cgalo5758
bea0ffc024
Support Codex CLI as a second agent harness alongside opencode, with per-harness credential mounting, model routing, and reasoning effort handling.
55 lines
1.9 KiB
YAML
55 lines
1.9 KiB
YAML
name: member-console-audit
|
|
|
|
networks:
|
|
# Proxy reaches the internet through here.
|
|
egress:
|
|
driver: bridge
|
|
labels: { com.member-console.audit: "1" }
|
|
# Auditor lives here ONLY. `internal: true` means no route off-box except
|
|
# via a container that also sits on `egress` — i.e. the proxy. Fail-closed.
|
|
isolated:
|
|
driver: bridge
|
|
internal: true
|
|
labels: { com.member-console.audit: "1" }
|
|
|
|
services:
|
|
egress-proxy:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.proxy
|
|
image: member-console-audit-proxy:latest
|
|
networks: [egress, isolated]
|
|
volumes:
|
|
- ./tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf:ro
|
|
- ./allowlist.txt:/etc/tinyproxy/allowlist.txt:ro
|
|
labels: { com.member-console.audit: "1" }
|
|
|
|
auditor:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
image: member-console-audit:latest
|
|
# Auditor is on the isolated (internal) network only. Its sole path out is
|
|
# the proxy, addressed by name; the proxy enforces the host allowlist.
|
|
networks: [isolated]
|
|
environment:
|
|
HTTPS_PROXY: http://egress-proxy:8888
|
|
HTTP_PROXY: http://egress-proxy:8888
|
|
ALL_PROXY: http://egress-proxy:8888
|
|
NO_PROXY: localhost,127.0.0.1,egress-proxy
|
|
# Scanners must not reach for modules at run time; the cache is baked in.
|
|
GOPROXY: "off"
|
|
GOFLAGS: "-mod=mod"
|
|
volumes:
|
|
# Disposable git-archive copy — the auditor's writable working tree.
|
|
# The real repository is never mounted.
|
|
- ./.code:/src
|
|
# The only path that survives the run: the caller's findings directory.
|
|
# Every script that produces findings exports OUT; the fallback exists
|
|
# so `docker compose build` parses this file without it.
|
|
- ${OUT:-./.run/out}:/out
|
|
# No credential is mounted here. A lane adds the one file its harness
|
|
# signs in with at `run` time (harness.sh); the scanner pass gets none.
|
|
working_dir: /src
|
|
labels: { com.member-console.audit: "1" }
|