SILVER/NODEDC_DESIGN_GUIDELINE
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(foundry): add managed data consumers and agent settings

Browse Source
This commit is contained in:
Codex
2026-07-19 15:03:54 +03:00
parent 5f583caa05
commit aac44d057f
35 changed files with 4534 additions and 243 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/docker-compose.module-foundry.yml
+17
View File
@@ -17,6 +17,10 @@ services:
NODEDC_LAUNCHER_BASE_URL: ${NODEDC_LAUNCHER_BASE_URL:?set NODEDC_LAUNCHER_BASE_URL in .env}
NODEDC_LAUNCHER_INTERNAL_URL: ${NODEDC_LAUNCHER_INTERNAL_URL:?set NODEDC_LAUNCHER_INTERNAL_URL in .env}
NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:?set the existing NODE.DC internal access value in .env}
# Ontology remains an internal read-only MCP. The external Codex receives
# a separate nodedc_ontology entry whose traffic is authenticated by the
# Foundry agent gateway and forwarded with the server-only platform token.
NODEDC_ONTOLOGY_CORE_URL: ${NODEDC_ONTOLOGY_CORE_URL:-http://ontology-core:18104}
# Runner-owned file mount. The secret signs private Gateway requests but
# never becomes a Foundry env value or browser-visible setting.
NODEDC_MAP_GATEWAY_ADMIN_SECRET_FILE: /run/nodedc-secrets/map-gateway-admin-secret
@@ -27,6 +31,13 @@ services:
# its own opaque reader grant from the read-only directory below.
NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL: ${NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL:-http://external-data-plane:18106}
NODEDC_EXTERNAL_DATA_PLANE_READER_GRANTS_DIR: /run/nodedc-secrets/external-data-plane-reader-grants
# Foundry has a separate managed-provisioner identity. The private key
# signs digest-only reader-grant plan/ensure requests and is never used
# by Engine, n8n, a browser, MCP input or application state.
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_PRIVATE_KEY_FILE: /run/nodedc-secrets/foundry-edp-managed-provisioner/private-key.pem
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_SERVICE_ID: ${NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_SERVICE_ID:-nodedc-module-foundry}
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_KEY_ID: ${NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_KEY_ID:-foundry-edp-managed-provisioner-v1}
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_AUDIENCE: ${NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_AUDIENCE:-nodedc-external-data-plane.managed-provisioning.v1}
# Long-lived L2 credentials are separate revocable workload grants. The
# directory contains only hashed grant records; opaque values stay in
# Engine credentials and never enter Foundry env or application state.
@@ -52,6 +63,12 @@ services:
read_only: true
bind:
create_host_path: false
- type: bind
source: /volume1/docker/nodedc-platform/secrets/foundry-edp-managed-provisioner/private-key.pem
target: /run/nodedc-secrets/foundry-edp-managed-provisioner/private-key.pem
read_only: true
bind:
create_host_path: false
networks:
- platform-engine
healthcheck: