ba4c935182
- Added support for bootstrap providers in AuthorityIdentityProviderRegistry. - Introduced a new property for bootstrap providers and updated AggregateCapabilities. - Updated relevant methods to handle bootstrap capabilities during provider registration. feat: Introduce Sealed Mode Status in OpenIddict Handlers - Added SealedModeStatusProperty to AuthorityOpenIddictConstants. - Enhanced ValidateClientCredentialsHandler, ValidatePasswordGrantHandler, and ValidateRefreshTokenGrantHandler to validate sealed mode evidence. - Implemented logic to handle airgap seal confirmation requirements. feat: Update Program Configuration for Sealed Mode - Registered IAuthoritySealedModeEvidenceValidator in Program.cs. - Added logging for bootstrap capabilities in identity provider plugins. - Implemented checks for bootstrap support in API endpoints. chore: Update Tasks and Documentation - Marked AUTH-MTLS-11-002 as DONE in TASKS.md. - Updated documentation to reflect changes in sealed mode and bootstrap capabilities. fix: Improve CLI Command Handlers Output - Enhanced output formatting for command responses and prompts in CommandHandlers.cs. feat: Extend Advisory AI Models - Added Response property to AdvisoryPipelineOutputModel for better output handling. fix: Adjust Concelier Web Service Authentication - Improved JWT token handling in Concelier Web Service to ensure proper token extraction and logging. test: Enhance Web Service Endpoints Tests - Added detailed logging for authentication failures in WebServiceEndpointsTests. - Enabled PII logging for better debugging of authentication issues. feat: Introduce Air-Gap Configuration Options - Added AuthorityAirGapOptions and AuthoritySealedModeOptions to StellaOpsAuthorityOptions. - Implemented validation logic for air-gap configurations to ensure proper setup.
43 lines
1.7 KiB
Plaintext
43 lines
1.7 KiB
Plaintext
# Substitutions for docker-compose.airgap.yaml
|
|
MONGO_INITDB_ROOT_USERNAME=stellaops
|
|
MONGO_INITDB_ROOT_PASSWORD=airgap-password
|
|
MINIO_ROOT_USER=stellaops-offline
|
|
MINIO_ROOT_PASSWORD=airgap-minio-secret
|
|
MINIO_CONSOLE_PORT=29001
|
|
RUSTFS_HTTP_PORT=8080
|
|
AUTHORITY_ISSUER=https://authority.airgap.local
|
|
AUTHORITY_PORT=8440
|
|
SIGNER_POE_INTROSPECT_URL=file:///offline/poe/introspect.json
|
|
SIGNER_PORT=8441
|
|
ATTESTOR_PORT=8442
|
|
# Secrets for Issuer Directory are provided via issuer-directory.mongo.env (see etc/secrets/issuer-directory.mongo.secret.example).
|
|
ISSUER_DIRECTORY_PORT=8447
|
|
ISSUER_DIRECTORY_MONGO_CONNECTION_STRING=mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017
|
|
ISSUER_DIRECTORY_SEED_CSAF=true
|
|
CONCELIER_PORT=8445
|
|
SCANNER_WEB_PORT=8444
|
|
UI_PORT=9443
|
|
NATS_CLIENT_PORT=24222
|
|
SCANNER_QUEUE_BROKER=nats://nats:4222
|
|
AUTHORITY_OFFLINE_CACHE_TOLERANCE=00:45:00
|
|
SCANNER_EVENTS_ENABLED=false
|
|
SCANNER_EVENTS_DRIVER=redis
|
|
# Leave SCANNER_EVENTS_DSN empty to inherit the Redis queue DSN when SCANNER_QUEUE_BROKER uses redis://.
|
|
SCANNER_EVENTS_DSN=
|
|
SCANNER_EVENTS_STREAM=stella.events
|
|
SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
|
|
SCANNER_EVENTS_MAX_STREAM_LENGTH=10000
|
|
SCANNER_SURFACE_FS_ENDPOINT=http://rustfs:8080/api/v1
|
|
SCANNER_SURFACE_CACHE_ROOT=/var/lib/stellaops/surface
|
|
SCANNER_SURFACE_SECRETS_PROVIDER=file
|
|
SCANNER_SURFACE_SECRETS_ROOT=/etc/stellaops/secrets
|
|
SCHEDULER_QUEUE_KIND=Nats
|
|
SCHEDULER_QUEUE_NATS_URL=nats://nats:4222
|
|
SCHEDULER_STORAGE_DATABASE=stellaops_scheduler
|
|
SCHEDULER_SCANNER_BASEADDRESS=http://scanner-web:8444
|
|
ADVISORY_AI_WEB_PORT=8448
|
|
ADVISORY_AI_SBOM_BASEADDRESS=http://scanner-web:8444
|
|
ADVISORY_AI_INFERENCE_MODE=Local
|
|
ADVISORY_AI_REMOTE_BASEADDRESS=
|
|
ADVISORY_AI_REMOTE_APIKEY=
|