44 lines
1.4 KiB
Markdown
44 lines
1.4 KiB
Markdown
|
---
|
||
|
|
id: surface.infotech.ops-bridge.tunnel-config
|
||
|
|
name: ops-bridge SSH tunnel configuration
|
||
|
|
kind: infra-state
|
||
|
|
summary: Declares the reverse SSH tunnels (local/remote port maps) that expose State Hub and MCP services to remote machines.
|
||
|
|
owner: ops-bridge
|
||
|
|
status: active
|
||
|
|
scope:
|
||
|
|
allowed_layers: [company, environment, installation]
|
||
|
|
default_layer: installation
|
||
|
|
mutability: deploy-time
|
||
|
|
security_class: operational
|
||
|
|
schema:
|
||
|
|
type: object
|
||
|
|
validator: ~/ops-bridge/schemas/tunnel.schema.yaml
|
||
|
|
sources:
|
||
|
|
- repo: ops-bridge
|
||
|
|
path: config/tunnels.yaml
|
||
|
|
role: installation-overlay
|
||
|
|
relations:
|
||
|
|
consumed_by:
|
||
|
|
- service.ops-bridge
|
||
|
|
overrides: []
|
||
|
|
depends_on_secret:
|
||
|
|
- ops-bridge/ssh-cert
|
||
|
|
related_to:
|
||
|
|
- surface.infotech.state-hub.api-config
|
||
|
|
evidence:
|
||
|
|
last_seen: '2026-06-26'
|
||
|
|
discovery_method: manual
|
||
|
|
change_log_ref: ATLAS-WP-0002-T03
|
||
|
|
---
|
||
|
|
|
||
|
|
# ops-bridge SSH tunnel configuration
|
||
|
|
|
||
|
|
ops-bridge maintains reverse SSH tunnels that expose the State Hub API and MCP
|
||
|
|
endpoints to remote machines (the remote port map: State Hub API `:18000`, MCP
|
||
|
|
`:18001`). This surface maps that tunnel configuration as **infra-state**.
|
||
|
|
|
||
|
|
- **Source of truth:** the `ops-bridge` repo tunnel config; SSH certs are a secret
|
||
|
|
reference (`depends_on_secret`), signed by ops-warden, never stored here.
|
||
|
|
- **Relation:** exposes `surface.infotech.state-hub.api-config` to remote workers.
|
||
|
|
- **Mutability:** deploy-time — tunnel changes are brought up via `bridge up`.
|