36 lines
1.2 KiB
Markdown
36 lines
1.2 KiB
Markdown
# TAPM Deployment Access
|
|
|
|
TAPM Deployment Access is a short-lived authorization broker for protected
|
|
deployment packages and installer actions. Technicians authenticate with
|
|
Gitea, create a deployment code, and permit a limited number of hosts to use
|
|
explicitly selected capabilities during a fixed authorization window.
|
|
|
|
Default policy:
|
|
|
|
- Public URL: `https://tapm.scity.us`
|
|
- Authorization lifetime: 3 hours
|
|
- Host limit: 3
|
|
- Authentication: Gitea OAuth
|
|
- Shared state: MariaDB Galera
|
|
- Package storage: private Gitea Generic Package Registry
|
|
|
|
See [docs/deployment.md](docs/deployment.md) for installation and configuration.
|
|
The ProxMenu integration contract is documented in
|
|
[docs/client-api.md](docs/client-api.md).
|
|
|
|
## Components
|
|
|
|
- `cmd/server`: portal, OAuth flow, authorization API, uploads, and downloads
|
|
- `cmd/migrate`: ordered MariaDB schema migrations with an advisory lock
|
|
- `internal/app`: application, security, and registry proxy logic
|
|
- `deploy/nginx`: TLS reverse-proxy example
|
|
- `compose.yaml`: hardened, host-networked container deployment
|
|
|
|
## Local checks
|
|
|
|
```sh
|
|
docker run --rm -v "$PWD:/src" -w /src golang:1.24-alpine \
|
|
sh -c 'gofmt -w cmd internal && go test ./...'
|
|
docker build -t tai/tapm-deployment-broker:local .
|
|
```
|