wmantly
ec4ca97af4
in-flight OAuth logins, and any admin-created API token redis-server ran with --save '' --appendonly no (deliberately ephemeral, per the original "audit/metrics/session storage" framing). That stopped being a safe assumption once API tokens (PATs) lived in this same Redis -- a PAT is supposed to be a stable, long-lived credential, not disposable session state, but every `docker rm -f jump-host` + rebuild silently invalidated every one that existed. Matches proxy's existing pattern exactly: AOF + periodic RDB persisted to $REDIS_DATA_DIR (default /data), which the deployment mounts as a volume (see the companion theta-env change). Verified against a live container: minted a real PAT, force-recreated the container (docker rm -f + rebuild), confirmed the same token still authenticates afterward. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1.4 KiB
Bash
36 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Start the theta42/jump-host all-in-one container: Redis (background) + the
|
|
# Node app (foreground, PID 2 under dumb-init so it gets SIGTERM).
|
|
set -e
|
|
|
|
info() { echo "[INFO] $*"; }
|
|
|
|
# When the unified theta-env stack (or any deployment) bind-mounts
|
|
# ./config/jump-secrets.js at /config, point CONF_SECRETS at it.
|
|
if [[ -f /config/jump-secrets.js ]]; then
|
|
export CONF_SECRETS=/config/jump-secrets.js
|
|
info "Loaded config from /config/jump-secrets.js"
|
|
fi
|
|
|
|
# Redis for audit/metrics/session AND api-token storage (app connects to
|
|
# 127.0.0.1:6379). Persisted (AOF + periodic RDB) to /data, which the
|
|
# deployment should mount as a volume -- without this, every container
|
|
# recreation silently wiped every session, in-flight OAuth login, and any
|
|
# admin-created API token, which is especially bad for the last one since a
|
|
# PAT is meant to be a stable, long-lived credential, not session state.
|
|
REDIS_DATA_DIR="${REDIS_DATA_DIR:-/data}"
|
|
mkdir -p "$REDIS_DATA_DIR"
|
|
info "Starting redis (AOF persisted to $REDIS_DATA_DIR)..."
|
|
redis-server --daemonize yes --dir "$REDIS_DATA_DIR" --appendonly yes \
|
|
--appendfilename appendonly.aof --save 900 1 --save 300 10 --save 60 10000
|
|
|
|
# Wait for redis to answer before starting the app.
|
|
for _ in $(seq 1 20); do
|
|
if redis-cli ping >/dev/null 2>&1; then break; fi
|
|
sleep 0.2
|
|
done
|
|
|
|
export NODE_ENV="${NODE_ENV:-production}"
|
|
info "Starting jump-host (SSH :${JUMP_SSH_PORT:-2222}, web :3002)..."
|
|
exec "$@"
|