gtiandClaude Sonnet 5
8d6122c096
One universal Windows Agent package per version (agent_releases: version/ platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary lives on a local release-storage volume, never in PostgreSQL). An operator creates a pending installation (agent_enrollments) from Agents / Servidores -> + Nova instalação, then either downloads it directly or generates a one-time HTTPS link (short TTL, single use). Either path streams the package plus a freshly minted enrollment.json whose token is never written to storage in plaintext, only its SHA-256 hash. On the client host, gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non- HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment token immediately after, success or failure), writes an ACL-restricted .env with the newly issued permanent Agent token, and registers the Windows Service without starting it (Firebird stays unconfigured on purpose). Idempotent, replay-proof, rate-limited per IP, fully audited, never logs a secret. Migration 0022_agent_releases_enrollment (verified fresh-DB == upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION bumped to 1.1.0 as the single source of truth across code, packages, the release manifest and every published AgentRelease row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
38 lines
1.6 KiB
Bash
38 lines
1.6 KiB
Bash
# GTI Fiscal Hub — production environment (copy to .env, never commit .env)
|
|
GTI_FISCAL_VERSION=1.1.0
|
|
|
|
# REQUIRED. URL-safe secret (used inside a connection URL): openssl rand -hex 24
|
|
POSTGRES_PASSWORD=
|
|
|
|
# REQUIRED. Public HTTPS URL that Agents use (TLS terminates in the reverse proxy in front of the Hub).
|
|
BASE_URL=https://fiscal.example.gti
|
|
|
|
# Interface the Hub listens on. Keep 127.0.0.1 when a reverse proxy runs on the same host; use the LAN IP only behind a firewall.
|
|
# Docker-published ports bypass UFW: restrict the source in the DOCKER-USER chain (see docs/PILOT_DEPLOYMENT.md).
|
|
HUB_BIND=127.0.0.1
|
|
HUB_PORT=8000
|
|
|
|
# IP(s) of the reverse proxy allowed to set X-Forwarded-For/-Proto (comma-separated). 127.0.0.1 = same host.
|
|
FORWARDED_ALLOW_IPS=127.0.0.1
|
|
# 1 once HTTPS terminates in front of the Hub (session/CSRF cookies become Secure).
|
|
WEB_COOKIE_SECURE=0
|
|
|
|
# SSO from GTI Gerenciador (docs/PILOT_DEPLOYMENT.md, "Human access"). Needs HTTPS (WEB_COOKIE_SECURE=1).
|
|
# PUBLIC key only (raw Ed25519, base64url) — the private key lives only in the panel.
|
|
SSO_GERENCIADOR_CHAVE_PUBLICA=
|
|
SSO_START_URL=https://gtigerenciador.example.gti/sso/fiscal
|
|
# Collaborator session lifetime; afterwards they are signed in again transparently.
|
|
FEDERATED_SESSION_SECONDS=3600
|
|
|
|
LOG_LEVEL=INFO
|
|
AGENT_ONLINE_THRESHOLD_SECONDS=120
|
|
|
|
# Agent distribution (docs/PILOT_DEPLOYMENT.md, "Agent distribution"). Defaults
|
|
# are safe; override only if the pilot needs a longer/shorter window.
|
|
# AGENT_DOWNLOAD_LINK_TTL_SECONDS=1800
|
|
# AGENT_DOWNLOAD_MAX_USES_DEFAULT=1
|
|
# AGENT_ENROLLMENT_TTL_SECONDS=86400
|
|
|
|
# Directory (host) where pg_dump backups are written by backup.sh
|
|
BACKUP_DIR=./backups
|