mirror of
https://github.com/axieyangb/aegis.git
synced 2026-09-10 01:35:40 +00:00
Yang Yang Xie
a92bbcd782
The README was written when Aegis was a monitoring and gateway tool, and it has been describing that product for three months while the thing itself grew into a platform. The headline still read "Self-hosted Envoy gateway · AI threat analysis · TLS automation · Real-time dashboard" — all true, all now one subsystem of several, and none of it the reason someone would choose this. README now leads with what it is: one control plane from the bare metal up, air-gapped by default, with the customer's model weights staying on the customer's storage. The gateway keeps its place; it just stops being the whole story. A note records the scope change rather than pretending the old framing never existed. ROADMAP is rewritten, not amended. It listed a container manager, a Docker registry, an embedded DNS server and AI-driven deployment orchestration as future phases — all four shipped. A roadmap that describes delivered features as upcoming undersells the product to exactly the reader who bothered to open it. It is now built / next / then, matching the private status doc so the two cannot drift. CHANGELOG gains 1.3, covering three months: bare-metal provisioning, the Kubernetes lifecycle with air-gapped installs validated live, Depot with pluggable storage backends and reference-only artifacts, GPU-aware workloads, Owl's risk-classified tool surface, and the auth middleware rewrite that replaced a method-blind public-route match. FIXED A BROKEN QUICKSTART, which is the part that mattered most. The published docker-compose.yml exposes only 8765, while agents dial in on 8766 and the overlay needs 3478/udp and 51820/udp. Anyone following the new one-line enrolment instructions would have watched the installer succeed and the node never appear. Both ports are now published with comments explaining when they are needed, and AGENT_HOST is present with a note that it must be set to something the nodes can actually resolve before enrolling any. Every internal link in README and ROADMAP verified to resolve; compose file validated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B9dzsPuPpFbdgCuUDgsG8L
53 lines
1.8 KiB
YAML
53 lines
1.8 KiB
YAML
services:
|
|
aegis:
|
|
image: axieyangb/aegis:latest
|
|
container_name: aegis
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8765:8765" # UI + API
|
|
# Agents dial IN to this port over mTLS. Without it published, a node can
|
|
# be issued a join token and will never be able to use it — the one-line
|
|
# installer completes and the node never appears. Only needed if you are
|
|
# enrolling machines; a single-host gateway install can drop it.
|
|
- "8766:8766" # agent control channel (mTLS)
|
|
# Overlay mesh. Needed for nodes that are not on this LAN; harmless if
|
|
# unused. UDP, and both are required — STUN discovers the path, WireGuard
|
|
# carries the traffic.
|
|
- "3478:3478/udp" # STUN — NAT traversal
|
|
- "51820:51820/udp" # WireGuard overlay
|
|
volumes:
|
|
- aegis_data:/data
|
|
environment:
|
|
- ADMIN_USERNAME=admin
|
|
- ADMIN_PASSWORD=changeme # change this
|
|
- AUTH_ENABLED=true
|
|
- BLOCK_ENABLED=true
|
|
- NODE_ID=home
|
|
# The address agents should dial back on. Leave blank for a gateway-only
|
|
# install; set it to a hostname or IP the nodes can actually reach before
|
|
# enrolling anything, or the token will carry an address that does not
|
|
# resolve from the node.
|
|
- AGENT_HOST=
|
|
|
|
envoy:
|
|
image: envoyproxy/envoy:v1.35-latest
|
|
container_name: envoy
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- aegis
|
|
ports:
|
|
- "80:10080" # HTTP — listeners in Aegis UI should bind to port 10080
|
|
- "443:10443" # HTTPS — listeners in Aegis UI should bind to port 10443
|
|
- "9901:9901" # Envoy admin UI
|
|
volumes:
|
|
- ./envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro
|
|
command:
|
|
- /usr/local/bin/envoy
|
|
- -c
|
|
- /etc/envoy/envoy.yaml
|
|
- --log-level
|
|
- warn
|
|
|
|
volumes:
|
|
aegis_data:
|