mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-12 23:12:23 -06:00
Patrick Buckley
62ff3217d0
* fix: TLS Docker end-to-end testing fixes Fixes discovered during Docker Compose TLS integration testing: - Dockerfile: use --extra all (prevents missing optional deps) - lacme 1.0.3: fixes CACertificateIssued event logging crash - chmod PermissionError: guard for Docker volume mounts - socket import: moved to top of main() (was inside TLS conditional, caused NameError in _default_node_id) - redis.SSLConnection: ConnectionPool needs explicit connection_class, not ssl=True (which only works on Redis() directly) - Empty redis password: pass None instead of "" to avoid AUTH error - TURNSTONE_CONSOLE_URL: env var for Docker service discovery (0.0.0.0 bind address isn't reachable from other containers) - HTTP01Handler: ACME client needs a challenge handler even when server auto-approves - Docker overlay: tls-init as root with chmod, Redis conditional password, console Redis TLS flags, TURNSTONE_CONSOLE_URL * feat: full mTLS end-to-end with lacme 1.0.4 Completes the mTLS chain across all services: lacme 1.0.4: - Dual EKU certs (serverAuth + clientAuth) — fixes mTLS rejection - Configurable CA name (name="turnstone") — consistent store key Bootstrap CA import: - Console imports bootstrap CA from /certs volume on first boot - Single trust root: bootstrap CA → console → all service certs Bridge mTLS: - TLSClient init when TURNSTONE_TLS_ENABLED set - Auto-upgrades server URL from http:// to https:// - SSLContext passed to all 3 httpx clients via verify= Console collector mTLS: - upgrade_tls() method replaces httpx client with mTLS context - Called in lifespan after cert issuance alongside proxy upgrade - Fixes "Failed to poll node" when server serves HTTPS Docker overlay: - TURNSTONE_TLS_SANS on all services (Docker service names as SANs) - TURNSTONE_TLS_ENABLED on bridge - Channel service with Redis TLS flags - TURNSTONE_CONSOLE_URL for service discovery - Server healthcheck disabled (mTLS healthcheck deferred) - Redis conditional password from env Verified end-to-end: bootstrap → console CA → server HTTPS → bridge mTLS → Redis TLS → channel Redis TLS → console collector polls server over mTLS → workstream creation works through bridge * fix: lint + copilot feedback on TLS Docker e2e - SIM105: contextlib.suppress(PermissionError) for chmod - F401: remove unused get_storage import in bridge - Redis healthcheck: pass password when REDIS_PASSWORD is set * fix: sort imports in admin.py and bridge.py * fix: tls-init key permissions, healthcheck env, collector race - tls-init: add set -e, chown to turnstone:turnstone with restrictive perms (keys 0600, certs 0640, dirs 0750) instead of world-readable - Redis healthcheck: use container runtime $$REDIS_PASSWORD instead of Compose-time interpolation for consistency with --requirepass block - collector upgrade_tls(): don't close old httpx client while concurrent poll threads may still be using it — let GC handle cleanup
54 lines
1.7 KiB
Docker
54 lines
1.7 KiB
Docker
# =============================================================================
|
|
# Turnstone — Docker build with uv for reproducible, locked installs
|
|
# Single image for all services: server, bridge, console, sim, eval
|
|
# =============================================================================
|
|
|
|
FROM python:3.14-slim
|
|
|
|
LABEL org.opencontainers.image.title="turnstone" \
|
|
org.opencontainers.image.description="Multi-node AI orchestration platform"
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.11.1 /uv /usr/local/bin/uv
|
|
|
|
# System dependencies for psycopg (PostgreSQL client library)
|
|
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends libpq5 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Non-root user
|
|
RUN useradd --create-home --shell /bin/bash turnstone
|
|
|
|
WORKDIR /app
|
|
|
|
# Compile bytecode for faster startup
|
|
ENV UV_COMPILE_BYTECODE=1
|
|
|
|
# Install dependencies first (cached layer — only re-runs when deps change)
|
|
COPY pyproject.toml uv.lock README.md LICENSE ./
|
|
RUN uv sync --frozen --no-install-project --no-dev \
|
|
--extra all
|
|
|
|
# Install the project itself
|
|
COPY turnstone/ turnstone/
|
|
RUN uv sync --frozen --no-dev \
|
|
--extra all
|
|
|
|
# Add venv to PATH so entry points are found
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
|
|
# Health check script (stdlib only, no pip deps needed)
|
|
COPY docker/healthcheck.py /usr/local/bin/healthcheck.py
|
|
|
|
# Entrypoint script — runs migrations before starting
|
|
COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
|
|
# Data directory — SQLite DB is created in CWD
|
|
WORKDIR /data
|
|
RUN chown turnstone:turnstone /data
|
|
|
|
USER turnstone
|
|
|
|
ENTRYPOINT ["entrypoint.sh"]
|
|
|
|
# Default command (overridden per service in compose.yaml)
|
|
CMD ["turnstone-server", "--host", "0.0.0.0", "--port", "8080"]
|