ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add the enrollment page, move scripts to per-PC credentials, and document the rollout
Some checks failed
CI / backend (push) Has been cancelled
Details
CI / naming (push) Has been cancelled
Details
CI / gates (push) Has been cancelled
Details
CI / frontend (push) Has been cancelled
Details
CI / lean-build (push) Has been cancelled
Details

Browse Source 
- Settings > Endpoints > Enrollment. Migration tab: readiness counts and
  progress, each PC's state with the reasons it is blocked, "Upgrade
  selected" and "Upgrade next 25", and live wave progress. Credentials tab:
  enrolled PCs with revoke, pending requests with approve and reject, and the
  shared key and auto-enroll switches. Turning the shared key off asks for
  confirmation and shows how many PCs are not enrolled.
- The server certificate page shows the SPKI pin to put in the GE-Enforce
  pin entry.
- The agent upgrade script and the asset and printer reporters send the PC's
  credential when it has one (over https, only to the issuing server), fall
  back to the shared key, check server pins, and log refusals clearly.
- New Set-ShopDBServerPins.ps1 (GE-Enforce entry) and Get-ShopDBServerPin.ps1.
- AGENT-CONTRACT.md documents per-PC credentials; the rollout runbook covers
  phases, gates, rollback, pin and wave entries, and every place the shared
  key lives and how to clear it at cutover.
- Removed the 09-14 certificate design notes and dated session reports, and
  two VM notes that carried a live collector key and advised plain http.
- Corrected the GE-Enforce collector note, which claimed a plain registry
  token is protected by ACL.
This commit is contained in:
cproudlock
2026-09-15 12:04:12 -04:00
parent a4c4bd1f40
commit 8b144a17bb
26 changed files with 2769 additions and 4058 deletions
Download Patch File Download Diff File Expand all files Collapse all files

199
agent/INSTALL-ON-VM.md
View File

@@ -1,199 +0,0 @@
# Install ShopDB Agent on Hyper-V VM
This guide shows how to install the fleet agent on your Hyper-V VM to report back to ShopDB running on the host PC.
## Configuration for Your Setup
**ShopDB Server (Host PC):**
- URL: `https://172.31.96.1:5001`
- Collector API Key: `shopdb_pat_b4a3fe2a01abc6bc1cb685280e65a8c35d52ec43`
**VM Network:**
- VM can reach host at: `172.31.96.1`
- Host's Hyper-V virtual adapter IP
---
## Step 1: Build the Agent (On Host PC)
**Install .NET SDK first:**
```powershell
# On Host PC (this machine):
winget install Microsoft.DotNet.SDK.8
```
**Build agent executables:**
```powershell
cd C:\Users\270015376\Documents\github\flask-shopdb\agent
# Build service
dotnet publish ShopDbEndpointAgent -c Release -r win-x64 --self-contained -o C:\temp\shopdb-agent
# Build tray app (optional)
dotnet publish ShopDbEndpointAgent.Tray -c Release -r win-x64 --self-contained -o C:\temp\shopdb-agent-tray
# Package for VM
Compress-Archive -Path C:\temp\shopdb-agent -DestinationPath C:\temp\shopdb-agent.zip
```
---
## Step 2: Copy to VM
**Copy the ZIP to your VM:**
- Via RDP shared folder
- Via network share
- Via USB
**Extract on VM:**
```powershell
# On VM:
Expand-Archive C:\path\to\shopdb-agent.zip -DestinationPath C:\ProgramData\ShopDB\EndpointAgent
```
---
## Step 3: Configure Agent (On VM)
**Set registry configuration:**
```powershell
# Run as Administrator on VM:
New-Item -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Force | Out-Null
# Point to HOST PC's IP (not localhost!)
Set-ItemProperty -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Name 'BaseUrl' -Value 'https://172.31.96.1:5001'
# Use the collector key
Set-ItemProperty -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Name 'CollectorKey' -Value 'shopdb_pat_b4a3fe2a01abc6bc1cb685280e65a8c35d52ec43'
```
---
## Step 4: Test Agent (On VM)
**Test one report:**
```powershell
cd C:\ProgramData\ShopDB\EndpointAgent
.\shopdb-endpoint-agent.exe --once
```
**Expected output:**
```
[INFO] Agent starting...
[INFO] Collecting endpoint state...
[INFO] Reporting to https://172.31.96.1:5001/api/collector/endpoints
[INFO] Report successful
```
**If you see SSL certificate errors:**
The self-signed cert will cause warnings. You can either:
- Ignore them (agent still works)
- Or use HTTP (not recommended): `http://172.31.96.1:5001`
---
## Step 5: Install as Service (On VM)
**Create Windows service:**
```powershell
# Run as Administrator on VM:
sc.exe create "ShopDBEndpointAgent" `
binPath= "C:\ProgramData\ShopDB\EndpointAgent\shopdb-endpoint-agent.exe" `
start= auto `
DisplayName= "ShopDB Endpoint Agent"
sc.exe description "ShopDBEndpointAgent" "Reports endpoint telemetry to ShopDB server."
# Start the service
sc.exe start "ShopDBEndpointAgent"
```
**Check service status:**
```powershell
Get-Service ShopDBEndpointAgent
```
---
## Step 6: Verify on Host PC
**Check ShopDB received the report:**
1. Open: `https://localhost:5001/computers`
2. Look for your VM's hostname
3. Click on it to see endpoint data
**Or check logs:**
```bash
# On host PC:
docker logs flask-shopdb-api-1 | grep -i "collector/endpoints"
```
---
## Troubleshooting
### Agent can't reach server
**Test connectivity from VM:**
```powershell
# On VM:
Test-NetConnection -ComputerName 172.31.96.1 -Port 5001
```
**If blocked by firewall:**
```powershell
# On Host PC, allow inbound:
New-NetFirewallRule -DisplayName "ShopDB API" -Direction Inbound -LocalPort 5001 -Protocol TCP -Action Allow
```
### SSL certificate errors
The agent works even with self-signed cert warnings. To eliminate them:
**Option 1: Use HTTP (dev only)**
```powershell
Set-ItemProperty -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Name 'BaseUrl' -Value 'http://172.31.96.1:5001'
```
**Option 2: Trust the cert**
- Export cert from host
- Import to VM's Trusted Root
### Agent reports but PC doesn't appear
**Check collector key matches:**
```powershell
# On VM:
Get-ItemProperty -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Name 'CollectorKey'
# Should match what's in ShopDB .env:
# shopdb_pat_b4a3fe2a01abc6bc1cb685280e65a8c35d52ec43
```
---
## Uninstall
```powershell
# Stop and remove service
sc.exe stop "ShopDBEndpointAgent"
sc.exe delete "ShopDBEndpointAgent"
# Remove files
Remove-Item -Recurse C:\ProgramData\ShopDB\EndpointAgent
# Remove registry
Remove-Item -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Recurse
```
---
## Quick Reference
**Host IP:** `172.31.96.1`
**ShopDB URL:** `https://172.31.96.1:5001`
**Collector Key:** `shopdb_pat_b4a3fe2a01abc6bc1cb685280e65a8c35d52ec43`
**Agent Location:** `C:\ProgramData\ShopDB\EndpointAgent\`
**Service Name:** `ShopDBEndpointAgent`
**Report Interval:** 15 minutes (configurable in appsettings.json)

51
agent/QUICK-FIX-VM.md
View File

@@ -1,51 +0,0 @@
# Quick Fix: Agent Can't Connect from VM
## Problem
SSL certificate errors when connecting from VM to host.
## Solution: Use HTTP on Local Network
Since the VM and host are on a trusted local network (Hyper-V), use HTTP instead of HTTPS.
### On VM - Set HTTP in Registry:
```powershell
# On VM (as Administrator):
New-Item -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Name 'BaseUrl' -Value 'http://172.31.96.1:5001'
Set-ItemProperty -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Name 'CollectorKey' -Value 'shopdb_pat_b4a3fe2a01abc6bc1cb685280e65a8c35d52ec43'
```
### Test it works:
```powershell
# On VM:
curl.exe http://172.31.96.1:5001
# Should return HTML
```
### Then run the agent:
```powershell
cd C:\ProgramData\ShopDB\EndpointAgent
.\shopdb-endpoint-agent.exe --once
```
## Why HTTP is OK Here
- [X] VM and host on same physical machine (Hyper-V)
- [X] Traffic never leaves the host
- [X] Hyper-V internal network is isolated
- [X] No external network exposure
For production multi-machine deployment, use HTTPS with proper certificates.
## Alternative: Fix HTTPS (More Complex)
If you need HTTPS:
1. Export the self-signed cert from host
2. Import to VM's Trusted Root Certification Authorities
3. Use HTTPS URL
See main INSTALL-ON-VM.md for details.