starred/warmbly
1
0
Fork 0
mirror of https://github.com/warmbly/warmbly.git synced 2026-09-12 16:04:25 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
a04d5d98e449932d050a7fa89f7b34003d29804d
warmbly/deploy/split-cloud
T
History
Matthew Meszaros 510ee692ba feat: address the review on the split-deployment branch by moving the two broker routes onto their own NODE_BROKER_TOKEN so the internet-facing tracking and forms services no longer hold a credential that can open any organization's data key, refusing to presign any key outside the prefixes a node reaches, fixing IAM policies that named an alias ARN KMS never resolves in a Resource element, bounding both brokered HTTP clients because the sync loop's context never expires, no longer reporting a 403 from the object store as a missing body, and redacting the DSN and URL credentials the dry-run listing printed in clear
2026-09-10 14:19:53 +02:00
..
bus
feat: address the review on the split-deployment branch by moving the two broker routes onto their own NODE_BROKER_TOKEN so the internet-facing tracking and forms services no longer hold a credential that can open any organization's data key, refusing to presign any key outside the prefixes a node reaches, fixing IAM policies that named an alias ARN KMS never resolves in a Resource element, bounding both brokered HTTP clients because the sync loop's context never expires, no longer reporting a 403 from the object store as a missing body, and redacting the DSN and URL credentials the dry-run listing printed in clear
2026-09-10 14:19:53 +02:00
node
feat: address the review on the split-deployment branch by moving the two broker routes onto their own NODE_BROKER_TOKEN so the internet-facing tracking and forms services no longer hold a credential that can open any organization's data key, refusing to presign any key outside the prefixes a node reaches, fixing IAM policies that named an alias ARN KMS never resolves in a Resource element, bounding both brokered HTTP clients because the sync loop's context never expires, no longer reporting a 403 from the object store as a missing body, and redacting the DSN and URL credentials the dry-run listing printed in clear
2026-09-10 14:19:53 +02:00
control-plane.env.example
feat: address the review on the split-deployment branch by moving the two broker routes onto their own NODE_BROKER_TOKEN so the internet-facing tracking and forms services no longer hold a credential that can open any organization's data key, refusing to presign any key outside the prefixes a node reaches, fixing IAM policies that named an alias ARN KMS never resolves in a Resource element, bounding both brokered HTTP clients because the sync loop's context never expires, no longer reporting a 403 from the object store as a missing body, and redacting the DSN and URL credentials the dry-run listing printed in clear
2026-09-10 14:19:53 +02:00
README.md
feat: make a split deployment work end to end by fixing the three defects that made an off-host node impossible to configure (nodeEnvKeys shipped S3_BUCKET and KMS_KEY_ID, which nothing reads, so an AWS-backed node silently used the default bucket and key alias; a joined consumer never received PRIMARY_DB and died at boot; and node.env was rewritten on every join with no file an operator could add to), then removing the need for cloud credentials on a node at all with brokered KMS and blob providers that renderNodeEnv hands out automatically, plus deploy/split-cloud, scripts/aws-bootstrap.sh, two fleet instance checks and the docs
2026-09-10 13:58:59 +02:00

README.md

Split deployment

The control plane on a container host, the fleet on machines you own, and the database, root key and object store in a cloud region next to the control plane. Three providers, one instance.

container host          your machines           cloud region
──────────────          ─────────────           ────────────
backend                 worker                  Postgres
consumer                worker                  KMS key
realtime                nats + redis            S3 bucket
tracking                                        SES
forms
web / admin

The full walkthrough, with costs and the order to build it in, is Split deployment.

What is here

Path What it is
control-plane.env.example Every setting the container host needs, annotated
bus/docker-compose.yml NATS JetStream and Redis, both over TLS
bus/nats.conf The bus config the compose file mounts
bus/certbot-deploy-hook.sh Publishes renewed certificates where the containers can read them
node/docker-compose.yml A worker run by hand, for the version-controlled path
node/worker.env.example What a worker needs, and what it deliberately does not
../../scripts/aws-bootstrap.sh The KMS key, bucket, database and IAM policies

Two things that are not optional

Redis over TLS. The cache holds each organization's decrypted data key for the life of its entry. A plaintext connection across the internet publishes key material, and a password does not change that.

S3 rather than filesystem blobs. A worker reads the message body the backend wrote. On another machine it has neither the disk nor the permissions, so sends fail at the last step with everything else looking healthy.

What a node does not get

A joining node is handed KMS_PROVIDER=brokered and BLOB_PROVIDER=brokered rather than the control plane's own AWS providers, so no machine in the fleet carries a cloud credential. It opens sealed keys and signs blob operations through the internal API, with the instance-scoped token it already holds. Blob bytes still travel directly between the node and the object store.

A worker also never receives PRIMARY_DB. A consumer does, because it is control plane and updates relational state itself.

Reference in New Issue View Git Blame Copy Permalink