44 lines
1.7 KiB
YAML
44 lines
1.7 KiB
YAML
# Disposable Node Agent identity for the M15 node-loss and re-enrollment rehearsal.
|
|
#
|
|
# Production node credentials are never revoked to prove recovery. This projection runs a second,
|
|
# throwaway Node Agent with its own persisted identity and state volume, so credential loss,
|
|
# revocation and re-enrollment can be exercised end to end without touching GPU Node.
|
|
#
|
|
# docker compose -p modelforge --env-file .env \
|
|
# -f docker-compose.node-recovery.yml up -d node-recovery-agent
|
|
services:
|
|
node-recovery-agent:
|
|
build:
|
|
context: .
|
|
dockerfile: node-agent/Dockerfile
|
|
hostname: ${MODELFORGE_RECOVERY_AGENT_HOSTNAME:-modelforge-recovery-rehearsal}
|
|
environment:
|
|
MODELFORGE_AGENT_CONTROL_PLANE_URL: ${MODELFORGE_RECOVERY_AGENT_URL:-http://api:8000}
|
|
MODELFORGE_AGENT_ENROLLMENT_TOKEN: ${MODELFORGE_RECOVERY_AGENT_TOKEN:-}
|
|
MODELFORGE_AGENT_DISPLAY_NAME: ${MODELFORGE_RECOVERY_AGENT_DISPLAY_NAME:-M15 node recovery rehearsal}
|
|
MODELFORGE_AGENT_IDENTITY_MODE: persisted
|
|
MODELFORGE_AGENT_IDENTITY_FILE: /data/state/node-id
|
|
MODELFORGE_AGENT_CREDENTIAL_FILE: /data/state/node-credential
|
|
MODELFORGE_AGENT_STATE_FILE: /data/state/agent-state.json
|
|
MODELFORGE_AGENT_TLS_VERIFY: "false"
|
|
MODELFORGE_AGENT_HEARTBEAT_INTERVAL_SECONDS: "5"
|
|
volumes:
|
|
- node-recovery-state:/data/state
|
|
- node-recovery-cache:/data/hf-cache
|
|
- node-recovery-artifacts:/data/artifacts
|
|
- node-recovery-quarantine:/data/quarantine
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=64m,mode=1777
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
restart: "no"
|
|
|
|
volumes:
|
|
node-recovery-state:
|
|
node-recovery-cache:
|
|
node-recovery-artifacts:
|
|
node-recovery-quarantine:
|