Joseph McQueen
4f9ebdb5fb
The previous packager (scripts/packageDectRelayAgent.js) shipped a
source-only bundle and expected the DC host to build the image with
`docker compose up --build`. That fails hard in corporate DCs with
TLS-intercepted egress: Alpine's apk fetch of dl-cdn.alpinelinux.org
can't verify the intercepted certificate ("apk: TLS: server
certificate not trusted"), and npm install would fail the same way
if apk had succeeded.
New approach: build the image ONCE on the dev machine (where TLS
works), save it as a gzipped tarball, and ship a ZIP whose install
step is `docker load` + `docker compose up -d`. Zero network calls
inside the DC container, ever.
Bundling (dev-machine):
- dect-relay-agent/bundle.sh: build → docker save → gzip → zip.
Auto-derives version from package.json, records git sha + dirty
flag + build date into image labels. Cross-arch friendly
(--platform=linux/amd64 by default; --platform linux/arm64 for
ARM DCs). Output: dect-relay-agent-bundle-<YYYYMMDD-HHMMSS>.zip
at repo root (typically 40-60MB).
- dect-relay-agent/Dockerfile: multi-stage node:20-alpine build.
No apk add. No runtime npm install. Non-root `node` user (uid
1000). Node handles SIGTERM natively via index.js handlers, so
no tini/dumb-init needed. Designed to build from the REPO ROOT
(not the agent folder) because the agent imports shared modules
from ../integrations/cisco-dect and ../utils.
- dect-relay-agent/Dockerfile.dockerignore: per-Dockerfile ignore
(BuildKit ≥ 23.0) with a whitelist that keeps the build context
to ~50KB. Older Docker daemons fall through to the repo-root
.dockerignore, which already excludes secrets — nothing sensitive
can leak either way.
- package.json: `npm run package:relay` now invokes bundle.sh.
Runtime (DC-host):
- dect-relay-agent/docker-compose.yml: pins IMAGE_TAG from .env
(install.sh writes it there — never falls back to :latest), reads
the rest of the config via env_file, restart: unless-stopped,
host networking (needed to reach 10.x/8 without userland proxy
translation, and the agent doesn't listen on anything). Hardened:
read_only: true rootfs with a 16MB /tmp tmpfs, cap_drop: ALL,
no-new-privileges, log rotation at 10MB × 5 files.
- dect-relay-agent/install.sh: preflight (docker + compose present,
daemon reachable, bundle files intact), docker load, pin loaded
tag into .env, validate .env has the three required values not
still set to placeholder strings, docker compose up -d, tail last
40 log lines. Idempotent — safe to re-run on upgrades.
Cleanup:
- scripts/packageDectRelayAgent.js: deleted (superseded).
- .gitignore: drops the scripts/* + !packageDectRelayAgent.js dance
since we no longer need to whitelist that one file; add pattern
for the datestamped bundle zips + staging dirs at repo root.
- dect-relay-agent/README.md: replaces the deploy section with the
new dev-machine-build → DC-host-load workflow, plus a
troubleshooting section keyed on the exact error messages seen
during the failed in-DC build (TLS cert not trusted, docker perm
denied, DIGEST_401).
Verified: all 113 existing tests still pass. Docker build itself
requires a Docker daemon (dev machine) so can't be exercised in
this sandbox — the bash scripts pass `bash -n` syntax checks.
75 lines
1.3 KiB
Text
75 lines
1.3 KiB
Text
# Dependencies
|
|
node_modules/
|
|
|
|
# Environment & Secrets
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
*.pem
|
|
*.cer
|
|
*.key
|
|
debug_cert_*.pem
|
|
|
|
# The rotating service token file must be provided locally for Docker mounts (and runtime writes).
|
|
# Never commit real tokens.
|
|
config/webex-service-tokens.json
|
|
|
|
# Logs & Runtime data
|
|
logs/
|
|
*.log
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
|
|
# Storage / Certificates / Debug artifacts (provide aeoroots.cer etc. locally for your clone; volume mounted in Docker)
|
|
storage/
|
|
|
|
# Dev / test artifacts (local only)
|
|
characterization-runs/
|
|
scripts/
|
|
characterize-*.js
|
|
|
|
# Backup & temp files
|
|
*.bak
|
|
*~
|
|
*.swp
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# IDE / Editor
|
|
.idea/
|
|
.vscode/
|
|
*.sublime-project
|
|
*.sublime-workspace
|
|
.history/
|
|
|
|
# Build / Output
|
|
dist/
|
|
build/
|
|
coverage/
|
|
.nyc_output/
|
|
|
|
# DECT relay agent deploy bundles produced by dect-relay-agent/bundle.sh.
|
|
# The datestamped zip lands at repo root and shouldn't be committed —
|
|
# it's ~40MB (Docker image tarball) and rebuildable on demand.
|
|
dect-relay-agent-bundle-*.zip
|
|
dect-relay-agent-bundle-*/
|
|
|
|
# Docker / Misc
|
|
docker-compose.override.yml
|
|
|
|
# OS generated
|
|
.AppleDouble
|
|
.LSOverride
|
|
._*
|
|
.Spotlight-V100
|
|
.Trashes
|
|
|
|
# Misc project artifacts
|
|
testobjects.json
|
|
meraki-store-topology-demo.html
|
|
config/config.json
|
|
config/config.bak
|
|
|
|
# Local spike samples pulled from lab DBS-210 (never commit)
|
|
.dect-samples/
|