Support/runtipi-appstore
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(n8n-sandbox): secure runner HTTP endpoint

Browse Source
This commit is contained in:
Hermes Agent
2026-09-02 17:46:56 +02:00
parent 05e1056a36
commit 7df02cccdf
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
__tests__/apps.test.ts
+2
View File
@@ -74,6 +74,8 @@ describe("modern compose files preserve runtime semantics", () => {
expect(parsed['x-runtipi']?.schema_version).toBe(2) expect(parsed['x-runtipi']?.schema_version).toBe(2)
expect(parsed.services?.['sandbox-certs']?.restart).toBe('no') expect(parsed.services?.['sandbox-certs']?.restart).toBe('no')
expect(parsed.services?.['sandbox-api']?.['x-runtipi']?.is_main).toBe(true) expect(parsed.services?.['sandbox-api']?.['x-runtipi']?.is_main).toBe(true)
expect(parsed.services?.['sandbox-runner-1']?.environment?.SANDBOX_RUNNER_HTTP_BASE_URL).toBe('https://sandbox-runner-1:8080')
expect(parsed.services?.['sandbox-runner-1']?.healthcheck?.test).toContain('https://localhost:8080/readyz')
}) })
}) })
apps/n8n-sandbox/docker-compose.yml
+7 -7
View File
@@ -115,11 +115,10 @@ services:
SANDBOX_RUNNER_REGISTRATION_TOKEN: "${SANDBOX_REGISTRATION_TOKEN}" SANDBOX_RUNNER_REGISTRATION_TOKEN: "${SANDBOX_REGISTRATION_TOKEN}"
SANDBOX_RUNNER_API_GRPC_ADDR: sandbox-api:9090 SANDBOX_RUNNER_API_GRPC_ADDR: sandbox-api:9090
# http:// et non https:// : le mTLS ne couvre que le gRPC # Le listener HTTP du runner sert obligatoirement TLS avec le certificat
# (enregistrement + SandboxControl). Le trafic proxy exec/files de # SandboxControl. Son SAN sandbox-runner-1 est genere par sandbox-certs.
# l'API vers le runner reste en HTTP clair authentifie par X-Api-Key # HTTP est refuse depuis la version 1.3.0 pour ne pas exposer X-Api-Key.
# (docs/configuration.md du depot et compose officiel n8n). SANDBOX_RUNNER_HTTP_BASE_URL: https://sandbox-runner-1:8080
SANDBOX_RUNNER_HTTP_BASE_URL: http://sandbox-runner-1:8080
SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: ":9091" SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: ":9091"
SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: sandbox-runner-1:9091 SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: sandbox-runner-1:9091
@@ -148,8 +147,9 @@ services:
healthcheck: healthcheck:
# /readyz passe au vert une fois le runner enregistre aupres de l'API # /readyz passe au vert une fois le runner enregistre aupres de l'API
# (meme check que le compose du depot upstream). # Le probe local ignore uniquement la verification du certificat ; le
test: "wget -qO- http://localhost:8080/readyz" # trafic API -> runner reste verifie avec la CA et le SAN partages.
test: "wget -qO- --no-check-certificate https://localhost:8080/readyz"
interval: 5s interval: 5s
timeout: 5s timeout: 5s
retries: 24 retries: 24