Handle the case when vault metadata is not present#101
Handle the case when vault metadata is not present#101
Conversation
``` /usr/bin/fetch-config.sh: 136: export: Illegal option -f ```
Fix error in fetch-config.sh
alexhulbert
left a comment
alexhulbert
left a comment
There was a problem hiding this comment.
I'm worried about the implications of allowing ssh to run if firewall falls. what's the purpose of that change?
| if [ -n "$CONFIG_SIMULATOR_IP" ]; then | ||
| accept_dst_ip_port $CHAIN_PRODUCTION_OUT tcp "$CONFIG_SIMULATOR_IP" $SIMULATOR_RPC_PORT "Simulator RPC (sendBackrun)" | ||
| accept_dst_ip_port $CHAIN_PRODUCTION_OUT tcp "$CONFIG_SIMULATOR_IP" $SIMULATOR_WS_PORT "Simulator WebSocket (tx stream)" | ||
| fi |
There was a problem hiding this comment.
I recall I didn't add this check explicitly because the image startup should fail critically if those endpoints were not configured/served correctly upon boot-up process.
My only concern here is that, in this case here the image will boot and suppress the issue in case those endpoints weren't fetched and set correctly. Hence, the image won't function correctly after a searcher has setup everything and trying to connect to those endpoints in production mode
| Requires=wait-for-key.service searcher-firewall.service | ||
| Requires=wait-for-key.service | ||
| Wants=searcher-firewall.service |
There was a problem hiding this comment.
Can you explain the rational behind this change? what is the scenario causing this to be locked out?
To my knowledge, this is the execution flow:
- Image boots (in maintenance mode) and fetches the configuration that includes secrets and firewall configs.
- searcher-firewall service triggers and sets up the correct firewall rules with the correctly configured IPtables
- Simultaneously, the wait-for-key service is expecting the operator to server the user's (searcher) ssh pubkey through
curlcommand to be set and allow the ssh command control panel to be ready for the searcher only. - dropbear service starts and searcher can executes ssh commands like initialize, toggle, log, etc...
4 participants
Uh oh!
There was an error while loading. Please reload this page.