gtiandClaude Sonnet 5
8d6122c096
One universal Windows Agent package per version (agent_releases: version/ platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary lives on a local release-storage volume, never in PostgreSQL). An operator creates a pending installation (agent_enrollments) from Agents / Servidores -> + Nova instalação, then either downloads it directly or generates a one-time HTTPS link (short TTL, single use). Either path streams the package plus a freshly minted enrollment.json whose token is never written to storage in plaintext, only its SHA-256 hash. On the client host, gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non- HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment token immediately after, success or failure), writes an ACL-restricted .env with the newly issued permanent Agent token, and registers the Windows Service without starting it (Firebird stays unconfigured on purpose). Idempotent, replay-proof, rate-limited per IP, fully audited, never logs a secret. Migration 0022_agent_releases_enrollment (verified fresh-DB == upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION bumped to 1.1.0 as the single source of truth across code, packages, the release manifest and every published AgentRelease row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
23 lines
989 B
Bash
23 lines
989 B
Bash
# GTI Fiscal Agent - PLANNED PROFILE (not installed): RINCAO (restaurante). C000004 has 3 company rows; EMISSOR.EMITENTE_CRT=3 vs C000004(row 000001).CRT=1
|
|
# NO SECRETS in this file. Copy to <install>\.env (gti-agent configure -FromTemplate) and fill AGENT_TOKEN / FB_PASSWORD locally.
|
|
GTI_HUB_URL=https://fiscal.example.gti
|
|
AGENT_TOKEN=
|
|
AGENT_ID=
|
|
|
|
# Company context (deterministic resolver; never the first row of C000004)
|
|
COMPANY_CODE=000001
|
|
COMPANY_CNPJ=
|
|
# REQUIRED: CRT sources conflict (EMISSOR=3, C000004=1); the emission programs read EMISSOR. COMPANY_CODE=000001 is the row whose CNPJ equals the EMISSOR CNPJ.
|
|
COMPANY_CRT_SOURCE=EMISSOR
|
|
# COMPANY_UF= is an explicit override only when the database proves nothing; it never replaces the resolver silently.
|
|
|
|
# Real path of the client's SGV database ON THIS HOST (do not reuse the path of any local copy)
|
|
FIREBIRD_DATABASE_PATH=
|
|
FB_USER=
|
|
FB_PASSWORD=
|
|
|
|
FISCAL_MODE=DRY_RUN
|
|
FIREBIRD_WRITES=0
|
|
POLL_INTERVAL_SECONDS=5
|
|
AGENT_VERSION=1.1.0
|