mirror of
https://github.com/axieyangb/aegis.git
synced 2026-09-09 17:25:39 +00:00
Jerry Xie
c1d77eb738
The installer asks about a dozen settings and there was nowhere to read what any of them mean. docs/configuration.md documents every one — installer prompts, hub environment variables and ports — with defaults, what breaks if the value is wrong, and worked examples. The installer now links to it, both before the first question and after the install finishes. The compose file also shipped AGENT_HOST, which the hub renamed to HUB_EXTERNAL_HOST: still honoured, but it logs a deprecation on every boot, so the file everyone copies was teaching the old name and guaranteeing the warning. Both names are documented; the installer writes whichever key the compose file actually contains, so an older file or a pinned fork keeps working. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UC1bwEPiq5ytX7VXap8cDK
56 lines
2.0 KiB
YAML
56 lines
2.0 KiB
YAML
services:
|
|
aegis:
|
|
image: axieyangb/aegis:latest
|
|
container_name: aegis
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8765:8765" # UI + API
|
|
# Agents dial IN to this port over mTLS. Without it published, a node can
|
|
# be issued a join token and will never be able to use it — the one-line
|
|
# installer completes and the node never appears. Only needed if you are
|
|
# enrolling machines; a single-host gateway install can drop it.
|
|
- "8766:8766" # agent control channel (mTLS)
|
|
# Overlay mesh. Needed for nodes that are not on this LAN; harmless if
|
|
# unused. UDP, and both are required — STUN discovers the path, WireGuard
|
|
# carries the traffic.
|
|
- "3478:3478/udp" # STUN — NAT traversal
|
|
- "51820:51820/udp" # WireGuard overlay
|
|
volumes:
|
|
- aegis_data:/data
|
|
environment:
|
|
- ADMIN_USERNAME=admin
|
|
- ADMIN_PASSWORD=changeme # change this
|
|
- AUTH_ENABLED=true
|
|
- BLOCK_ENABLED=true
|
|
- NODE_ID=home
|
|
# The address agents should dial back on. Leave blank for a gateway-only
|
|
# install; set it to a hostname or IP the nodes can actually reach before
|
|
# enrolling anything, or the token will carry an address that does not
|
|
# resolve from the node.
|
|
#
|
|
# Was AGENT_HOST, which still works but logs a deprecation on every boot.
|
|
# See docs/configuration.md for this and every other setting.
|
|
- HUB_EXTERNAL_HOST=
|
|
|
|
envoy:
|
|
image: envoyproxy/envoy:v1.35-latest
|
|
container_name: envoy
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- aegis
|
|
ports:
|
|
- "80:10080" # HTTP — listeners in Aegis UI should bind to port 10080
|
|
- "443:10443" # HTTPS — listeners in Aegis UI should bind to port 10443
|
|
- "9901:9901" # Envoy admin UI
|
|
volumes:
|
|
- ./envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro
|
|
command:
|
|
- /usr/local/bin/envoy
|
|
- -c
|
|
- /etc/envoy/envoy.yaml
|
|
- --log-level
|
|
- warn
|
|
|
|
volumes:
|
|
aegis_data:
|