SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Document Synology Authentik deploy guardrails

Browse Source
This commit is contained in:
Codex
2026-05-23 20:41:05 +03:00
parent 8be632a07e
commit 8c8a5b5975
3 changed files with 62 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/CURRENT_INFRA_HANDOFF.md
+18
View File
@@ -263,6 +263,23 @@ The script does not overwrite live secret files:
/volume1/docker/nodedc-platform/ops-agents/.env
```
Launcher must use the platform Authentik alias for internal API sync:
```env
NODEDC_AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
```
Do not use `http://authentik-server:9000` in Launcher env after attaching Launcher to the Engine Docker network. The Engine stack also has an `authentik-server` service name, so Docker DNS can resolve the name to the wrong Authentik and valid platform tokens will fail with `403 Token invalid/expired`.
The platform Authentik service exposes a stable identity-network alias in the Synology compose:
```text
nodedc-platform-authentik-server
```
When changing this alias or Authentik env wiring, recreate `authentik-server`, `authentik-worker`, and `launcher` together. A freshly recreated Authentik server can temporarily return `503 Service Unavailable` until the worker/bootstrap path is ready, so verify with retry from inside the launcher container.
Launcher image build is done from the Launcher repo when frontend/backend code changes:
```bash
@@ -393,6 +410,7 @@ Never run docker compose down -v on production/staging data.
Never delete nodedc-tasker_* volumes without a verified backup.
Never use docker system prune blindly on the NAS.
Never commit .env.synology or real secrets.
Never deploy Launcher with NODEDC_AUTHENTIK_BASE_URL=http://authentik-server:9000 on NAS.
```
## Local development model
docs/SECURITY_CHECKLIST.md
+1
View File
@@ -27,6 +27,7 @@ Service catalog UX rules: `docs/SERVICE_CATALOG_UX_RULES.md`.
- [ ] Authentik service token хранится только server-side.
- [ ] Frontend не получает service token.
- [ ] Synology Launcher использует platform Authentik alias `http://nodedc-platform-authentik-server:9000`, не неоднозначный `http://authentik-server:9000`.
- [ ] Admin endpoints требуют `nodedc:superadmin` или `nodedc:launcher:admin`.
- [ ] Все admin actions пишутся в audit log.
- [ ] Удаление пользователя реализовано как deactivate/disable, не hard delete.