q792602257
efeb3eb926
Tests / Test passed: 581
Host Agent: - One-time local operator account bootstrap (PBKDF2-HMAC-SHA256, atomic 0600-permission write) gating the daemon's first unattended start via a new `setup` CLI subcommand. - Default control-plane URL now https://amcp.home.jerryyan.top (env var override unchanged). - Enrollment no longer requires a pre-issued token; falls back to zero-token self-service enrollment when none is configured. Cloud control plane: - CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED (default false) opt-in flag. - SelfServiceEnrollmentAuthProvider + ChainedEnrollmentAuthProvider: configured tokens still take priority; self-service only applies when no token matches, preserving edge-host-enrollment's token-bound path. - Fixed a latent bug in sql_repository.py::enroll_host: the token-conflict lookup used `== enrollment_token_digest`, which SQLAlchemy compiles to `IS NULL` when the value is None, so every self-service enrollment after the first would have falsely collided with an existing NULL-digest host. Skipped that lookup entirely when the digest is None. Docs/deploy: .env.example, compose.yaml, compose.deploy.yaml, CLOUD_DEPLOYMENT.md, MACOS_IPHONE_SETUP.md updated for the new flag, URL default, and required `device-host-agent setup` step. Verification: 494 non-integration tests pass; openspec validate --strict passes. PostgreSQL-backed contract tests and full manual end-to-end verification were not run (no Postgres/Docker or reachable cloud-api in this environment); noted as unchecked in tasks.md 7.2/7.4.
54 lines
2.3 KiB
Bash
54 lines
2.3 KiB
Bash
# Used by compose.deploy.yaml (image: git.jerryyan.net/q792602257/agentic-mobile-control:${IMAGE_TAG}).
|
|
# Jenkins publishes IMAGE_TAG as "<BUILD_NUMBER>-<git short sha>"; match the
|
|
# tag of the build you intend to deploy.
|
|
IMAGE_TAG=latest
|
|
|
|
POSTGRES_DB=device_cloud
|
|
POSTGRES_USER=device_cloud
|
|
POSTGRES_PASSWORD=change-me-database-password
|
|
|
|
CLOUD_API_PORT=8001
|
|
CLOUD_PUBLIC_CREDENTIALS_JSON=[{"principal_id":"local-sdk","token":"change-me-public-token","scopes":["tasks:submit","tasks:read","pool:read","plugins:read","plugins:admin"]}]
|
|
CLOUD_HOST_CREDENTIALS_JSON=[{"principal_id":"local-host-agent","token":"change-me-host-token","scopes":[],"host_id":"host-local"}]
|
|
CLOUD_ENROLLMENT_TOKENS_JSON=[{"principal_id":"edge-installer","token":"change-me-enrollment-token"}]
|
|
# Zero-token self-service Host enrollment (see docs/CLOUD_DEPLOYMENT.md). Only
|
|
# enable this on a deployment whose control-plane URL is not reachable by
|
|
# untrusted networks; any caller that reaches it can register itself as a Host.
|
|
CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED=false
|
|
CLOUD_SCHEDULER_INTERVAL_SECONDS=1
|
|
CLOUD_LEASE_REAPER_INTERVAL_SECONDS=5
|
|
CLOUD_LEASE_DURATION_SECONDS=60
|
|
CLOUD_MAX_TASK_ATTEMPTS=3
|
|
# Browser user sessions are secure-by-default in production. Terminate TLS at a
|
|
# reverse proxy before exposing the Console; do not put initial-user passwords here.
|
|
CLOUD_USER_SESSION_IDLE_SECONDS=28800
|
|
CLOUD_USER_SESSION_ABSOLUTE_SECONDS=604800
|
|
CLOUD_LOGIN_FAILURE_LIMIT=5
|
|
CLOUD_LOGIN_FAILURE_WINDOW_SECONDS=900
|
|
CLOUD_LOGIN_BLOCK_SECONDS=900
|
|
CLOUD_SESSION_COOKIE_SECURE=true
|
|
CLOUD_TRUST_PROXY_HEADERS=false
|
|
|
|
HOST_AGENT_HOST_ID=host-local
|
|
HOST_AGENT_TOKEN=change-me-host-token
|
|
HOST_AGENT_ENROLLMENT_TOKEN=
|
|
HOST_AGENT_IDENTITY_PATH=/app/tasks/host_identity.json
|
|
# One-time local operator account gate; run `device-host-agent setup`
|
|
# interactively before the daemon's first unattended start (see
|
|
# docs/CLOUD_DEPLOYMENT.md).
|
|
HOST_AGENT_LOCAL_ACCOUNT_PATH=/app/tasks/host_local_account.json
|
|
HOST_AGENT_DISPLAY_NAME=
|
|
HOST_AGENT_TASKS_PATH=./tasks
|
|
HOST_AGENT_HEARTBEAT_INTERVAL_SECONDS=30
|
|
HOST_AGENT_POLL_TIMEOUT_SECONDS=20
|
|
HOST_AGENT_RETRY_BACKOFF_SECONDS=1
|
|
HOST_AGENT_MAX_RETRY_BACKOFF_SECONDS=30
|
|
HOST_AGENT_MAX_RETRY_ATTEMPTS=5
|
|
|
|
AI_PLANNER_ENABLED=false
|
|
AI_PLANNER_PROVIDER=anthropic
|
|
AI_PLANNER_MODEL=
|
|
AI_PLANNER_TIMEOUT_SECONDS=30
|
|
ANTHROPIC_API_KEY=
|
|
OPENAI_API_KEY=
|