shadowdaoandClaude Sonnet 5.5
d07030a10b
Linux packages: migrate /etc/boundary.d to /etc/threshold.d without clobbering, reuse the boundary service user, carry over service enablement with a boundary.service alias, provide a boundary command. Docker: accept /boundary/config.hcl, boundary command, /boundary symlink. CLI: deprecation notice when invoked as boundary (stderr only). Dev mode: also create *.threshold.dev aliases. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
128 lines
4.3 KiB
Markdown
128 lines
4.3 KiB
Markdown
<!---
|
|
This is used for the Overview tab for the threshold docker image on hub.docker.com
|
|
https://repo.anhonesthost.net/CyberCoveLLC/threshold
|
|
--->
|
|
|
|
# Threshold
|
|
|
|
## Usage
|
|
|
|
See the latest updates to the Dockerfile for this image in our
|
|
[repository](https://repo.anhonesthost.net/CyberCoveLLC/threshold).
|
|
|
|
### Dev Mode
|
|
|
|
Due to the limitations of `threshold dev` running and maintaining a postgres docker container,
|
|
it's not recommended to run `dev` mode inside docker.
|
|
To do so will require knowledge of running [docker-in-docker](https://hub.docker.com/_/docker),
|
|
and the caveats associated with it.
|
|
|
|
### Default Configuration
|
|
|
|
The default behavior of the Threshold docker image is to run `threshold server -config /threshold/config.hcl`.
|
|
The included `config.hcl` file is meant to serve as an example,
|
|
and is not suitable for actual deployment.
|
|
Please see the comments within the file for more information;
|
|
full configuration details can be found on Threshold's documentation site.
|
|
|
|
#### Upgrading from the HashiCorp Boundary image
|
|
|
|
The configuration directory moved from `/boundary` to `/threshold`. For
|
|
compatibility, `/boundary` is a symlink to `/threshold` inside the image, a
|
|
`-config /boundary/config.hcl` argument (or a config mounted at
|
|
`/boundary/config.hcl`) is still honored with a deprecation warning, `boundary`
|
|
is accepted as a command name, and `BOUNDARY_*` environment variables are
|
|
mirrored to `THRESHOLD_*`. Please migrate your mounts and arguments to the
|
|
`/threshold` and `THRESHOLD_*` names.
|
|
|
|
### Postgres
|
|
|
|
The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run threshold server with.
|
|
If you want to get started quickly, you can start a local postgres in docker:
|
|
|
|
```bash
|
|
docker run -it -p 5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres postgres
|
|
```
|
|
|
|
The postgres URL setting is defined with `env://THRESHOLD_POSTGRES_URL` so it can be easily set with `-e` during docker run:
|
|
|
|
```bash
|
|
docker run \
|
|
--network host \
|
|
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
|
repo.anhonesthost.net/cybercovellc/threshold
|
|
```
|
|
|
|
### Database Init
|
|
|
|
If you're starting with a new,
|
|
unused postgres instance,
|
|
initialize the database using the default `config.hcl`:
|
|
|
|
```bash
|
|
docker run \
|
|
--network host \
|
|
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
|
repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl
|
|
```
|
|
|
|
If you want to run this with your own `config.hcl` (assuming `config.hcl` is located at `$(pwd)/config.hcl`):
|
|
|
|
```bash
|
|
docker run \
|
|
--network host \
|
|
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
|
-v "$(pwd)":/threshold/ \
|
|
repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl
|
|
```
|
|
|
|
### Database Migration
|
|
|
|
If you are updating to a newer version of threshold with a database instance
|
|
that was initialized with an older version,
|
|
you will need to apply the database migrations:
|
|
|
|
```bash
|
|
docker run \
|
|
--network host \
|
|
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
|
repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl
|
|
```
|
|
|
|
If you want to run this with your own `config.hcl` (assuming `config.hcl` is located at `$(pwd)/config.hcl`):
|
|
|
|
```bash
|
|
docker run \
|
|
--network host \
|
|
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
|
-v "$(pwd)":/threshold/ \
|
|
repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl
|
|
```
|
|
|
|
### Server
|
|
|
|
Start a Threshold server using the default `config.hcl`:
|
|
|
|
```bash
|
|
docker run \
|
|
--network host \
|
|
-p 9200:9200 \
|
|
-p 9201:9201 \
|
|
-p 9202:9202 \
|
|
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
|
repo.anhonesthost.net/cybercovellc/threshold
|
|
```
|
|
|
|
Start a Threshold server using your own `config.hcl`, assuming it's located at `$(pwd)/config.hcl`:
|
|
|
|
```bash
|
|
docker run \
|
|
--network host \
|
|
-p 9200:9200 \
|
|
-p 9201:9201 \
|
|
-p 9202:9202 \
|
|
-v "$(pwd)":/threshold/ \
|
|
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
|
repo.anhonesthost.net/cybercovellc/threshold
|
|
```
|