From 7df02cccdffb9d58dfe1ec674c853ec7750481dc Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Wed, 2 Sep 2026 17:46:56 +0200 Subject: [PATCH] fix(n8n-sandbox): secure runner HTTP endpoint --- __tests__/apps.test.ts | 2 ++ apps/n8n-sandbox/docker-compose.yml | 14 +++++++------- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/__tests__/apps.test.ts b/__tests__/apps.test.ts index 0f92ed1..2fd2da9 100644 --- a/__tests__/apps.test.ts +++ b/__tests__/apps.test.ts @@ -74,6 +74,8 @@ describe("modern compose files preserve runtime semantics", () => { expect(parsed['x-runtipi']?.schema_version).toBe(2) expect(parsed.services?.['sandbox-certs']?.restart).toBe('no') expect(parsed.services?.['sandbox-api']?.['x-runtipi']?.is_main).toBe(true) + expect(parsed.services?.['sandbox-runner-1']?.environment?.SANDBOX_RUNNER_HTTP_BASE_URL).toBe('https://sandbox-runner-1:8080') + expect(parsed.services?.['sandbox-runner-1']?.healthcheck?.test).toContain('https://localhost:8080/readyz') }) }) diff --git a/apps/n8n-sandbox/docker-compose.yml b/apps/n8n-sandbox/docker-compose.yml index 9992c1c..d5b58d6 100644 --- a/apps/n8n-sandbox/docker-compose.yml +++ b/apps/n8n-sandbox/docker-compose.yml @@ -115,11 +115,10 @@ services: SANDBOX_RUNNER_REGISTRATION_TOKEN: "${SANDBOX_REGISTRATION_TOKEN}" SANDBOX_RUNNER_API_GRPC_ADDR: sandbox-api:9090 - # http:// et non https:// : le mTLS ne couvre que le gRPC - # (enregistrement + SandboxControl). Le trafic proxy exec/files de - # l'API vers le runner reste en HTTP clair authentifie par X-Api-Key - # (docs/configuration.md du depot et compose officiel n8n). - SANDBOX_RUNNER_HTTP_BASE_URL: http://sandbox-runner-1:8080 + # Le listener HTTP du runner sert obligatoirement TLS avec le certificat + # SandboxControl. Son SAN sandbox-runner-1 est genere par sandbox-certs. + # HTTP est refuse depuis la version 1.3.0 pour ne pas exposer X-Api-Key. + SANDBOX_RUNNER_HTTP_BASE_URL: https://sandbox-runner-1:8080 SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: ":9091" SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: sandbox-runner-1:9091 @@ -148,8 +147,9 @@ services: healthcheck: # /readyz passe au vert une fois le runner enregistre aupres de l'API - # (meme check que le compose du depot upstream). - test: "wget -qO- http://localhost:8080/readyz" + # Le probe local ignore uniquement la verification du certificat ; le + # trafic API -> runner reste verifie avec la CA et le SAN partages. + test: "wget -qO- --no-check-certificate https://localhost:8080/readyz" interval: 5s timeout: 5s retries: 24