Phase 4: service store — manifest validation, install/remove, Store UI · 0a21f22076 - pic

roof/pic

Phase 4: service store — manifest validation, install/remove, Store UI

- ServiceStoreManager: manifest allowlist (git.pic.ngo/roof/*), volume
  denylist, ACCEPT-only iptables rules, ${SERVICE_IP}-only dest_ip
- IP allocator: pool 172.20.0.20-254, skips CONTAINER_OFFSETS VIPs
- Compose overlay: docker-compose.services.yml auto-included via DCF
- Flask blueprint at /api/store: list, install, remove, refresh
- Store.jsx: full install/remove UI with spinners and toast notifications
- 95 new unit tests for ServiceStoreManager (all passing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This commit is contained in:

Dmitrii Iurco

2026-05-09 10:19:39 -04:00

parent f77d7fabcd

commit 0a21f22076

14 changed files with 2190 additions and 12 deletions

									
										docker-compose.services.yml
									
		+6
		
												View File
												
				@@ -0,0 +1,6 @@

				version: '3.3'

				services: {}

				networks:

				  cell-network:

				    external: true

				    name: pic_cell-network