Skip to content

Revert PR 1: Central Auth migration #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
junaidquraishi merged 1 commit into from
Sep 27, 2026
Merged

Revert PR 1: Central Auth migration #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 38 additions & 40 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,11 @@ LOCAL_BUILD_ENV ?= BUILDX_BUILDER=default
DIND_COMPOSE_FILE ?= ops/dind/docker-compose.dind.yaml
CENTRAL_COMPOSE_FILE ?= ops/unicron/docker-compose.unicron.yaml
CENTRAL_ENV_FILE ?= ops/unicron/.env
CENTRAL_AUTH_TEST_POSTGRES_COMPOSE_FILE ?= ops/testing/docker-compose.central-auth-test-postgres.yml
CENTRAL_AUTH_TEST_POSTGRES_PORT ?= 5433
CENTRAL_AUTH_TEST_POSTGRES_USER ?= postgres
CENTRAL_AUTH_TEST_POSTGRES_PASSWORD ?= password
CENTRAL_AUTH_TEST_POSTGRES_DB ?= central_auth_test
CENTRAL_AUTH_TEST_POSTGRES_SCHEMA ?= central_auth_test
CENTRAL_AUTH_TEST_MONGO_COMPOSE_FILE ?= ops/testing/docker-compose.central-auth-test-mongo.yml
CENTRAL_AUTH_TEST_MONGO_PORT ?= 27018
CENTRAL_AUTH_TEST_MONGO_ROOT_USERNAME ?= root
CENTRAL_AUTH_TEST_MONGO_ROOT_PASSWORD ?= password
CENTRAL_AUTH_TEST_MONGODB_DB_NAME ?= central_auth_test

REGISTRY ?= localhost:5000
TAG ?= latest
Expand All @@ -24,7 +23,8 @@ RELEASE_PLATFORMS ?= linux/amd64,linux/arm64

CENTRAL_ENV_ARG = $(if $(wildcard $(CENTRAL_ENV_FILE)),--env-file $(CENTRAL_ENV_FILE),)
CENTRAL_COMPOSE = $(LOCAL_BUILD_ENV) $(COMPOSE) -f $(CENTRAL_COMPOSE_FILE) $(CENTRAL_ENV_ARG)
CENTRAL_AUTH_TEST_POSTGRES_COMPOSE = $(LOCAL_BUILD_ENV) $(COMPOSE) -f $(CENTRAL_AUTH_TEST_POSTGRES_COMPOSE_FILE)
CENTRAL_AUTH_TEST_MONGODB_URI ?= mongodb://$(CENTRAL_AUTH_TEST_MONGO_ROOT_USERNAME):$(CENTRAL_AUTH_TEST_MONGO_ROOT_PASSWORD)@127.0.0.1:$(CENTRAL_AUTH_TEST_MONGO_PORT)/?authSource=admin
CENTRAL_AUTH_TEST_MONGO_COMPOSE = $(LOCAL_BUILD_ENV) $(COMPOSE) -f $(CENTRAL_AUTH_TEST_MONGO_COMPOSE_FILE)
DIND_COMPOSE = $(LOCAL_BUILD_ENV) $(COMPOSE) -f $(DIND_COMPOSE_FILE)

OTEL_MIN_IMAGE ?= unicron-otel-min
Expand Down Expand Up @@ -71,9 +71,9 @@ APPLIANCE_NETWORK_ALIAS ?= unicron.central
central-down \
central-destroy \
central-migrate \
central-auth-test-postgres-up \
central-auth-test-postgres-down \
central-auth-test-postgres-destroy \
central-auth-test-mongo-up \
central-auth-test-mongo-down \
central-auth-test-mongo-destroy \
test-central-auth \
build-otel-min \
build-fluent-bit-min \
Expand Down Expand Up @@ -185,40 +185,38 @@ central-migrate: ## Run central backend migrations
@$(CENTRAL_COMPOSE) run --rm --no-deps backend \
python /app/backend/scripts/migrate_or_bootstrap.py

central-auth-test-postgres-up: ## Start disposable central-auth test Postgres and wait for readiness
central-auth-test-mongo-up: ## Start disposable central-auth test Mongo and wait for readiness
@echo ""
@echo "Starting central-auth test Postgres on 127.0.0.1:$(CENTRAL_AUTH_TEST_POSTGRES_PORT)..."
@CENTRAL_AUTH_TEST_POSTGRES_PORT="$(CENTRAL_AUTH_TEST_POSTGRES_PORT)" \
CENTRAL_AUTH_TEST_POSTGRES_USER="$(CENTRAL_AUTH_TEST_POSTGRES_USER)" \
CENTRAL_AUTH_TEST_POSTGRES_PASSWORD="$(CENTRAL_AUTH_TEST_POSTGRES_PASSWORD)" \
CENTRAL_AUTH_TEST_POSTGRES_DB="$(CENTRAL_AUTH_TEST_POSTGRES_DB)" \
$(CENTRAL_AUTH_TEST_POSTGRES_COMPOSE) up -d --wait --wait-timeout $(WAIT_TIMEOUT)

central-auth-test-postgres-down: ## Stop central-auth test Postgres while preserving its disposable volume
@echo "Starting central-auth test Mongo on 127.0.0.1:$(CENTRAL_AUTH_TEST_MONGO_PORT)..."
@CENTRAL_AUTH_TEST_MONGO_PORT="$(CENTRAL_AUTH_TEST_MONGO_PORT)" \
CENTRAL_AUTH_TEST_MONGO_ROOT_USERNAME="$(CENTRAL_AUTH_TEST_MONGO_ROOT_USERNAME)" \
CENTRAL_AUTH_TEST_MONGO_ROOT_PASSWORD="$(CENTRAL_AUTH_TEST_MONGO_ROOT_PASSWORD)" \
CENTRAL_AUTH_TEST_MONGODB_DB_NAME="$(CENTRAL_AUTH_TEST_MONGODB_DB_NAME)" \
$(CENTRAL_AUTH_TEST_MONGO_COMPOSE) up -d --wait --wait-timeout $(WAIT_TIMEOUT)

central-auth-test-mongo-down: ## Stop central-auth test Mongo while preserving its disposable volume
@echo ""
@CENTRAL_AUTH_TEST_POSTGRES_PORT="$(CENTRAL_AUTH_TEST_POSTGRES_PORT)" \
CENTRAL_AUTH_TEST_POSTGRES_USER="$(CENTRAL_AUTH_TEST_POSTGRES_USER)" \
CENTRAL_AUTH_TEST_POSTGRES_PASSWORD="$(CENTRAL_AUTH_TEST_POSTGRES_PASSWORD)" \
CENTRAL_AUTH_TEST_POSTGRES_DB="$(CENTRAL_AUTH_TEST_POSTGRES_DB)" \
$(CENTRAL_AUTH_TEST_POSTGRES_COMPOSE) down --remove-orphans || true

central-auth-test-postgres-destroy: ## Destructively remove central-auth test Postgres and its disposable volume
@echo "Stopping central-auth test Mongo..."
@CENTRAL_AUTH_TEST_MONGO_PORT="$(CENTRAL_AUTH_TEST_MONGO_PORT)" \
CENTRAL_AUTH_TEST_MONGO_ROOT_USERNAME="$(CENTRAL_AUTH_TEST_MONGO_ROOT_USERNAME)" \
CENTRAL_AUTH_TEST_MONGO_ROOT_PASSWORD="$(CENTRAL_AUTH_TEST_MONGO_ROOT_PASSWORD)" \
CENTRAL_AUTH_TEST_MONGODB_DB_NAME="$(CENTRAL_AUTH_TEST_MONGODB_DB_NAME)" \
$(CENTRAL_AUTH_TEST_MONGO_COMPOSE) down --remove-orphans || true

central-auth-test-mongo-destroy: ## Destructively remove central-auth test Mongo and its disposable volume
@echo ""
@CENTRAL_AUTH_TEST_POSTGRES_PORT="$(CENTRAL_AUTH_TEST_POSTGRES_PORT)" \
CENTRAL_AUTH_TEST_POSTGRES_USER="$(CENTRAL_AUTH_TEST_POSTGRES_USER)" \
CENTRAL_AUTH_TEST_POSTGRES_PASSWORD="$(CENTRAL_AUTH_TEST_POSTGRES_PASSWORD)" \
CENTRAL_AUTH_TEST_POSTGRES_DB="$(CENTRAL_AUTH_TEST_POSTGRES_DB)" \
$(CENTRAL_AUTH_TEST_POSTGRES_COMPOSE) down -v --remove-orphans || true

test-central-auth: central-auth-test-postgres-up ## Run central-auth unit and integration tests against disposable Postgres
@echo "Destroying central-auth test Mongo and volume..."
@CENTRAL_AUTH_TEST_MONGO_PORT="$(CENTRAL_AUTH_TEST_MONGO_PORT)" \
CENTRAL_AUTH_TEST_MONGO_ROOT_USERNAME="$(CENTRAL_AUTH_TEST_MONGO_ROOT_USERNAME)" \
CENTRAL_AUTH_TEST_MONGO_ROOT_PASSWORD="$(CENTRAL_AUTH_TEST_MONGO_ROOT_PASSWORD)" \
CENTRAL_AUTH_TEST_MONGODB_DB_NAME="$(CENTRAL_AUTH_TEST_MONGODB_DB_NAME)" \
$(CENTRAL_AUTH_TEST_MONGO_COMPOSE) down -v --remove-orphans || true

test-central-auth: central-auth-test-mongo-up ## Run central-auth unit and integration tests against disposable Mongo
@echo ""
@echo "Running central-auth tests against Postgres on 127.0.0.1:$(CENTRAL_AUTH_TEST_POSTGRES_PORT)"
@CENTRAL_AUTH_TEST_POSTGRES_HOST="127.0.0.1" \
CENTRAL_AUTH_TEST_POSTGRES_PORT="$(CENTRAL_AUTH_TEST_POSTGRES_PORT)" \
CENTRAL_AUTH_TEST_POSTGRES_USER="$(CENTRAL_AUTH_TEST_POSTGRES_USER)" \
CENTRAL_AUTH_TEST_POSTGRES_PASSWORD="$(CENTRAL_AUTH_TEST_POSTGRES_PASSWORD)" \
CENTRAL_AUTH_TEST_POSTGRES_DB="$(CENTRAL_AUTH_TEST_POSTGRES_DB)" \
CENTRAL_AUTH_TEST_POSTGRES_SCHEMA="$(CENTRAL_AUTH_TEST_POSTGRES_SCHEMA)" \
@echo "Running central-auth tests against $(CENTRAL_AUTH_TEST_MONGODB_URI)"
@CENTRAL_AUTH_TEST_MONGODB_URI="$(CENTRAL_AUTH_TEST_MONGODB_URI)" \
CENTRAL_AUTH_TEST_MONGODB_DB_NAME="$(CENTRAL_AUTH_TEST_MONGODB_DB_NAME)" \
npm --prefix central/auth run test:all

define docker_build_only
Expand Down
27 changes: 1 addition & 26 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,8 @@ docker compose -f deploy/standalone/docker-compose.yml up -d
- Single-image appliance runtime for standalone deployment.
- Local administrator auth with explicit recovery mode.
- Central backend, React frontend, alert engine, notifier API, and notifier worker.
- Postgres, Redis, Step CA/RA, Traefik, VictoriaMetrics, VictoriaLogs,
- Postgres, MongoDB, Redis, Step CA/RA, Traefik, VictoriaMetrics, VictoriaLogs,
and OTel collector inside the appliance.
- Automatic migration of Central Auth data from older MongoDB-backed appliance volumes.
- Agent enrollment through tokens and mTLS identity.
- Browser and API ingress under `/unicron`.
- Agent mTLS and OTLP ingress on port `8443`.
Expand All @@ -65,22 +64,6 @@ docker compose -f deploy/standalone/docker-compose.yml up -d

## Development

### Upgrading Multi-container Auth

Compose retains `unicron-central-auth-mongo-data` and imports the existing login
before creating a new administrator. Keep the old `CENTRAL_AUTH_MONGO_ROOT_USERNAME`,
`CENTRAL_AUTH_MONGO_ROOT_PASSWORD`, and `CENTRAL_AUTH_MONGODB_DB_NAME` settings.
Back up both databases before upgrading. Missing legacy users, missing passwords,
or conflicting PostgreSQL and MongoDB accounts stop startup rather than replacing
the login. Restore the missing data or correct the connection settings before retrying.

Fresh installs never start MongoDB. After migration, restarting the legacy helper
leaves it idle; it no longer needs a MongoDB-compatible CPU. The first migration
of an old database still requires a compatible CPU. Keep the new
`unicron-central-auth-migration` volume with PostgreSQL when backing up or restoring.

### Local Checks

Useful commands:

```sh
Expand All @@ -105,14 +88,6 @@ make test-central-auth
(cd central/unicron/backend && poetry run python -m unittest tests.test_security_hardening tests.test_origin_policy tests.test_appliance_update)
```

Test the production multi-container auth wiring with isolated containers and
volumes (including real legacy password migration and failure cases):

```sh
docker build -f central/auth/Dockerfile -t unicron-central-auth:local-test .
python3 ops/testing/test-central-auth-compose.py unicron-central-auth:local-test
```

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md).
Expand Down
14 changes: 6 additions & 8 deletions central/auth/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,14 +13,12 @@ HEADERS_TIMEOUT_MS=35000
KEEPALIVE_TIMEOUT_MS=5000
SHUTDOWN_DRAIN_MS=5000

POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_DB=unicron
CENTRAL_AUTH_POSTGRES_SCHEMA=central_auth
POSTGRES_MAX_POOL_SIZE=10
POSTGRES_SSL=false
MONGODB_URI=mongodb://root:password@mongodb:27017/?authSource=admin
MONGODB_DB_NAME=UnicronCentralAuthDev
MONGODB_MIN_POOL_SIZE=0
MONGODB_MAX_POOL_SIZE=10
MONGODB_TLS=true
MONGODB_RETRY_WRITES=true

CENTRAL_AUTH_SECRET=changeme-central-auth-secret-min-32-chars
CENTRAL_AUTH_BASE_URL=http://localhost:3020
Expand Down
Loading
Loading