mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 16:01:30 +00:00
shankar0123
efea4d0e03
The bundled `docker-compose.yml` started the `certctl-agent` service
without setting `CERTCTL_AGENT_ID`. `cmd/agent/main.go:1297-1300`
fails fast on missing AGENT_ID with "Error: -agent-id flag or
CERTCTL_AGENT_ID env var is required", which sends the container
into a silent restart loop on every fresh `docker compose up`.
Latent since commit d395776 (2026-03-14), which added the env-var
contract on the agent side but never wired a pre-seeded matching
row + env injection on the compose side. The integration test
compose (`docker-compose.test.yml`) does set CERTCTL_AGENT_ID +
seed agent-test-01 via seed_test.sql, which is why CI didn't
surface the bug. Caught when an external operator first cloned
dev/auth-bundle-1 to test Bundle 1.
Closure mirrors the integration-test pattern:
* migrations/seed_demo.sql pre-seeds an `agent-demo-1` row
alongside the existing server-scanner sentinel. ON CONFLICT
(id) DO NOTHING preserves idempotency. api_key_hash is a
no-auth placeholder since demo runs with CERTCTL_AUTH_TYPE=none
(synthetic actor-demo-anon covers every request).
* deploy/docker-compose.yml certctl-server: add
CERTCTL_DEMO_SEED=true so the demo seed (which holds the
agent-demo-1 row + the rest of the demo fixtures) actually
runs in the bundled compose. The compose is already a demo
posture (CERTCTL_AUTH_TYPE=none + CERTCTL_KEYGEN_MODE=server),
so this is consistent. docker-compose.demo.yml still works
(it sets the same flag) and stays for backward compat.
* deploy/docker-compose.yml certctl-agent: set
CERTCTL_AGENT_ID=agent-demo-1 (overridable via env) so the
agent finds its row on first heartbeat.
* Makefile qa-stats: agents-table count bumped 12 -> 13.
Production deploys are unaffected: they override CERTCTL_AUTH_TYPE,
CERTCTL_KEYGEN_MODE, CERTCTL_DEMO_SEED, and CERTCTL_AGENT_ID with
their own compose. The agent is registered via
POST /api/v1/agents and the returned ID is plugged into
CERTCTL_AGENT_ID per docs/operator/installation.md.
Verified path: `docker compose -f deploy/docker-compose.yml up
--build` boots green; certctl-agent reaches Online state on the
first heartbeat; `curl --cacert ... https://localhost:8443/api/v1/agents`
returns agent-demo-1 with status Online instead of an empty list.