percent threshold). Until then, check the Storage tab.
|
||||
|
||||
## Python packages and the Gitea index
|
||||
|
||||
@@ -170,7 +170,7 @@ mfiles.pescoinc.biz uses a public Let's Encrypt certificate, so MFILES_CA_BUNDLE
|
||||
|
||||
Resolved 2026-10-17: the CA was switched to SHA-256 (`certutil -setreg ca\csp\CNGHashAlgorithm SHA256`, restart certsvc; the CA already used the Key Storage Provider) and the Kerberos Authentication, Domain Controller Authentication and Directory Email Replication certificates on DC-02 and PDC-1 and the Machine certificate on APP-03 were renewed with `certreq -enroll -machine -q -cert <thumbprint> renew reusekeys`. From docker-1 all three endpoints now verify against the PESCO bundle with sha256WithRSAEncryption. The CA certificate itself is still SHA-1 self-signed, which OpenSSL accepts for a trust anchor. If the problem comes back, the fix was: set the CA to issue with SHA-256 and reissue the domain controller and relay certificates. The CA certificate itself may stay SHA-1, since OpenSSL does not check the trust anchor's own signature. Until then the test stack cannot sign in or verify the relay without a test-only OpenSSL security-level override, which is Spencer's decision to apply, never the production stack's. The doctor should report a SHA-1 chain with this hint (follow-up).
|
||||
|
||||
The test stack on docker-1 lives under /home/spencerm/packetstation/test (stack.env, secrets/, ca/pesco-ca.pem, backups/) because the session that set it up had no sudo; move it to /etc/packetstation/test when convenient.
|
||||
The test stack on docker-1 lives under /home/spencerm/packetstation/test (stack.env, secrets/, ca/pesco-ca.pem, backups/). It stays there: that matches the other compose stacks on the host (Gitea issue 38, 2026-10-18).
|
||||
|
||||
## Known issue: Docker subnet pool on docker-1 (found 2026-10-17)
|
||||
|
||||
@@ -212,7 +212,7 @@ Docker's default address pool on docker-1 holds fifteen /16 bridge networks (172
|
||||
Then prove the live connection with the doctor and `VISUAL_ENCRYPT=yes`. The image does not yet add the PESCO CA to OpenSSL's trust store for the ODBC driver (the issue 5 follow-up), so this one-off check builds a bundle in `/tmp`. It skips the entrypoint, so the M-Files password line fails. Read the VISUAL line.
|
||||
|
||||
```bash
|
||||
docker compose -p packetstation-test --env-file /etc/packetstation/test/stack.env \
|
||||
docker compose -p packetstation-test --env-file ~/packetstation/test/stack.env \
|
||||
-f deploy/compose.yaml -f deploy/compose.proxy.yaml run --rm --no-deps \
|
||||
-e VISUAL_ENCRYPT=yes --entrypoint sh app -c \
|
||||
'cat /etc/ssl/certs/ca-certificates.crt /etc/ssl/pesco/ca.pem > /tmp/ca.pem && SSL_CERT_FILE=/tmp/ca.pem exec packetstation doctor'
|
||||
@@ -243,7 +243,7 @@ Docker's default address pool on docker-1 holds fifteen /16 bridge networks (172
|
||||
`packetstation doctor` proves a host and a stack are ready. Run it with `compose run`, not `compose exec`: the entrypoint exports MFILES_PASSWORD from its secret file, and `exec` skips the entrypoint, so the M-Files password check fails under `exec` even though the running worker has it.
|
||||
|
||||
```bash
|
||||
docker compose -p packetstation-test --env-file /etc/packetstation/test/stack.env \
|
||||
docker compose -p packetstation-test --env-file ~/packetstation/test/stack.env \
|
||||
-f deploy/compose.yaml -f deploy/compose.proxy.yaml run --rm app doctor
|
||||
```
|
||||
|
||||
|
||||
Reference in New Issue
Block a user