mirror of
https://github.com/hanzoai/compute.git
synced 2026-10-30 14:50:41 +00:00
zooqueenandHanzo Dev
554f45454c
platformOwner named any org, and any member of that org could write a row in it, so a hanzo member's AWS row named hanzo-compute drove the hosted account: listing every tenant's instance and stopping them. The platform owner is now the one SuperAdmin predicate, owner == "admin", with the platformOwner setting removed. A row naming AWS hanzo-compute is refused for every owner, and hosted compute alone reaches that account. Co-authored-by: Hanzo Dev <[email protected]>
46 lines
2.0 KiB
Plaintext
46 lines
2.0 KiB
Plaintext
appname = hanzo-visor
|
|
httpport = 19000
|
|
runmode = dev
|
|
SessionOn = true
|
|
copyrequestbody = true
|
|
driverName = postgres
|
|
dataSourceName = ${DB_DSN||user=hanzo dbname=hanzo_visor host=localhost port=5432 sslmode=disable}
|
|
dbName = hanzo_visor
|
|
storageBackend = ${STORAGE_BACKEND||base}
|
|
dataRoot = ${DATA_ROOT||/data}
|
|
tableNamePrefix =
|
|
isDemoMode = false
|
|
logPostOnly = true
|
|
guacamoleEndpoint = 127.0.0.1:4822
|
|
iamEndpoint = https://iam.hanzo.ai
|
|
clientId = ${IAM_CLIENT_ID||}
|
|
clientSecret = ${IAM_CLIENT_SECRET||}
|
|
iamOrganization = "hanzo"
|
|
iamApplication = "app-hanzo-visor"
|
|
# The audience a forwarded bearer must carry: a token minted for this service
|
|
# (unset = clientId). A token minted for any other application is refused, and
|
|
# the tenant is the token's signed org membership, never its owner claim.
|
|
iamAudience = ${IAM_AUDIENCE||}
|
|
|
|
# Hosted compute: Hanzo's own AWS EC2 account, where every org's hosted machines
|
|
# run. Nothing here can sign an AWS request: every EC2 call goes through egress
|
|
# (egressAddress), which holds the account hanzo-compute in KMS and signs. With
|
|
# no egressAddress hosted compute refuses. Every call names what is missing
|
|
# instead of guessing: a launch needs the region, subnet and security group, and
|
|
# computeGpuImage for a GPU size or computeImage for any other. Both images are
|
|
# x86_64. In a deployment this file is the one KMS delivers to /conf/app.conf,
|
|
# with values in place; the ${VAR||} forms let a local run set them from the
|
|
# environment instead.
|
|
computeRegion = ${COMPUTE_REGION||}
|
|
computeSubnet = ${COMPUTE_SUBNET||}
|
|
computeSecurityGroup = ${COMPUTE_SECURITY_GROUP||}
|
|
computeImage = ${COMPUTE_IMAGE||}
|
|
computeGpuImage = ${COMPUTE_GPU_IMAGE||}
|
|
|
|
# Where hanzoai/egress answers (egress.hanzo.svc:9653, tcp:// or unix://), and
|
|
# the audience compute's own IAM token is minted for there (hanzo-egress). With
|
|
# an address set, every cloud call is carried and compute's IAM identity
|
|
# (clientId, clientSecret, iamEndpoint) is required.
|
|
egressAddress = ${EGRESS_ADDRESS||}
|
|
egressAudience = ${EGRESS_AUDIENCE||}
|