7081221352
Add WS_TLS_CA_FILE and WS_TLS_REJECT_UNAUTHORIZED so the remote agent can trust internal PKI chains instead of failing with "unable to verify the first certificate". Apply the same TLS options to proxied HTTPS calls and document CA bundle mounting in compose and deploy READMEs. Co-authored-by: Cursor <cursoragent@cursor.com>
51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
# Compose file for the StoreHealthAnalyzer remote agent.
|
|
#
|
|
# Run from the REPOSITORY ROOT so the build context can pick up
|
|
# remoteAgent.js:
|
|
#
|
|
# docker compose -f docker/remote-agent/docker-compose.yml up -d --build
|
|
#
|
|
# Environment values come from docker/remote-agent/.env (copy the .env.example
|
|
# next to it). Set WS_URL to the main StoreHealthAnalyzer server's public
|
|
# websocket endpoint, and WS_TOKEN to the shared secret.
|
|
|
|
services:
|
|
remote-agent:
|
|
build:
|
|
context: ../..
|
|
dockerfile: docker/remote-agent/Dockerfile
|
|
image: sha-remote-agent:latest
|
|
container_name: sha-remote-agent
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
# If WS_URL uses wss:// with a corporate/private CA, place your root +
|
|
# intermediate PEM bundle in docker/remote-agent/certs/ and uncomment:
|
|
#
|
|
# volumes:
|
|
# - ./certs/ca-bundle.pem:/certs/ca-bundle.pem:ro
|
|
# environment:
|
|
# WS_TLS_CA_FILE: /certs/ca-bundle.pem
|
|
#
|
|
# The agent is a websocket client — it doesn't listen on any port, so
|
|
# there's nothing to publish. It just needs outbound network access to:
|
|
# - the main StoreHealthAnalyzer server (WS_URL)
|
|
# - the internal APIs it proxies for (SIW, MDM, whatever else).
|
|
#
|
|
# If those live on the host's Docker network, uncomment `network_mode:
|
|
# host` (Linux only) or attach to a shared user-defined network.
|
|
#
|
|
# network_mode: host
|
|
|
|
# Stop signal + timeout tuning: the agent handles SIGTERM cleanly via
|
|
# tini, so the default 10s grace period is plenty.
|
|
stop_signal: SIGTERM
|
|
stop_grace_period: 10s
|
|
|
|
# Send stdout/stderr to json-file with sensible rotation so a long-lived
|
|
# container doesn't fill the disk with reconnect chatter.
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: '10m'
|
|
max-file: '3'
|