Harden admin deployment and local acceptance

Enforce mTLS and least-privilege runtime boundaries while adding repeatable MySQL 8.4 and Docker smoke checks that require no production secrets.
2026-08-17 15:20:46 +08:00
parent 1a9c518f96
commit 405a2cfc0f
17 changed files with 1480 additions and 37 deletions
@@ -0,0 +1,121 @@
+services:
+  mysql:
+    image: mysql:8.4
+    environment:
+      MYSQL_DATABASE: osg_account_smoke
+      MYSQL_ROOT_PASSWORD: ${SMOKE_MYSQL_ROOT_PASSWORD:?generated by deploy/smoke-local.sh}
+      TZ: UTC
+    volumes:
+      - smoke-mysql-data:/var/lib/mysql
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "MYSQL_PWD=$$MYSQL_ROOT_PASSWORD mysqladmin ping --host=127.0.0.1 --user=root --silent",
+        ]
+      interval: 2s
+      timeout: 3s
+      retries: 60
+    networks:
+      - smoke-internal
+
+  schema-migrator:
+    profiles: ["setup"]
+    image: osg-account-server-smoke:${SMOKE_RUN_ID:?generated by deploy/smoke-local.sh}
+    build:
+      context: .
+      dockerfile: Dockerfile
+    init: true
+    user: "10001:10001"
+    env_file:
+      - ${SMOKE_RUNTIME_ENV:?generated by deploy/smoke-local.sh}
+    environment:
+      ADMIN_ENABLED: "false"
+      ADMIN_BOOTSTRAP_ENABLED: "false"
+      DATABASE_USER: osg_smoke_migrator
+      DATABASE_PASSWORD: ${SMOKE_MYSQL_MIGRATION_PASSWORD:?generated by deploy/smoke-local.sh}
+    depends_on:
+      mysql:
+        condition: service_healthy
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777,noexec,nosuid,nodev
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - smoke-internal
+
+  credential-generator:
+    profiles: ["setup"]
+    image: osg-account-server-smoke:${SMOKE_RUN_ID:?generated by deploy/smoke-local.sh}
+    build:
+      context: .
+      dockerfile: Dockerfile
+    entrypoint:
+      - java
+      - -cp
+      - /app/lib/*
+      - com.osglab.account.tools.AdminCredentialGenerator
+    command:
+      - smoke-admin
+      - /run/smoke/admin.generated.env
+      - /run/smoke/admin-handoff.txt
+    user: "${SMOKE_HOST_UID:?generated by deploy/smoke-local.sh}:${SMOKE_HOST_GID:?generated by deploy/smoke-local.sh}"
+    volumes:
+      - ${SMOKE_SECRET_DIR:?generated by deploy/smoke-local.sh}:/run/smoke
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    network_mode: none
+
+  account-server:
+    image: osg-account-server-smoke:${SMOKE_RUN_ID:?generated by deploy/smoke-local.sh}
+    build:
+      context: .
+      dockerfile: Dockerfile
+    init: true
+    user: "10001:10001"
+    env_file:
+      - ${SMOKE_RUNTIME_ENV:?generated by deploy/smoke-local.sh}
+      - ${SMOKE_ADMIN_ENV:?generated by deploy/smoke-local.sh}
+    depends_on:
+      mysql:
+        condition: service_healthy
+    ports:
+      - "127.0.0.1:${SMOKE_APP_PORT:?generated by deploy/smoke-local.sh}:8080"
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777,noexec,nosuid,nodev
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "wget",
+          "-q",
+          "-O",
+          "/dev/null",
+          "http://127.0.0.1:8080/health/ready",
+        ]
+      interval: 2s
+      timeout: 3s
+      retries: 60
+    networks:
+      - smoke-internal
+      - smoke-loopback
+
+volumes:
+  smoke-mysql-data:
+
+networks:
+  smoke-internal:
+    internal: true
+  smoke-loopback:
+    driver: bridge