Sharang ParnerkarandClaude Fable 5
32b0435738
CI / Check (pull_request) Successful in 5m40s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
Closes the gap between "endpoints exist" and "a runner can actually run a job":
- POST /api/v1/werkbank/jobs/enqueue {tenant, target_id} — the control-plane
"enqueue" half: extract the target's control-logic program, stash the source as
a content-addressed blob, and queue a plc-provision job referencing it by hash.
- GET /api/v1/werkbank/artifacts/{hash} — serve a blob so the runner can fetch
the program (traversal-safe: the hash is validated). Both runner-token gated.
- blob.rs: store_bytes / read_blob helpers; ingest::blob is now pub(crate).
- .env.example documents WERKBANK_RUNNER_TOKEN.
With the runner-side auth + blob fetch (werkbank repo), the loop runs end to end:
enqueue -> lease -> Docker executor fetches the program by hash, provisions,
probes, DASTs -> completes -> findings persisted against the target.
Tests: a new integration test enqueues from a PlcSps target, confirms the job
carries a program blob, and serves it back. All 4 werkbank_api tests pass; clippy
+ fmt clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
72 lines
1.9 KiB
Bash
72 lines
1.9 KiB
Bash
# MongoDB
|
|
MONGODB_URI=mongodb://root:example@localhost:27017/compliance_scanner?authSource=admin
|
|
MONGODB_DATABASE=compliance_scanner
|
|
|
|
# LiteLLM
|
|
LITELLM_URL=http://localhost:4000
|
|
LITELLM_API_KEY=
|
|
LITELLM_MODEL=gpt-4o
|
|
|
|
# GitHub
|
|
GITHUB_TOKEN=
|
|
GITHUB_WEBHOOK_SECRET=
|
|
|
|
# GitLab
|
|
GITLAB_URL=https://gitlab.com
|
|
GITLAB_TOKEN=
|
|
GITLAB_WEBHOOK_SECRET=
|
|
|
|
# Jira
|
|
JIRA_URL=https://your-org.atlassian.net
|
|
JIRA_EMAIL=
|
|
JIRA_API_TOKEN=
|
|
JIRA_PROJECT_KEY=
|
|
|
|
# SearXNG
|
|
SEARXNG_URL=http://localhost:8888
|
|
|
|
# NVD
|
|
NVD_API_KEY=
|
|
|
|
# Agent
|
|
AGENT_PORT=3001
|
|
SCAN_SCHEDULE=0 0 */6 * * *
|
|
CVE_MONITOR_SCHEDULE=0 0 0 * * *
|
|
GIT_CLONE_BASE_PATH=/tmp/compliance-scanner/repos
|
|
|
|
# Dynamic PLC testing — ephemeral soft-PLC provisioning (#183). Off unless
|
|
# enabled; requires the agent container to have Docker access (socket mount).
|
|
# When on, a PLC/SPS target with control logic but no reachable device gets its
|
|
# logic instantiated on a throwaway OpenPLC, probed, then torn down.
|
|
PLC_RUNTIME_ENABLED=0
|
|
PLC_RUNTIME_IMAGE=registry.meghsakha.com/openplc:latest
|
|
PLC_RUNTIME_NETWORK=certifai
|
|
PLC_RUNTIME_MEMORY=512m
|
|
PLC_RUNTIME_CPUS=0.5
|
|
PLC_RUNTIME_MAX_LIFETIME_SECS=180
|
|
PLC_RUNTIME_OPENPLC_USER=openplc
|
|
PLC_RUNTIME_OPENPLC_PASSWORD=openplc
|
|
|
|
# Werkbank runner API (/api/v1/werkbank/jobs/*, /api/v1/werkbank/artifacts/*).
|
|
# When set, mounts the runner-facing queue + artifact endpoints behind this
|
|
# bearer token; runners present the same token. Unset = endpoints not mounted.
|
|
WERKBANK_RUNNER_TOKEN=
|
|
|
|
# Dashboard
|
|
DASHBOARD_PORT=8080
|
|
AGENT_API_URL=http://localhost:3001
|
|
|
|
# MCP Server
|
|
MCP_ENDPOINT_URL=http://localhost:8090
|
|
|
|
# Keycloak (required for authentication)
|
|
KEYCLOAK_URL=http://localhost:8080
|
|
KEYCLOAK_REALM=compliance
|
|
KEYCLOAK_CLIENT_ID=compliance-dashboard
|
|
REDIRECT_URI=http://localhost:8080/auth/callback
|
|
APP_URL=http://localhost:8080
|
|
|
|
# OpenTelemetry (optional - omit to disable)
|
|
# OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
|
|
# OTEL_SERVICE_NAME=compliance-agent
|