bitflicker64 commented on code in PR #3149:
URL: https://github.com/apache/hugegraph/pull/3149#discussion_r3789870293
##########
docker/README.md:
##########
@@ -168,14 +173,109 @@ To validate local images without Compose replacing them
with remote `latest`:
## 3-Node Cluster Quickstart
+The cluster and the Hubble add-on share one named Docker network so Hubble
+can attach to a running cluster without touching it. Treat that network as a
+trust boundary: only the Server layer performs real authentication. Store
+serves its control APIs with no credentials at all, and while PD's REST
+control APIs do require an `Authorization` header, PD only checks that the
+Basic-auth *user* is one of its internal service names and never validates
+the password — so any client on the network can read and drive them. Note
+that this stack depends on that behaviour: Hubble reaches PD as the service
+name `hubble` with an empty password, so tightening PD's credential check
+would also break Hubble's operations view. Any container on the host can
+also join the network by declaring the well-known name. One-time setup:
+write the required credentials to a mode-600 `docker/.env` and create the
+network.
+The cluster file requires both credentials — the admin password enables
+authentication, and every Server replica must share one token secret so a
+token issued by any server validates on all of them. The `:?` guards fire
+on every Compose subcommand, including `down`.
+
+```bash
+(
+ set -eu
+ cd docker
+ command -v openssl >/dev/null 2>&1 || { echo "openssl not found" >&2; exit
1; }
+ [ -e .env ] || install -m 600 /dev/null .env
+ chmod 600 .env
+ # Keep appends on their own lines even if the file was hand-edited.
+ [ ! -s .env ] || [ -z "$(tail -c1 .env)" ] || printf '\n' >> .env
+ pat='^[[:space:]]*(export[[:space:]]+)?'
+ if ! grep -Eq "${pat}HUGEGRAPH_ADMIN_PASSWORD=" .env; then
+ admin_password="$(openssl rand -base64 12)"
+ printf "HUGEGRAPH_ADMIN_PASSWORD='%s'\n" "${admin_password}" >> .env
+ unset admin_password
+ fi
+ if ! grep -Eq "${pat}HUGEGRAPH_AUTH_TOKEN_SECRET=" .env; then
+ token_secret="$(openssl rand -hex 32)"
+ printf "HUGEGRAPH_AUTH_TOKEN_SECRET='%s'\n" "${token_secret}" >> .env
+ unset token_secret
+ fi
+ admin_value="$(sed -nE
"s/${pat}HUGEGRAPH_ADMIN_PASSWORD='([^']*)'[[:space:]]*$/\\1/p" .env | tail
-n1)"
Review Comment:
Agreed and also in scope. The optional export group made \1 capture the
wrong text. I’ll fix the setup parser to read the value group (and keep parsing
as data, not by sourcing .env).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
